Loray (loray.ai)
Effective date: April 25, 2026
Last updated: April 25, 2026 · Policy 3
Loray is a B2B SaaS platform that provides AI-powered SMS and voice communication tools for independent contractors and small businesses ("Clients"). This policy covers how Loray collects, uses, and protects data at the platform level — both Client data (contractors using the platform) and end-user (contact) data processed on behalf of Clients.
Loray operates in two distinct roles depending on the data in question:
If you are a contact of a business that uses Loray, that business is generally the controller of your data. Loray acts as a processor or service provider for that business.
Loray may collect the following Client data:
Name, email, and company name
Purpose: account management, authentication, onboarding, support, and communication.
Retention: duration of account + 90 days.
Billing information
Purpose: subscription billing and payment processing through Stripe.
Retention: per Stripe's policies; Loray retains only transaction metadata needed for account, tax, and accounting purposes.
Business configuration
Examples: services offered, business hours, service area, business address, booking preferences, phone settings, AI assistant configuration, and TCR brand/campaign IDs.
Purpose: AI assistant personalization, appointment booking, SMS compliance, and platform operation.
Retention: duration of account.
Support and correspondence records
Purpose: customer support, troubleshooting, security review, and account administration.
Retention: duration of account + 24 months.
Loray may process the following contact data on behalf of Clients:
Phone numbers
Storage: stored encrypted during active messaging; hashed copies may be retained for opt-out enforcement, deduplication, fraud prevention, and compliance.
Retention: duration of conversation with the Client, plus up to 24 months, subject to Client settings and legal retention obligations.
SMS conversation content
Storage: encrypted at rest and protected in transit using TLS 1.2 or higher.
Retention: duration of Client relationship + 24 months, unless deleted earlier by the Client or required by law.
Voice call audio recordings
Storage: encrypted at rest and protected in transit using TLS 1.2 or higher.
Retention: 30 days after the call, then permanently deleted, unless a shorter retention period is configured or deletion is required earlier.
Voice call transcripts
Storage: encrypted at rest.
Retention: duration of Client relationship + 24 months, unless deleted earlier by the Client or required by law.
Call metadata
Examples: timestamps, call duration, caller phone number, direction of call, and delivery status.
Storage: encrypted at rest.
Retention: duration of Client relationship + 24 months.
Opt-in and opt-out consent records
Examples: hashed phone number, timestamp, source, channel, consent artifact, STOP/START events.
Purpose: TCPA, A2P 10DLC, carrier compliance, and suppression list enforcement.
Retention: at least 4 years, or longer where required for legal compliance.
When you visit loray.ai, use Loray's website, open emails from Loray, or interact with forms, demos, or marketing pages, Loray may collect limited website and analytics data.
This may include:
Loray uses this information to:
Loray may use cookies, pixels, local storage, log files, and similar technologies. Cookies may be used for essential site functionality, analytics, security, preferences, and, if enabled, marketing measurement.
You can control cookies through your browser settings. Blocking some cookies may affect website functionality. Where required by law, Loray will provide additional cookie notices, consent controls, or opt-out options.
Loray does not use end-user contact data processed on behalf of Clients for targeted advertising.
Loray may use Client or prospective Client contact information to send product updates, onboarding messages, service notices, and marketing communications.
You may opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting [email protected]. Loray may still send transactional or service-related messages, such as billing notices, security alerts, account updates, and required compliance notifications.
Loray uses data to:
Loray does not sell, rent, or share end-user contact data with any third party for marketing or advertising purposes.
Loray does not use Client data or end-user contact data to train AI models.
Loray does not share mobile phone numbers, SMS opt-in records, or SMS consent data with third parties or affiliates for their own marketing or promotional purposes.
Loray uses third-party subprocessors to provide hosting, telephony, messaging, speech transcription, speech synthesis, AI language processing, payments, email delivery, and compliance-related services.
