Raya Privacy Policy
Version of: 6 October 2026 The Polish version is the binding version. Versions in other languages are translations.
This policy explains what personal data we process when you use the Raya service (https://raya.design) and the Raya Plug-ins for design software. It also explains why we process it, who we share it with, how long we keep it and what rights you have. Capitalised terms have the meaning given to them in the Terms of Service.
1. Data controller
The controller of your personal data is Mateusz Ciećwierz, conducting business under the name Red Gear Mateusz Ciećwierz, ul. Żytnia 1B, 05-825 Grodzisk Mazowiecki, Poland, Polish tax ID (NIP): 7742958423, REGON: 146168551 ("we", "us").
For any matter concerning personal data, write to hello@raya.design or by post to the address above. We have not appointed a data protection officer.
2. Where we get your data from
- From you: when you create an Account, upload materials, buy a Subscription, contact us or subscribe to the newsletter.
- From Google: when you sign in with a Google account, we receive your e-mail address, name and profile picture.
- From the payment provider: payment data and the billing details entered on the payment page.
- Automatically: technical data collected while you use the Service and the Plug-ins, as described below.
3. What data we process, why, and for how long
| Purpose | Data | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Maintaining your Account | e-mail address, name and profile picture (when signing in with Google), language, sign-in method, Credit balance and history | Art. 6(1)(b) - performance of a contract | until the Account is deleted, then until the limitation period for claims expires |
| Providing the AI Features | Input Materials (photos, floor plans, sketches, viewport captures, reference images, prompts, annotations), Outputs, generation parameters, information on which Plug-in or app you use | Art. 6(1)(b) - performance of a contract | up to 12 months from generation |
| Payments, invoices and tax settlement | name or company name, billing address, tax/VAT number and its VIES verification result, amount, currency, date and status of payment, transaction IDs. We do not have access to your full card details | Art. 6(1)(b) and (c) - performance of a contract and legal obligations (tax and accounting law) | 5 years from the end of the tax year in which the invoice was issued |
| Handling support requests, complaints and the contact form | name, e-mail address, message content and attachments, IP address and browser data and, where needed, related generations | Art. 6(1)(b) and (f) - performance of a contract and our legitimate interest in responding | until the matter is closed, then until the limitation period for claims expires |
| Security and abuse prevention | IP address, browser and operating system type, browser language, sign-in dates, device identifier and browser fingerprint (for Users without a paid Subscription), whether the connection comes from a VPN or data centre, the result of an automated abuse-risk assessment, data from bot protection | Art. 6(1)(f) - our legitimate interest in protecting the Service and preventing repeated use of Free Credits | for the lifetime of the Account, then until the limitation period for claims expires |
| Plug-ins | device name, hashed access key, date of last use, IP address and request type each time the key is used | Art. 6(1)(b) and (f) - performance of a contract and security | until the key expires or is revoked; the usage log until the limitation period for claims expires |
| Referral Programme | referral code, who referred whom, date the referral was attributed, rewards granted | Art. 6(1)(b) - performance of a contract | for the lifetime of the Account, then until the limitation period for claims expires |
| Evaluating and improving the quality of the Service | Output ratings and comments you submit, information on errors and failed generations | Art. 6(1)(f) - our legitimate interest in improving our services | up to 12 months from generation |
| Newsletter | e-mail address, first name, language, date and IP address of sign-up | Art. 6(1)(a) - consent; proof of consent: Art. 6(1)(f) | until consent is withdrawn; proof of consent until the limitation period for claims expires |
| Account and payment messages (e.g. failed payment, referral reward) | e-mail address, first name, transaction data | Art. 6(1)(b) - performance of a contract | as for the Account |
| Analytics and marketing | data from cookies and similar technologies (section 7) and, on purchase: hashed e-mail address, name, city, postcode and country, Account ID, IP address, browser data, purchase value and type | Art. 6(1)(a) - consent | until consent is withdrawn, no longer than the cookie lifetime |
| Establishing, exercising or defending legal claims | data needed to establish the claim | Art. 6(1)(f) - our legitimate interest | until the limitation period for claims expires |
Providing data is voluntary, but without the data necessary to maintain the Account and process payments we cannot provide our services.
4. Artificial intelligence and your materials
- We pass Input Materials and prompts to third-party artificial intelligence model and cloud computing providers solely to perform the operation you request.
- We do not use your materials or Outputs to train artificial intelligence models. The providers we use are contractually bound not to do so either, and to protect data to at least the standard described in this policy.
- When responding to support requests, we may use AI tools that help draft a reply based on the request and related generations. Every reply is reviewed and sent by a human.
- Authorised persons acting on our behalf may view Input Materials and Outputs where this is needed for technical support, handling complaints, security or quality control.
- Files of Input Materials and Outputs are served at unique, hard-to-guess web addresses. Anyone who knows such an address can open the file. Do not share these addresses with anyone who should not have access to the files.
- We do not use uploaded files to identify people or for biometric purposes. Please do not upload images showing people, health data or other special categories of data.
5. Plug-ins for design software
The Raya Plug-ins (e.g. for SketchUp, Autodesk® Revit®, Autodesk® 3ds Max®, Rhino, Archicad, pCon.planner) work as a window into the Service inside your design software.
