Privacy Policy

1. Introduction

ARAY Social Ltd ("ARAY", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use the ARAY platform.

ARAY Social Ltd is the data controller for the purposes of UK data protection law. We are registered in England and Wales under company number 14392788, with our registered address at Floor 1, No 1 St Michaels, 36 Jacksons Row, Manchester, England, M2 5WD.

If you have any questions about this Privacy Policy, please contact us at general@araysocial.com.

2. What Data We Collect

We collect different categories of personal data depending on how you interact with the platform.

2.1 Account and Identity Data

When you create an account and build your profile, we collect:

1. Your name (first name, last name, and optionally middle name).
2. Your email address (used for account authentication; accessible only to ARAY administrators).
3. Your date of birth (accessible only to ARAY administrators; displayed publicly as an age bracket such as "25 to 34").
4. Your pronouns.
5. A profile photo (avatar).
6. Your chosen display location (town and country, shown publicly on your profile) and your full postal address (accessible only to ARAY administrators). You can choose whether your display location matches your postal address or set a different one.
7. Your mobile phone number (accessible only to ARAY administrators).
8. Your Instagram handle, TikTok handle, YouTube URL, and personal website URL. These are accessible only to ARAY administrators.
9. How you heard about ARAY (accessible only to ARAY administrators).

2.2 Profile and Portfolio Data

To help us match you with brand opportunities, we collect:

1. A written bio, tagline, and hobbies.
2. Your everyday job and whether you are willing to show it on camera.
3. Your content niche (the types of content you create).
4. Languages you speak, including fluency level and whether you make or want to make videos in each language.
5. Video content you upload to your portfolio, including titles, tags, and organisational groupings (galleries).
6. Information about your filming environments, including location descriptions and photographs.

2.3 Special Category Data

We collect some data that falls within "special categories" under UK GDPR. This data is collected with your explicit consent and is used solely for the purpose of matching you with relevant brand opportunities:

1. Your ethnicity.
2. Physical appearance details, including hair texture, hair length, hair colour, and photographs of your hair.
3. Whether you have visible tattoos, piercings, or skin conditions, along with descriptions and photographs where applicable.

We collect this data because brands frequently require creators with specific physical attributes for their campaigns (for example, a haircare brand may need creators with a particular hair type). Without this information, ARAY cannot effectively match creators to briefs.

2.4 Information About Others

If you choose to include other people in your profile, we collect:

1. Details about family members and friends who may appear in your content, including their first name, gender, age bracket, and photographs.
2. Details about pets, including pet type, name, breed, gender, age, and photographs.
3. Your confirmation that you have obtained consent from any individuals (or, in the case of minors, their parent or legal guardian) featured in your profile or content.

2.5 Professional History

We optionally collect:

1. Brands you have previously worked with.
2. Testimonials from past brand collaborations.

2.6 Technical and Usage Data

When you use the platform, we automatically collect:

1. Authentication session data (login status, session tokens).
2. Information about how you interact with the platform, including pages visited and features used.
3. Your IP address and basic device information provided by your browser.

3. How We Use Your Data

We use your personal data for the following purposes:

Where we rely on legitimate interest, we have assessed that our interests do not override your rights and freedoms. You may contact us at any time to request further details of these assessments.

4. Who We Share Your Data With

4.1 Brand Partners

When ARAY presents you as part of a shortlist to a prospective brand, we share your public profile information, including your name (displayed as first name plus middle and last initials), your chosen display location (town and country, which may differ from your postal address), bio, tagline, content niche, age bracket, portfolio videos, filming environments, pet details, and family details (where you have provided them).

Your email address, phone number, home address, Instagram handle, TikTok handle, YouTube URL, personal website URL and date of birth are accessible only to ARAY administrators. Contact between you and brands is facilitated through ARAY.

4.2 Service Providers

We use the following third-party service providers to operate the platform. These providers process your data on our behalf under data processing agreements:

4.3 International Transfers

Some of our service providers are based outside the United Kingdom. Where your data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR, including:

1. UK adequacy decisions where available.
2. Standard contractual clauses (UK International Data Transfer Agreement or UK Addendum to EU SCCs) where no adequacy decision exists.
3. Supplementary measures where necessary to ensure an equivalent level of protection.

4.4 Other Disclosures

We may also share your data:

1. Where required by law, regulation, or legal process.
2. To protect the rights, property, or safety of ARAY, our users, or others.
3. In connection with a merger, acquisition, or sale of assets, in which case we will notify you.

We only share your personal data as described in this Privacy Policy. We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes.

5. How We Protect Your Data

We take appropriate technical and organisational measures to protect your personal data, including:

1. Row-Level Security (RLS) policies on our database, ensuring that users can only access data they are authorised to see.
2. Encryption of data in transit (HTTPS/TLS).
3. Encryption of data at rest (provided by our database hosting provider).
4. Secure authentication using industry-standard practices, including protection against compromised passwords.
5. Access controls limiting which ARAY team members can view sensitive data.
6. Regular security reviews of the platform.

6. How Long We Keep Your Data

We retain your data for as long as your account is active and you remain on the ARAY creator roster.

After the relevant retention period, your data will be securely deleted or anonymised.

7. Your Rights

Under UK GDPR, you have the following rights:

Right of access. You can request a copy of the personal data we hold about you.

Right to rectification. You can ask us to correct inaccurate data. You can also update most of your profile information directly through the platform.

Right to erasure. You can ask us to delete your personal data, subject to any legal obligations we have to retain it.

Right to restrict processing. You can ask us to limit how we use your data in certain circumstances.

Right to data portability. You can request your data in a structured, commonly used, machine-readable format.

Right to object. You can object to processing based on legitimate interest. We will stop processing unless we have compelling legitimate grounds that override your interests.

Right to withdraw consent. Where we process your data based on consent (including special category data such as ethnicity and appearance), you may withdraw consent at any time. This will not affect the lawfulness of processing carried out before withdrawal. Withdrawing consent for special category data may affect our ability to match you with brand opportunities.

To exercise any of these rights, please contact us at general@araysocial.com. We will respond within one month of receiving your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

The ARAY platform uses cookies that are strictly necessary for the platform to function:

1. Authentication cookies. These are set when you log in and are required to keep you signed in as you navigate the platform. They expire when your session ends or after a period of inactivity.
2. Preference cookies. These store your interface preferences (such as sidebar state) to improve your experience.

We do not currently use analytics cookies, advertising cookies, or third-party tracking cookies.

9. Children

The ARAY platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.

Where creators include information about their own children in their profile (for content featuring family members), the creator is responsible for obtaining parental or guardian consent as described in the Creator Terms.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform. The date at the top of this policy indicates when it was last updated.

We encourage you to review this policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

ARAY Social Ltd
Floor 1, No 1 St Michaels, 36 Jacksons Row,
Manchester, England, M2 5WD
general@araysocial.com

You can also contact the Information Commissioner's Office (ICO) if you have concerns about how we handle your data:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk