Privacy Policy

1. Introduction

ARAY Social Ltd ("ARAY", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the ARAY platform.

ARAY Social Ltd is the data controller for the purposes of UK data protection law. We are registered in England and Wales under company number 14392788, with our registered address at Floor 1, No 1 St Michaels, 36 Jacksons Row, Manchester, England, M2 5WD.

If you have any questions about this Privacy Policy, please contact us at hello@araysocial.com.

2. Data We Collect

When you create an account and build your profile, we collect:

(a) Identity and contact details: Name, pronouns, address, email address, date of birth, phone number, profile photo.

(b) Financial and payment information: Payment details (including where relevant, credit reference information) and where relevant banking or payment card information.

(c) Digital information: IP address, general location information derived from your IP address, search and browsing behaviour, user journeys, error reports (including browser type, operating system, and page URL at the time of an error), and session replays of your interactions with the platform for the purpose of diagnosing technical issues.

(d) Professional information: Brands you have previously worked with and testimonials from past brand collaborations.

(e) Your Instagram handle, TikTok handle, YouTube URL, and personal website URL. These are accessible only to ARAY administrators.

(f) How you heard about ARAY (accessible only to ARAY administrators).

2.1 Profile and Portfolio Data

To help us match you with brand opportunities, we collect:

(a) A written bio, tagline, and hobbies.

(b) Your everyday job and whether you are willing to show it on camera.

(c) Your content niche (the types of content you create).

(d) Languages you speak, including fluency level and whether you make or want to make videos in each language.

(e) Video content you upload to your portfolio, including titles, tags, and organisational groupings (galleries).

(f) Information about your filming environments, including location descriptions and photographs.

(g) Auto-generated text transcripts of your video content, produced by our video hosting provider using speech recognition technology. These transcripts are used to improve searchability and accessibility of your portfolio.

2.2 Special Category Data

This is special information that the law says is more sensitive (sometimes called "sensitive personal data"). We handle special category data with extra care and protection, and we only collect and use these where legally permitted. This data is collected with your explicit consent and is used solely for the purpose of matching you with relevant brand opportunities. The special category of data we collect includes:

(a) Racial or ethnic origin.

(b) Health information (including visible skin conditions).

We collect this data because brands frequently require creators with specific physical attributes for their campaigns (for example, a haircare brand may need creators with a particular hair type). Without this information, ARAY cannot effectively match creators to briefs.

2.3 Information About Others

If you choose to include other people in your profile, we collect:

(a) Details about family members and friends who may appear in your content, including their first name, gender, age bracket, and photographs.

(b) Your confirmation that you have obtained consent from any individuals (or, in the case of minors, their parent or legal guardian) featured in your profile or content.

2.4 Shared Page Analytics

When visitors who are not registered ARAY users view a shared page, we collect limited pseudonymous data to measure engagement and provide voting functionality. Full details of what is collected and how it is processed are set out in our Viewer Privacy Notice.

3. How We Use Your Data

Data protection law requires us to have proper legal reasons for using your personal data. We can only use your information when we have one or more of these legal bases:

• Consent — You have clearly agreed to us using your personal data for a specific purpose.
• Performance of a contract — We need to use your information to fulfil a contract with you, or because you've asked us to do something before entering into a contract.
• Legal duty — We must use your information to comply with the law.
• Vital interests — We need to use your information to protect someone's life.
• Public interest — We need to use your information to perform a task in the public interest or carry out official functions that have a clear legal basis.
• Legitimate interests — We have a genuine business reason to use your information, or a third party does, but only if this doesn't unfairly override your rights and interests. Where we rely on legitimate interests as our legal basis, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. These assessments consider:
  • The nature of our legitimate interest
  • The impact on you
  • Any safeguards we can implement
  • Your reasonable expectations
  • The broader context of our relationship

Note that we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your data. We have listed the reasons we process your data and the legal basis below. Please reach out to us if you need further details about the specific legal basis we are relying on to process your personal data.

We use your personal data for the following purposes:

Where we rely on legitimate interest, we have assessed that our interests do not override your rights and freedoms. You may contact us at any time to request further details of these assessments.

