Privacy policy

1. What we collect

• Account details from Google, LINE or TikTok when you choose to sign in, such as your user ID, display name, and email or profile picture, as far as the provider shares them.
• When you sign in with TikTok, we ask only for your basic profile (user.info.basic) and use just your user ID, display name and profile picture, to link your RAYA account and show them on your profile page. The TikTok access token is used once, at sign-in, and is not kept. We don’t post to TikTok, don’t read your videos or followers, and don’t share TikTok data with third parties.
• Your design projects, room layouts, materials, BOQs and the business details you enter yourself.
• If you own a Studio plan, the email addresses of the people you invite to your organization. We use them only to send the invitation, and keep them hashed with a partly hidden form (such as a***@example.com) so the owner can see who was invited.
• Technical data needed to run the service and keep it secure, such as transaction times, sync status and service error logs.

2. What we use it for

To provide the design service, save and sync your work, create documents, keep things secure and fix problems you report. We do not sell personal data. On a Studio plan, the members of an organization share its credits and picture storage and can open the projects saved in the organization's space; each person's personal projects are not shared with the other members.

3. Where it is stored

If you don’t sign in, your work stays in that device’s browser. When you sign in, projects and your business profile sync to Google Firebase. LINE, Google and TikTok handle sign-in under their own policies, and the LINE and TikTok connections run on Cloudflare Workers. These providers may process data outside Thailand.

The outside services RAYA uses, and what each one receives:

• Google Firebase stores your account, projects, business profile, credit balance and purchase history.
• Cloudflare (Workers and R2) runs LINE and TikTok sign-in, payments and credits, and stores the pictures made with RAYA credits.
• Stripe takes payments. It receives the name, email and card or PromptPay details you enter on Stripe’s checkout page. RAYA never sees your card number.
• OpenAI makes the pictures you pay for with RAYA credits. It receives the clay image, any reference images you attach and the prompt (see section 5).
• Resend sends payment receipts, the reminder before a free trial ends, the reminder before a 30-day PromptPay pass ends, email verification codes and Studio organization invitations. It receives the recipient's email address and the content of that email.
• LINE handles LINE sign-in. If you sign in with LINE, we also send payment, trial and 30-day PromptPay pass reminders to you on LINE.

We use localStorage and sessionStorage to keep your work, your trial status, the version of the terms and the date you accepted them, and a sign-in check code that lasts no more than 10 minutes. Clearing your browser data can lose work that has not synced, and you will be asked to accept the terms again. The sign-in service’s cookies are used to keep sign-in secure.

4. Analytics and advertising cookies

These cookies only run after you tap “Accept” on the cookie banner. If you don’t accept, every feature still works. Once you accept, the website and the app load Google Analytics and Meta Pixel to count which post or ad people came from and where they drop off: opening the app, signing in, creating a first room, tapping to download a document without a plan, and a completed payment. For payments we send only the plan name and the amount, never your name, email or design work. Both providers receive the device and browser information these tools usually collect, and may process it outside Thailand under their own policies.

If you arrive from a link with a campaign or discount code (such as ?utm_source= or ?code=), your browser remembers it to fill in the code at checkout, and sends the campaign code with the data above only if you accept.

You can change your mind any time in cookie settings. Withdrawing consent stops these tools loading from the next page on and deletes their cookies on this domain.

5. Sending data to AI

When you make a picture with RAYA credits, the clay image, any reference images you attach and the prompt go to OpenAI through our servers, along with a hashed account ID (not your name or email) so OpenAI can deal with misuse.

If you enter your own API key (OpenAI or Google Gemini), your browser sends the same data straight to that provider under your account, and the key stays in that browser only. Please keep your clients’ sensitive information out of pictures and prompts.

6. Retention and security

We keep data only as long as the purposes above need it, and use authentication and access rules to keep each account’s data apart. No online system is 100% secure, so always keep copies of important files.

7. Your rights and contact

You can ask to access, correct, object to, restrict, transfer or delete your personal data as the law provides. Send requests to admin@raya-studio.com and say clearly which account and what you are asking for.