Privacy Policy

1. Our Dual Role & GDPR Article 6 Legal Bases

Under European Data Protection Law (GDPR / UK GDPR) and applicable international privacy frameworks:

• Erayaha as Data Controller: We act as a Data Controller for Account Registration PII, customer billing information, business inquiries, and aggregated platform telemetry.
• Erayaha as Data Processor: We act as a Data Processor on behalf of our enterprise and individual customers regarding any Customer Document Content or personal data contained within agreements uploaded or analyzed via the Service. All such processing is governed by our Data Processing Agreement (DPA).

2. Information We Collect & Process

We strictly categorize the data processed by our systems into three separate tiers:

3. Zero Model Training Warranty

We strictly warrant that we do not use Customer Inputs, Customer Outputs, or confidential contract data to train, fine-tune, or calibrate foundational AI models. Our downstream inference providers (such as AWS Bedrock) operate under binding enterprise B2B covenants prohibiting any training or data logging on user prompts.

4. Zero Website Tracking, Cookie Disclosure & Opt-Out Signals

Our website (erayaha.ai) is statically hosted on Cloudflare's global edge network. We maintain a strict privacy-first posture:

• Zero Tracking Scripts & No Analytics Cookies: We do NOT use Google Analytics, tracking pixels, behavioral advertising cookies, Facebook Pixels, or cross-site tracking scripts. Our marketing pages do not track visitors or build behavioral profiles.
• Universal Opt-Out & GPC Signals: We honor the Global Privacy Control (GPC) and universal browser opt-out signals automatically across all endpoints.
• Direct Inquiry Submissions: When you submit an optional pilot or enterprise inquiry, your submission is transmitted directly over encrypted TLS 1.3 solely to communicate with you regarding your inquiry. We never sell, rent, or broker contact data.

5. Authorized Subprocessors

We engage the following trusted infrastructure subprocessors to provide core hosting, identity, and AI reasoning capabilities with minimum operational overhead and maximum security compliance:

6. International Data Transfers & Standard Contractual Clauses

When personal data is transferred outside the European Economic Area (EEA), United Kingdom, or Switzerland, Erayaha relies on the European Commission's approved Standard Contractual Clauses (EU SCCs 2021/914) and the UK International Data Transfer Addendum, supplemented by technical safeguards including AES-256 encryption in transit and at rest.

7. Your Privacy Rights & Supervisory Authorities (GDPR, UK GDPR, CCPA/CPRA, India DPDP)

Depending on your jurisdiction, you possess the following rights regarding your personal account data:

• Right of Access & Portability: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your user account records within thirty (30) days without charge.
• Right to Restrict or Object to Processing: Object to processing based on legitimate interests.
• No Sale or Targeted Advertising: We certify that Erayaha does NOT "sell" or "share" personal data or conduct cross-context behavioral advertising.
• No Automated Profiling: We do NOT subject consumers to automated decision-making or profiling producing legal effects.
• India DPDP Act 2023 Rights: For users in India, Erayaha acts as a Data Fiduciary regarding user account PII and authentication credentials, and as Data Processor for Customer Document Content. Data Principals may exercise statutory rights to access, correction, and grievance redressal via privacy@erayaha.ai, with right to escalate to the Data Protection Board of India.
• Non-Discrimination: We will never discriminate against you for exercising any applicable privacy rights.
• Right to Lodge Complaints with Supervisory Authorities: You have the right to lodge a complaint with a competent supervisory authority:
  • European Union / EEA: The Data Protection Commission of Ireland (Irish DPC) as our lead supervisory authority, or your local national Data Protection Authority.
  • United Kingdom: The Information Commissioner's Office (UK ICO).
  • India: The Data Protection Board of India (DPBI).
• Appeals Process: If we decline to take action regarding your request, you may appeal within thirty (30) days by contacting our Legal Department at legal@erayaha.ai.

To exercise any of these rights, contact our Data Protection Office at privacy@erayaha.ai.

8. Data Retention Schedule, Sensitive Data & Children's Privacy

We enforce strict data retention schedules across all operational data stores:

• No Sensitive, Biometric or Health Data: Erayaha does not knowingly collect, process, or sell sensitive personal information, biometric identifiers (under Illinois BIPA or similar laws), or consumer health data (under Washington MHMDA or Nevada SB 370).
• Children's Privacy (COPPA): The Service is an enterprise B2B platform intended solely for business users aged 18 and older, and does not knowingly collect personal data from children under 16.