4. Who We Share Your Data With

4.1 Brand Partners

When ARAY presents you as part of a shortlist to a prospective brand, we share your public profile information, including your name (displayed as first name plus middle and last initials), your chosen display location (town and country, which may differ from your postal address), age bracket, and portfolio videos. Your email address, phone number, home address, Instagram handle, TikTok handle, YouTube URL, personal website URL, and date of birth are accessible only to ARAY administrators.

Contact between you and brands is facilitated through ARAY.

4.2 Our Disclosures of Personal Data to Third Parties

We use the following third-party service providers to operate the platform. These providers process your data on our behalf under data processing agreements:

We may also disclose personal data to:

Professional advisers

• Bankers
• Auditors
• Insurers and insurance brokers
• Legal advisers

Business partners

• Our existing or potential agents
• Our business partners or contractors

Corporate transactions

If we merge with or are acquired by another company, or sell our business assets:

• Your information may be disclosed to our advisers
• Your information may be disclosed to the potential purchaser's advisers
• Your information may be included in the transferred assets

Legal and regulatory bodies

• Courts and tribunals
• Regulatory authorities including as required for reporting obligations
• Law enforcement officers

Other parties

• Third parties you have authorised
• Emergency services when necessary
• Any other parties as required or permitted by law

4.3 Where We Store and Access Your Information

We store your personal data in the United Kingdom. However, your information may be transferred to locations outside the United Kingdom in these circumstances:

(a) When our service providers are located overseas.

(b) When we work with overseas business partners.

(c) When using cloud-based services or data storage solutions.

(d) When required by law or legal proceedings.

4.4 International Transfers

Some of our service providers are based outside the United Kingdom. Where your data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR. We ensure it receives appropriate protection by:

(a) Only transferring your information to countries that UK data protection law recognises as providing adequate protection for personal data, or

(b) Putting in place a contract with the third party that means they must protect personal data to the same standards as the UK.

(c) Transferring personal data to organisations that are part of specific agreements on cross-border data transfers with the UK.

The specific safeguards currently in place for each of our service providers are as follows. Supabase hosts data in the United Kingdom (London). Vercel is certified under the EU US Data Privacy Framework and its UK extension. Mux is certified under the EU US Data Privacy Framework and includes Standard Contractual Clauses with the UK Addendum for international transfers. Resend processes data in the United States under Standard Contractual Clauses. Sentry processes data in Germany (EU), covered by the UK adequacy decision for the EEA. Cloudflare R2 stores data in the European Union.

What this means for you

We only transfer the minimum amount of personal data necessary and require all recipients to:

• Protect your information to the same standards required by UK law
• Use your information only for the purposes we've agreed
• Allow us to monitor how they handle your information
• Provide you with the same rights over your information that you have under UK law

5. How We Protect Your Data

We take appropriate technical and organisational measures to protect your personal data, including:

(a) Row-Level Security (RLS) policies on our database, ensuring that users can only access data they are authorised to see.

(b) Encryption of data in transit (HTTPS/TLS).

(c) Encryption of data at rest (provided by our database hosting provider).

(d) Secure authentication using industry-standard practices, including protection against compromised passwords.

(e) Access controls limiting which ARAY team members can view sensitive data.

(f) Regular security reviews of the platform.

6. How Long We Keep Your Data

We retain your data for as long as your account is active and you remain on the ARAY creator roster.

After the relevant retention period, your data will be securely deleted or anonymised.

7. Your Privacy Rights and Choices

Providing information

You can choose whether to provide personal data to us, however, if you don't provide certain information, we may not be able to provide some services. Let us know if you don't want to provide information and we will let you know when information is required versus optional.

Under UK GDPR, you have the following rights:

Right of access. You have the right to ask us for copies of your personal data. You can request other information such as details about where we get personal data from and who we share personal data with. There are some exemptions which means you may not receive all the information you ask for.

Right to rectification. You can ask us to correct or delete inaccurate data. You can also update most of your profile information directly through the platform.

