Loray (loray.ai)
Last updated: April 25, 2026 · Version 1
Loray is built to help small businesses communicate with customers through AI-powered SMS, voice, and appointment automation.
Because Loray processes customer conversations, phone numbers, call transcripts, appointment details, and business configuration data, security and privacy are core parts of how the platform is designed.
This page summarizes Loray's current security, privacy, infrastructure, AI data handling, and compliance practices.
Loray uses administrative, technical, and organizational safeguards designed to protect Client data and end-user contact data.
Our security approach focuses on:
Loray's production infrastructure is hosted in the United States.
Current hosting provider:
OVHcloud (US, LLC)
Region: USA — Oregon, us-west-or-2, Hillsboro, OR.
Loray uses OVHcloud for:
More information about subprocessors is available at:
Loray uses encryption to protect personal data where applicable.
Data transmitted between user devices, Loray systems, and subprocessors is protected using TLS 1.2 or higher.
This includes:
Stored personal data is encrypted at rest where applicable using AES-256 or equivalent encryption.
This includes, where applicable:
Phone numbers are sensitive identifiers in Loray's platform.
Loray stores phone numbers encrypted during active use. Hashed copies may be retained for:
Loray uses hashed phone records to help ensure that Contacts who opt out are not contacted again through Loray-powered workflows.
Loray is a multi-tenant SaaS platform.
Client data is logically separated so that each Client can access only their own business data, users, contacts, conversations, appointments, and configuration.
Loray uses application-level authorization controls to enforce tenant separation.
Production access is restricted to authorized personnel with a legitimate business need.
Access to production systems and personal data is limited to authorized personnel.
Loray applies the principle of least privilege where practical.
Production access may be granted for:
Administrative and sensitive actions are logged where appropriate.
Access is reviewed and updated as personnel roles change.
Loray maintains audit and operational logs to support:
Logs may include:
Logs are retained only as long as reasonably necessary for security, compliance, support, and business operations.
Loray uses AI services to generate responses, classify inquiries, support SMS automation, support voice automation, and assist with appointment-related workflows.
Current AI-related subprocessors may include:
Loray does not permit AI subprocessors to use Client data or end-user contact data to train their general-purpose AI models.
Where technically feasible, Loray removes direct identifiers, such as phone numbers, before sending conversation context to AI language model providers.
However, conversation content may still include personal information voluntarily provided by a caller or message sender, such as:
Zero-data-retention or reduced-retention configurations are used where available and commercially supported.
Loray may process voice call audio and transcripts when AI voice features are enabled.
Voice call audio is used to:
Voice call audio is retained for 30 days after the call, then permanently deleted, unless a shorter retention period is configured or deletion is required earlier.
Voice call transcripts may be retained longer than audio because they are used for:
Voice call transcripts are retained according to Loray's Privacy Policy and Client configuration.
Loray supports SMS compliance through:
When a Contact replies STOP, Loray honors the opt-out and records the suppression event.
Opt-out and consent records may be retained for at least 4 years or longer where required for legal, carrier, or compliance purposes.
Loray does not share mobile phone numbers, SMS opt-in data, or SMS consent records with third parties or affiliates for their own marketing or promotional purposes.
Loray uses third-party subprocessors to provide the Services.
Subprocessors are reviewed for their role, data access, purpose, and contractual data protection commitments.
Subprocessors are used for:
Loray maintains a current list of subprocessors at:
Clients are notified at least 30 days in advance of additions or changes that may materially affect data processing.
Loray retains data only as long as reasonably necessary to provide the Services, comply with legal obligations, support security, resolve disputes, enforce agreements, and maintain platform reliability.
Typical retention periods include:
More information is available in Loray's Privacy Policy:
Clients may request deletion of their account data and associated contact data by contacting:
Loray will honor deletion requests subject to:
End users who wish to delete data processed on behalf of a Client should contact that Client directly. Loray may assist the Client in responding to the request.
Loray maintains backup and recovery practices designed to support service reliability and data restoration in the event of operational failure.
Backups may contain Client data and contact data.
Backup data is protected through access controls and infrastructure safeguards.
Data deleted from production systems may remain in backups for a limited period until backup rotation or deletion cycles complete.
Loray maintains procedures for investigating and responding to security incidents.
If Loray confirms a security incident affecting personal data, Loray will notify affected Clients without undue delay and as required by applicable law.
Incident notices may include, where available:
If you believe you have discovered a security vulnerability in Loray, please report it responsibly.
Contact:
Please include:
Do not access, modify, delete, or exfiltrate data that does not belong to you.
Loray will review security reports and respond as appropriate.
Loray supports Clients with technical tools designed to help with telecommunications and communication compliance.
Relevant areas include:
Clients are responsible for their own legal compliance when using Loray, including:
Loray does not provide legal advice.
Relevant privacy and security documents:
For security, privacy, or compliance questions:
Security: [email protected]
Privacy: [email protected]
Legal: [email protected]
Website: loray.ai