This policy explains what Rayzia ("we") collects when you use Rayzia, why, and your rights. The short version: your designs stay on your device and reach our servers only when you save them to the cloud. We collect the minimum needed to run accounts, cloud sync, and billing; we don't sell data or run ad tracking.
1. What we collect
- Your designs stay on your device by default. Documents live in your browser's local storage and reach our servers only when you save one to the cloud.
- Account data: your email, display name and, if you use Google sign-in, your Google avatar and account identifier. If you set a password, we store only a salted, one-way hash of it (PBKDF2), never the password itself. We also keep when you signed up and, if you allowed it on the cookie banner, how you first found Rayzia (the website or campaign that sent you and the first page you saw).
- Your documents: files you sync to the cloud while signed in, their names, sizes, and revision history per your plan.
- Billing data: handled by Paddle, our merchant of record. We receive subscription status and plan; we never see your card number.
- Bug reports: only when you submit one, the description, a screenshot of the editor, and technical context you attach.
- Technical logs: aggregate usage analytics (page views, country, device type) via Cloudflare and Google Analytics, and short-lived security logs. We use these as statistics, not to profile you.
- Editor usage log (signed-in accounts only): while you are signed in, the editor keeps a log of how the app is used, tied to your account. It records each editor session (when it started and was last active, the mode it opened in, a coarse device class, operating system, browser, the interface language and your country as Cloudflare reports it), the days you were active, and counts and labels of what you used: modes (Design, Vector), tool names, export formats (for example PNG or PDF), the catalogue ids of library items and templates you placed, the operations an outside agent ran through Agent Connect, and error messages with addresses, quoted text and long numbers removed. It never contains your drawings, file or layer names, text you typed or colours. When you are signed out nothing is kept.
2. Why (legal bases)
- Operating the Service you asked for: accounts, sync, sharing, billing (performance of contract).
- Transactional email such as sign-in links and billing notices (performance of contract).
- Security, abuse prevention and fixing bugs (legitimate interest).
- Analytics through Google Analytics, and remembering how you found us: only if you accept them on the cookie banner (consent). You can withdraw consent at any time from Cookie settings in the footer or the Privacy section of your Account page.
- The editor usage log: to see which tools and features people actually use, find what breaks, and decide what to build and fix next (legitimate interest). We read it inside Rayzia only; it is not shared with anyone for advertising and is not sold.
- We do not use your content to train AI models, sell personal data, or build advertising profiles.
3. Who processes data for us
| Processor | Purpose | Where |
|---|---|---|
| Cloudflare | Hosting, storage of cloud documents, security, analytics | Global edge network |
| Paddle | Payments, tax, invoices (merchant of record) | UK / US |
| Resend | Transactional email (sign-in links) | US / EU |
| Sign-in (only when you choose "Continue with Google") and aggregate usage analytics (Google Analytics) | Global |
4. Retention
- Account and cloud documents: kept while your account is active. When your account is deleted, they are deleted at once, and the last copies in our database's recovery history are gone within 30 days. Payment records are kept as described below.
- Revisions of a cloud document: on our servers we keep the latest saved copy on Free and up to the last 30 on Pro. They are deleted with the document or your account. The app has no screen for opening an earlier one.
- Billing records: kept as long as tax law requires (by Paddle and in our subscription ledger).
- Editor usage log: session rows and the per-day counts of tools, modes, exports, library items, Agent Connect operations and errors are deleted after about 400 days (13 months). The list of days you were active is kept while your account exists. All of it is deleted when your account is deleted.
- Share links you disable die immediately; re-enabling issues a new URL.
5. Your rights
You can access and export your documents at any time from your account, and delete individual files or your whole account. To delete your account, open Delete account on your Account page: we email a link to your address to confirm, and a paid subscription has to be canceled first. Under GDPR, Thailand's PDPA, and similar laws you may also request access, correction, deletion, or portability of your personal data, and you may lodge a complaint with your supervisory authority. Write to support@rayzia.com and we respond within 30 days.
To delete your editor usage log, write to support@rayzia.com from your account's email and ask for it: we delete the log and keep your account and files. Deleting your account deletes the log with it.
6. Cookies and browser storage
Rayzia stores a few small things in your browser. Some are needed for the site to work, and they are always on. Others help us understand how the site is used, and they stay off until you choose to turn them on.
Your choice. The first time you visit, a banner asks you to Accept or Reject. Rejecting is as easy as accepting, and the site works the same either way. You can change your choice at any time from Cookie settings in the footer of every page, or from the Privacy section of your Account page. Your choice is saved in this browser for 12 months; after that, or if we add a new kind of optional cookie, we ask again.
Always on (needed for the site to work)
| Name | What it does | How long |
|---|---|---|
rz_sess | Keeps you signed in. It cannot be read by scripts on the page. | 30 days from sign-in |
rz_auth | Tells the page you are signed in, so the "Sign in" link does not flash. It holds no personal data. | 30 days from sign-in |
rz_oauth_state | Protects "Continue with Google" against forged requests. Set only when you choose it. | 10 minutes |
rz_sv | Remembers the items you saved with the heart on Rayzia Stock while signed out. Set only when you press the heart. | 400 days |
rz_consent | Remembers your cookie choice. | 12 months |
We also use your browser's local storage for things you would expect a design app to remember: your documents (until you save them to the cloud), your theme, your panel layout, your recent colours and fonts, and the items in your library. This never leaves your device unless you save to the cloud. If you file a bug report, we keep an id in this browser so you can see your reports again later.
Off until you accept
| Name | Who | What it does | How long |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Counts visits, pages and devices, so we can see how the site is used. We do not send it your name or email, and we do not use it for advertising. | Up to 13 months |
rz_attr | Rayzia | Remembers how you first arrived: the website, search or campaign link that brought you, and the first page you saw. If you create an account, this is stored with it so we know which channels are worth our time. It is never shared or sold. | 6 months (if you create an account, a copy is kept with it) |
Without cookies
Our hosting provider counts page views without cookies and without identifying you, to keep the site running and secure.
Things we load from other services
Some parts of the site load files from other services, which then receive your IP address and browser details as any web request does: fonts (from Google Fonts and, in the editor, from public font CDNs), the payment provider (only when you open checkout), Google (only when you choose Google sign-in or Google Drive) and image libraries (only when you search for photos).
7. Security
All traffic is encrypted (TLS). Sign-in links are single-use, short-lived, and stored only as hashes. Shared documents are served in a way that prevents them from running code on our domain. Access to production data is limited to what operating the Service requires.
8. Children
The Service is not directed at children under 13 (or the higher age your country requires for consent). Don't create an account if you're under that age.
9. Changes & contact
We'll announce material changes to this policy by email or in-product. Questions or requests: support@rayzia.com.