Right to erasure. You can request deletion of your personal data in certain limited circumstances as set out in data protection law, such as where the data is no longer necessary or has been unlawfully processed. This right is not absolute, and we may be required or entitled to retain your data for legal, regulatory or legitimate business reasons.

Right to restrict processing. You can ask us to suspend processing where:

• You contest the accuracy of the data
• Processing is unlawful but you don't want erasure
• We no longer need the data but you need it for legal claims
• You've objected to processing pending verification of our legitimate grounds

Right to opt-out of marketing communications. You can opt-out of receiving marketing communications at any time. Each marketing communication will include an unsubscribe option. You can change your marketing preferences by contacting us. We will process your request as soon as practicable.

Right to data portability. Where technically feasible, you can receive your personal data in a structured, commonly used format or have it transmitted to another controller where:

• Processing is based on consent or contract
• Processing is automated

Right to object. You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.

Right to withdraw consent. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@araysocial.com.

Making a complaint

If you're unhappy with how we've used your personal data, please get in touch with us first using the contact details at the end of this policy. When you contact us:

• Give us full details about your complaint
• We'll investigate your concerns promptly
• We'll respond to you in writing explaining what we found and what we'll do to address your complaint

Your right to complain to the regulator

You can also make a complaint directly to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time.

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Helpline number: 0303 123 1113
Website: ico.org.uk/make-a-complaint

You don't have to contact us first before going to the ICO, but we'd appreciate the opportunity to try to resolve your concerns directly with you.

8. Cookies

We use cookies and similar tracking technologies on our website to enhance your browsing experience and improve our services.

The ARAY platform uses cookies that are strictly necessary for the platform to function:

(a) Essential cookies. These are set when you log in and are required to keep you signed in as you navigate the platform. They expire when your session ends or after a period of inactivity.

(b) Functionality cookies. These store your interface preferences (such as sidebar state) to improve your experience.

We do not currently use analytics cookies, advertising cookies, or third-party tracking cookies. Because we only use strictly necessary cookies, no cookie consent banner is currently required. If we introduce non-essential cookies in the future, we will ask for your consent before placing them on your device.

(c) Local storage. On shared pages viewed by visitors who are not registered users, we use a single local storage key to support page view deduplication and voting. This data is pseudonymous. Full details are set out in our Viewer Privacy Notice.

Managing your preferences

You can change your cookie preferences at any time by:

• Adjusting your browser settings to refuse or delete cookies
• Visiting our Cookie Policy for detailed information about specific cookies

Please note that disabling certain cookies may affect the functionality of our website and your user experience.

9. Children's Personal Data

The ARAY platform is not intended for use by anyone under 18 years of age. We do not knowingly collect or process personal data from children under 18 for the purpose of creating creator accounts. If you are under 18, you may not create an account or provide personal data to us.

Children featured in creator content: Creators may include information about their own children or other minors in their profiles (such as photographs and age brackets) where those children may appear in content. Where a creator includes information about a child, the creator is solely responsible for obtaining appropriate parental or guardian consent as described in the Terms of Service. This information is provided by the creator, not collected directly from the child.

If we become aware that an individual under 18 has created an account, or that a creator has included information about a child without verified parental or guardian consent, we will take steps to delete that information as quickly as possible and may suspend or terminate the relevant account.

Parents and guardians have the right to:

• Review any personal data we hold about their child
• Request correction or deletion of their child's personal data
• Refuse or withdraw consent for further collection or use of their child's data
• Request removal of their child's information from a creator's profile
• Contact us with any concerns about their child's privacy

If you are a parent or guardian and believe your child has created an account without your consent or has been featured in a creator's profile or content without your consent, please contact us immediately at hello@araysocial.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform. The date at the top of this policy indicates when it was last updated.

We encourage you to review this policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

ARAY Social Ltd
Floor 1, No 1 St Michaels, 36 Jacksons Row,
Manchester, England, M2 5WD
hello@araysocial.com

You can also contact the Information Commissioner's Office (ICO) if you have concerns about how we handle your data:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

Version: 2.5 Effective Date: 1 April 2026