Each subprocessor is restricted to the purpose listed in Loray's subprocessor list and is subject to written contractual obligations, including confidentiality, security, and data protection obligations.
A current, detailed list is maintained at loray.ai/subprocessors.
Current subprocessors include:
All subprocessors are currently located in the United States or operate through US-based service endpoints.
Loray uses administrative, technical, and organizational safeguards designed to protect personal data.
Security measures include:
No system can be guaranteed to be completely secure. However, Loray uses reasonable safeguards designed to protect data against unauthorized access, disclosure, alteration, or destruction.
In the event of a data breach affecting personal information, Loray will notify affected Clients and applicable regulators as required by law, generally within seventy-two (72) hours of discovering the breach where such timing is legally required.
Loray operates under the laws of the United States.
SMS services are governed by applicable telecommunications and consumer protection laws, including the Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227. Loray's A2P 10DLC campaigns are registered with TCR (The Campaign Registry) as required by major US carriers.
Voice call recording and transcription are conducted in accordance with applicable federal and state wiretapping and call-recording laws, with call-participant notification where required.
All Loray infrastructure is hosted in the United States, and all subprocessors operate through US-based service endpoints.
Loray does not currently target or market its services to the European Economic Area, the United Kingdom, or Switzerland. If Loray processes data from those regions in the future, additional notices and safeguards may apply.
Loray retains data only for as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business operations.
Summary:
Clients may request deletion of their data and associated contact data by contacting [email protected]. Loray will honor deletion requests subject to legal retention obligations, fraud prevention, security, backup retention, dispute resolution, and compliance requirements.
End users who wish to delete data processed on behalf of a Client should first contact the Client. Loray may assist the Client in responding to such requests.
Depending on where you live, you may have the right to:
To exercise these rights, contact [email protected].
Loray may need to verify your identity before fulfilling a privacy request. Verification may include confirming control over your email address, account, or other information reasonably necessary to process the request.
If you are a contact or customer of a business that uses Loray, please contact that business directly to exercise privacy rights. That business controls the purposes and means of processing your data.
For platform-level requests, or if the Client is unresponsive, you may contact Loray at [email protected]. Loray may forward the request to the relevant Client or assist the Client in responding.
End-user rights may include:
Residents of certain U.S. states, including California and other states with consumer privacy laws, may have additional rights regarding their personal information.
Depending on your state of residence and the nature of your relationship with Loray, these rights may include:
Loray does not sell end-user contact data.
Loray does not share mobile phone numbers, SMS opt-in data, or SMS consent records with third parties or affiliates for their own marketing or promotional purposes.
Loray does not use end-user contact data processed on behalf of Clients for targeted advertising.
If Loray uses advertising or analytics technologies on its website that may be considered "sharing" under certain state privacy laws, website visitors may exercise applicable opt-out rights by using available cookie controls, browser settings, recognized opt-out preference signals where supported, or by contacting [email protected].
To submit a U.S. state privacy request, email [email protected] with the subject line "Privacy Request." If you use an authorized agent, Loray may request proof that the agent is authorized to act on your behalf and may also require you to verify your identity directly.
Loray is a business-to-business service and is not directed to children under 13. Loray does not knowingly collect personal information from children under 13.
If Loray learns that it has collected personal information from a child under 13 without appropriate consent, Loray will take reasonable steps to delete that information.
Loray updates its subprocessor list at loray.ai/subprocessors when subprocessors are added, removed, or changed.
Clients are notified by email at least 30 days in advance of additions or changes that may materially affect data processing.
Clients may object in writing to a new subprocessor within 15 days of notice. If the objection cannot be resolved, the Client may terminate the affected service without penalty.
Loray may update this Policy from time to time. Material changes will be notified to Clients by email at least 30 days in advance where required or appropriate.
The "Last updated" date above reflects the current version.
For privacy questions, data requests, or legal inquiries:
Privacy email: [email protected]
Legal email: [email protected]
Website: loray.ai