Privacy Policy

Effective October 8, 2026

Your designs and your data are yours. This policy explains what rAI Optics LLC ("rAI Optics", "we", "us") collects when you use raioptics.app, the chat assistant, Lens Studio, and the rAITrace desktop app (the "Services"), why, who processes it for us, and what you can do about it. We do not sell or share your personal information for advertising, and we do not use your content to train AI models.

What we collect and why

We collect only what we need to run the Services.

Account

Your email address, and either a password (stored hashed by our authentication provider) or your Google account identifier if you sign in with Google. We use your email to sign you in, send receipts and security notices, and tell you about material changes to our terms. We record when you accepted our Terms and which version.

Billing

If you subscribe, Stripe collects your payment details and billing address directly — card numbers never reach our servers. We keep your Stripe customer and subscription identifiers, your plan, and its renewal date. If you linked a subscription bought on raioptics.com, we keep the Wix plan identifiers for it.

Your work

The messages you send the assistant, its replies, the designs and documents you create or import (including ZMX files), and your saved Studio systems. We store these so the Services work — so you can come back to a chat or design — for as long as your account exists or until you delete them.

AI processing

When you use the chat assistant, your messages, the relevant parts of your conversation, and the design data the assistant is working on are sent to our AI providers to generate a reply (see Subprocessors). Search text may be converted into embeddings to search the lens library. We ask our AI routing provider not to route requests to providers that retain or train on prompts, and our model providers do not train on API data. AI output can be wrong — see our Terms.

Usage

For each AI request we record the model, token counts, and cost against your account, to enforce plan limits and bill fairly. Our hosting provider keeps standard server logs (IP address, browser, pages requested, errors) for security and debugging.

Desktop app

When you sign in to rAITrace, we store a hashed device token, when it was created and last used, and whether it was revoked. Licence checks send that token; the desktop app does not send us your designs.

Website analytics and cookies

We use Vercel Web Analytics, which counts page views without cookies and without identifying you across sites. We set only the cookies the Services need:

We don't use advertising cookies, tracking pixels, or third-party ad networks.

Email you send us

If you email us, we keep the correspondence so we can help you and refer back to it.

Who we share it with

• Service providers that host, secure, and run the Services, process payments, or provide AI models. They may use your data only to provide their service to us. The current list is on our Subprocessors page.
• When required by law — a valid subpoena, court order, or similar legal process. Where we're allowed to, we will tell you first.
• To protect people and the Services — to investigate fraud, abuse, or security incidents.
• In a merger or sale of the company, in which case we will tell you before your information becomes subject to a different privacy policy.

Our staff look at your content only when you ask us for help, when an error requires it, or to investigate abuse.

How long we keep it

• Account, chats, designs: while your account exists. When you delete your account, we delete them from our database immediately and they leave our provider's database backups within 30 days.
• Billing records: Stripe and we keep transaction records as long as tax and accounting law requires (typically 7 years).
• Usage records: deleted with your account.
• Webhook and server logs: up to 90 days.

Your rights

Wherever you live, you can:

• Know and access what we hold about you — download it from Account → Preferences → Export my data.
• Correct it — update your details in your account, or email us.
• Delete it — Account → Delete account deletes your account and everything in it, cancels your subscription, and removes your billing customer from Stripe.
• Opt out of sale or sharing — we don't sell or share personal information for cross-context behavioral advertising, so there's nothing to opt out of.
• Not be discriminated against for exercising these rights.

California residents have these rights under the CCPA. In the last 12 months we collected the categories above (identifiers, commercial information, internet activity, and the content of your work) for the purposes above, and disclosed them only to the service providers listed on our Subprocessors page. We do not knowingly collect personal information from anyone under 18.

To exercise a right you can't use from your account, email nader.heidari@raioptics.com from the address on your account. We may need to verify your identity, and will respond within 45 days. An authorized agent needs your signed permission. If we deny a request, you can reply to appeal.

Security

Data is encrypted in transit (TLS) and at rest by our hosting and database providers. Passwords are hashed. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires.

Where your data is processed

We are a US company and the Services are hosted in the United States. If you use them from elsewhere, your information is transferred to and processed in the US.

Changes

We'll update the date at the top when this policy changes, and email account holders about material changes before they take effect.

Contact

rAI Optics LLC, California — nader.heidari@raioptics.com

Portions of this policy are adapted from 37signals' policies, licensed under CC BY 4.0.