This policy explains what Rayzia ("we") collects when you use Rayzia, why, and your rights. The short version: your designs stay on your device and reach our servers only when you save them to the cloud. We collect the minimum needed to run accounts, cloud sync, and billing; we don't sell data or run ad tracking.
1. What we collect
- Your designs stay on your device by default. Documents live in your browser's local storage and reach our servers only when you save one to the cloud.
- Account data: email, display name, and (with Google sign-in) your Google avatar and account identifier. We never see or store a password.
- Your documents: files you sync to the cloud while signed in, their names, sizes, and revision history per your plan.
- Billing data: handled by Paddle, our merchant of record. We receive subscription status and plan; we never see your card number.
- Bug reports: only when you submit one, the description, a screenshot of the editor, and technical context you attach.
- Technical logs: aggregate usage analytics (page views, country, device type) via Cloudflare and Google Analytics, and short-lived security logs. We use these as statistics, not to profile you.
2. Why (legal bases)
- Operating the Service you asked for: accounts, sync, sharing, billing (performance of contract).
- Transactional email such as sign-in links and billing notices (performance of contract).
- Security, abuse prevention, debugging, and aggregate usage analytics (legitimate interest).
- We do not use your content to train AI models, sell personal data, or build advertising profiles.
3. Who processes data for us
| Processor | Purpose | Where |
|---|---|---|
| Cloudflare | Hosting, storage of cloud documents, security, analytics | Global edge network |
| Paddle | Payments, tax, invoices (merchant of record) | UK / US |
| Resend | Transactional email (sign-in links) | US / EU |
| Sign-in (only when you choose "Continue with Google") and aggregate usage analytics (Google Analytics) | Global |
4. Retention
- Account and cloud documents: kept while your account is active; permanently deleted within 30 days after account deletion.
- Version history: per your plan (Pro: 30 days of revisions).
- Billing records: kept as long as tax law requires (by Paddle and in our subscription ledger).
- Share links you disable die immediately; re-enabling issues a new URL.
5. Your rights
You can access and export your documents at any time from your account, and delete individual files or your whole account. Under GDPR, Thailand's PDPA, and similar laws you may also request access, correction, deletion, or portability of your personal data, and you may lodge a complaint with your supervisory authority. Write to [email protected] and we respond within 30 days.
6. Cookies
We set two first-party cookies of our own: rz_sess keeps you signed in, and rz_attr remembers how you first found us (for example a search engine or a link from another site) so we know which channels are worth our time. Neither follows you around the web.
We also use Google Analytics, which sets its own cookies (_ga and similar) to give us aggregate statistics about how the site is used. We use it for counting, not advertising, and we don't send it your name or email. You can block these cookies in your browser or with Google's opt-out add-on and the site works exactly the same. No advertising cookies, ever.
7. Security
All traffic is encrypted (TLS). Sign-in links are single-use, short-lived, and stored only as hashes. Shared documents are served in a way that prevents them from running code on our domain. Access to production data is limited to what operating the Service requires.
8. Children
The Service is not directed at children under 13 (or the higher age your country requires for consent). Don't create an account if you're under that age.
9. Changes & contact
We'll announce material changes to this policy by email or in-product. Questions or requests: [email protected].