- A viewport capture is sent to the Service only when you click the capture button. The Plug-in does not read or send project files, models or any other data from the software.
- The access key you receive after signing in is stored on your computer in encrypted form, in your Windows user profile. Settings (e.g. language) and the data of the browser built into the Plug-in are also stored on your computer.
- Update checks: the Plug-in sends us the name of the software it runs in and its own version to check whether a newer version is available. We do not store this data.
- Each use of the access key is recorded in a log (IP address, request type, time) for security purposes.
- You can sign out of the Plug-in at any time, which revokes the access key.
6. Who we share data with
We share your data only with parties that help us run the Service, and only to the extent needed for the given purpose:
- hosting, cloud infrastructure, database and file storage providers - the Service's database is located in the European Union (Ireland),
- artificial intelligence model and computing providers - they process Input Materials and prompts to produce Outputs,
- the payment provider Stripe - processes payments and stores payment card data,
- the provider of our invoicing system and our accounting services,
- e-mail and support system providers - sending and receiving messages,
- the newsletter platform provider - if you have subscribed to the newsletter,
- security providers - bot protection (captcha), rate limiting, and device recognition to prevent abuse,
- Google - Google sign-in (if you use it) and Google Analytics statistics (if you consent),
- Meta Platforms - the Meta pixel and Conversions API for measuring advertising effectiveness (if you consent),
- public authorities - where required by law.
Service providers process data on our instructions under data processing agreements or, where they act as separate controllers (e.g. the payment provider, Google, Meta), under their own privacy policies. On request, we will tell you who the specific recipients of your data are.
Transfers outside the European Economic Area. Some providers are based in or have servers outside the EEA, including in the United States and Asian countries. In such cases we transfer data on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses adopted by the European Commission. You can obtain a copy of the safeguards used by writing to hello@raya.design.
7. Cookies and similar technologies
We use cookies and browser local storage (localStorage). Strictly necessary cookies are always active. Analytics and marketing cookies are set only after you consent in the cookie banner. You can change or withdraw your consent at any time using the "Cookie settings" link in the page footer.
| Type | Purpose | Examples | Lifetime |
|---|---|---|---|
| Necessary | keeping you signed in | sign-in session cookies (sb-…-auth-token) | until you sign out or the session expires |
| Necessary | remembering your cookie choice | raya_consent | 12 months |
| Necessary | remembering your language | NEXT_LOCALE | until the browser is closed |
| Necessary | attributing referrals in the Referral Programme | ref | 60 days |
| Necessary | secure Plug-in sign-in | pa_claim_… | 5 minutes |
| Necessary | bot protection | Cloudflare Turnstile cookies | session |
| Necessary | interface settings and abuse prevention | local storage entries (e.g. panel state, whether a notice has been shown, device recognition flag) | until you delete them |
| Analytics | anonymous statistics on traffic and use of the Service | Google Analytics (_ga, _ga_…) | up to 2 years |
| Marketing | measuring advertising effectiveness and tailoring ads on Meta services | Meta pixel (_fbp, _fbc). When you are signed in, the pixel may receive your e-mail address in hashed form | up to 90 days |
You can also delete or block cookies in your browser settings. Blocking necessary cookies may prevent you from using the Service.
YouTube videos on our pages load in privacy-enhanced mode (youtube-nocookie.com) only after you click them.
8. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
To prevent abuse, we automatically assess the risk that the same person is creating multiple Accounts. The result of this assessment may restrict access to Free Credits but does not affect paid services. If you believe a restriction is wrong, contact us and a human will review it.
9. Your rights
You have the right to:
- access your data and receive a copy of it (Art. 15 GDPR),
- rectification of your data (Art. 16 GDPR),
- erasure of your data (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on our legitimate interest (Art. 21 GDPR),
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Art. 7(3) GDPR). You can unsubscribe from the newsletter using the link in every e-mail,
- lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (https://uodo.gov.pl), or with the supervisory authority in the EU country where you live or work.
To exercise these rights, write to hello@raya.design from the e-mail address linked to your Account. We will respond within one month. In particularly complex cases this period may be extended by a further two months, and we will let you know.
Deleting your Account and data. At your request we will delete your Account, Input Materials, Outputs and other data. We will keep only the data we are required to retain by law (e.g. invoices) or that is necessary to establish, exercise or defend legal claims, for the periods set out in section 3.
10. Security
We apply technical and organisational measures appropriate to the risk, in particular:
- encrypted connections (HTTPS),
- access control to our systems, limited to authorised persons,
- storing Plug-in access keys in hashed form only,
- password-free sign-in (e-mail link or Google account),
- rate limiting and bot protection.
The limitations on access to files through unique addresses are described in section 4.
11. Minors
The Service is intended only for persons aged 18 or over. We do not knowingly collect data from minors. If we learn that such data has been provided to us, we will delete it.
12. Changes to this privacy policy
We may change this privacy policy when the law, our services or our providers change. We will inform you of material changes by e-mail or in the Service at least 7 days before they take effect. The current version is always available at raya.design/en/privacy.
Autodesk, Revit and 3ds Max are registered trademarks or trademarks of Autodesk, Inc. and/or its subsidiaries and/or affiliates in the USA and/or other countries. Other product names are trademarks of their respective owners.