Viewer Privacy Notice

ARAY Social Ltd ("ARAY", "we", "us", "our") is committed to protecting your personal data. This notice explains what data we collect and how we use it when you view a shared page on our platform. It applies to visitors who are not registered ARAY users. If you create an account, our full Privacy Policy applies instead.

ARAY Social Ltd is the data controller for the purposes of UK data protection law. We are registered in England and Wales under company number 14392788, with our registered address at Floor 1, No 1 St Michaels, 36 Jacksons Row, Manchester, England, M2 5WD.

1. Data We Store

When you view a shared page, we store the following data in our database.

(a) Viewer token. We generate a random identifier (a UUID) and store it in your browser's local storage under the key aray_viewer_token. This same token is also stored in our database. It is used to avoid counting duplicate page views within a 30 minute window and to associate any votes you cast with your viewing session.

(b) IP address hash. We create a one way cryptographic hash (SHA 256) of your IP address. We do not store your raw IP address. The hash is used to recover your viewer token if your browser storage is cleared.

(c) User agent string and hash. We store your browser's full user agent string as well as a SHA 256 hash of it. The raw string is used to determine your device type, browser, and operating system. The hash is used alongside the IP hash for token recovery.

(d) Approximate location. We record your approximate city and country, derived from geographic headers provided by our hosting infrastructure at the time of your request.

(e) Device type. We record whether you are using a desktop computer, mobile phone, or tablet, derived from your user agent string.

(f) Votes. If you choose to vote on a creator, we record the vote type (approve or reject), your viewer token, and the IP and user agent hashes described above.

(g) Timestamps. We record the date and time of each page view and each vote.

2. Data Received by Third Party Services

When you visit a shared page, the following services receive data as part of delivering the page to your browser.

(a) Vercel (website hosting, global edge network). Vercel serves the page and all static assets including self hosted fonts. As standard web infrastructure, Vercel receives your IP address and request headers. Vercel is certified under the EU US Data Privacy Framework with the UK extension.

(b) Supabase (database and image hosting, London, United Kingdom). Your browser loads creator profile images directly from Supabase storage. Supabase receives your IP address and request headers for these image requests.

(c) Mux (video streaming, global CDN). When you play a video, your browser connects directly to Mux's content delivery network. Mux receives your IP address and user agent as part of the standard video streaming request. Mux also serves video thumbnail images. Mux is certified under the EU US Data Privacy Framework and includes Standard Contractual Clauses with the UK Addendum.

(d) Sentry (error monitoring, Germany, EU). If a JavaScript error occurs in your browser, Sentry receives the error details, browser metadata (operating system, browser version, screen resolution), page URL, and navigation breadcrumbs. Session replays are disabled on shared pages. Sentry collects performance traces on approximately 10% of page loads. These traces cover both the server side request (including page rendering time and database query duration) and the browser side page load (including load timing and network request metadata). You are not identified by name or account. Sentry processes data in Germany, which is covered by the UK adequacy decision for the EEA.

3. Data We Do Not Collect

We do not set advertising cookies, analytics cookies, or any other cookies on shared pages. We do not use fingerprinting. We do not load third party analytics scripts such as Google Analytics, Mixpanel, Hotjar, or similar services. The only browser storage used is the single local storage key described in Section 1(a). Shared pages are also marked as noindex and nofollow, which instructs search engines not to index or follow links on these pages.

4. Legal Basis

We process this data under Legitimate Interest (Article 6(1)(f) UK GDPR). We use the data to measure engagement on shared pages and to provide voting functionality for brand partners reviewing creators.

Because the hashed identifiers described in this notice can be linked back to a specific browsing session, this data is pseudonymous rather than anonymous. It remains personal data under UK GDPR. We have assessed that our interest in collecting this data does not override your rights and freedoms, given the limited and pseudonymous nature of the data involved.

5. Data Retention

Page view and vote data is retained for as long as the shared page exists on the platform. When a shared page is deleted, all associated view and vote records are permanently deleted via cascading deletion. There is no separate retention schedule or automated cleanup.

6. International Transfers

Vercel is certified under the EU US Data Privacy Framework and its UK extension. Mux is certified under the EU US Data Privacy Framework and includes Standard Contractual Clauses with the UK Addendum. Sentry processes data in Germany, covered by the UK adequacy decision for the EEA. Supabase hosts our production database in London, United Kingdom.

7. Your Rights

Under UK GDPR, you have the right to:

• Object to processing based on legitimate interests.
• Request information about the data we hold.
• Request erasure of your data.

Because the data we collect is pseudonymous, exercising these rights may require you to provide corroborating information such as your viewer token. You can find this in your browser's developer tools under local storage, listed under the key aray_viewer_token. You can also clear your local storage at any time to remove the token from your browser.

To exercise any of these rights, contact us at hello@araysocial.com.

8. Contact Us

ARAY Social Ltd
Floor 1, No 1 St Michaels, 36 Jacksons Row,
Manchester, England, M2 5WD
hello@araysocial.com

You can also contact the Information Commissioner's Office (ICO) if you have concerns about how we handle your data:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

Version: 1.0 Effective Date: 1 April 2026