Privacy policy

Who is responsible

Raywake, operated from Germany, is the controller for the personal data described here. For any privacy question or request, write to hello@raywake.com. We have not appointed a data protection officer, as the law does not require one for a business of our size.

What we collect and why

• Account details: your email address and, if you sign in with Google or GitHub, the name, email and profile picture they share. For email sign-in we store a salted hash of your password, never the password. Basis: performing our contract with you (GDPR Art. 6(1)(b)).
• What you create: prompts, settings, uploaded input files and the images, video and audio generated for you, with each generation’s model, status and credit cost. Basis: contract.
• Credits and payments: your credit balance and its history and the packs you buy. Stripe processes the payment; we receive its status, amount and currency, never your full card number. Basis: contract, and our legal duty to keep accounting records (Art. 6(1)(c)).
• API keys: a hash and a short prefix of each key you create; the full key is shown to you once. Basis: contract.
• Technical data: your IP address, to limit request rates and keep the service secure, and your country as reported by our network provider, to show prices in your region’s currency. Basis: our legitimate interest in a secure, correctly priced service (Art. 6(1)(f)).
• Emails you send us, and withdrawal declarations. Basis: contract and legal obligation.

We do not sell personal data, show ads or build advertising profiles, and we do not use your prompts, uploads or results to train models. Account and payment details are needed to provide the service; without them we cannot open an account or sell credits. We do not make decisions about you based solely on automated processing.

Who processes it for us

These providers process data on our behalf under data processing agreements, or as independent controllers where they say so (for example Stripe for fraud prevention):

AI model providers receive only the prompt, settings and input files of a generation you start, to produce its result. Where data leaves the EU/EEA, we rely on the European Commission’s adequacy decision (including the EU–US Data Privacy Framework for certified providers) or on Standard Contractual Clauses. You can ask us for a copy of the safeguards.

How long we keep it

Cookies

We only use cookies that are strictly necessary: to keep you signed in, protect sign-in forms and remember security state. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent (§ 25(2) TDDDG).

Your rights

You can ask to access, correct, delete or export your personal data, and to restrict processing. Where we rely on legitimate interest, you can object at any time. Write to hello@raywake.com from the email on your account; we answer within one month. You can also complain to a data protection supervisory authority, in particular where you live or work.

For users in Turkey (KVKK)

This notice is also our information notice under Article 10 of Turkey’s Personal Data Protection Law No. 6698. We collect personal data electronically through the site, the API and our payment and sign-in providers, for the purposes and on the legal grounds above (Article 5: performance of a contract, legal obligation and legitimate interest). Data is transferred abroad to the recipients listed above to provide the service. Under Article 11 you can ask whether your data is processed, request information, correction, deletion or notification of recipients, object to results of automated analysis, and claim compensation for unlawful processing. Send requests to hello@raywake.com.

Children

Raywake is not meant for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy we update the date above and tell you by email or in the studio when the change is significant. See also our Terms and Refund policy.