Privacy Policy

RayCentral LLC (“RayCentral”, “we”, “us” or “our”) is a Limited Liability Company organised under the laws of the State of New Mexico, United States, with its principal place of business at 1209 Mountain Road Pl NE, Albuquerque, NM 87110, United States and D-U-N-S Number 149921732.

We are the party responsible for the personal information described in this policy. For any question about this policy or about how we handle personal information, contact us at contact@raycentral.net. For questions relating to one of our applications, including RayX VPN, contact support@raycentral.net.

This policy covers three distinct contexts:

• This website — visitors browsing raycentral.net and people who submit the enquiry form.
• Our applications — including RayX VPN, our secure connectivity client, and our other published mobile and desktop software.
• Our client services — custom software development, network engineering and cloud work delivered under contract.

Where we build or operate software on behalf of a client, that client determines what personal information is processed and for what purpose; we act on their documented instructions under the terms of the relevant agreement, and their own privacy notice governs that processing.

RayX VPN is designed around data minimisation. This clause sets out exactly what the app and the service behind it do not touch, and the limited data they do process in order to work.

We do not employ tracking or advertising SDKs in RayX VPN, we do not build behavioural profiles of users, and we do not sell or share personal information for cross-context behavioural advertising. RayX VPN does not claim to provide anonymity: it encrypts and routes your traffic, and nothing more.

RayX VPN establishes its tunnel using the VPN mechanism each operating system provides for that purpose, and nothing beyond it:

• On Android, the client uses the operating system’s VpnService API (android.net.VpnService) — the standard, documented Android mechanism that allows an application to establish a virtual network interface.
• On iOS, the client uses Apple’s Network Extension framework (NEPacketTunnelProvider) — the equivalent Apple-sanctioned mechanism for establishing a packet tunnel.

Both operating systems require your explicit consent before any application may establish a VPN connection. On Android the consent prompt is presented by the system itself; on iOS you must approve the addition of a VPN configuration before the tunnel can be created. Neither prompt comes from us, and no tunnel exists until you grant it. You can revoke that consent at any time by disconnecting within the app or by removing the VPN profile in your device settings.

Traffic passing through the tunnel is routed, not retained. The client requests only the permissions technically necessary to establish and maintain that connection. It does not request access to your contacts, messages, call logs, photos, precise location or other unrelated personal data.

Because no transaction is processed through either store, we receive no purchase records, order or transaction identifiers, subscription state or payer information from Google or Apple in connection with RayX VPN.

Access to the service is controlled outside the app. Android users may receive device-based access codes, while iOS enterprise users sign in with Apple and may redeem a code or invitation that is assigned to an authorised employee by their organisation or the operator. This iOS authentication is an account-creation/sign-in process for access control, not an in-app purchase. See clause 6 of our Terms of Service. Business correspondence and any billing records are handled separately from VPN traffic contents.

Beyond the RayX VPN service data described in clause 3, the following limited categories of information may be processed:

• Enquiry data — the name, organization, email address and message you submit through the contact form on this website, or send to us by email.
• Access code correspondence — the contact details you give us when requesting an access code outside the app, and the code issued in response.
• iOS enterprise identity and membership data — the identifiers, email addresses or private relay addresses, verified provider status, organisational membership, employee entitlement, device association and audit records described in clause 3.
• Support correspondence — the content of messages you send to our support desk, together with any diagnostic detail you choose to include.
• Billing records — invoices and transaction records for development services and, where applicable, for access codes, retained for accounting and tax compliance.
• Website server data — transient request logs generated by our hosting infrastructure for security and diagnostic purposes, and a short-lived in-memory record of request timing used to rate-limit the contact form against automated abuse.

We do not intentionally collect sensitive or special category information, and we ask that you do not submit such information to us through this website or our support channels.

We use the limited information described above only to:

• respond to your enquiry and provide the services you ask for;
• operate the RayX VPN service — validate a device key’s entitlement, establish and maintain its tunnel, and deliver service notifications — and issue access codes;
• authenticate iOS enterprise employees with Apple and Firebase, validate company membership, prevent misuse and suspend or revoke access when an employee’s permission or contract ends;
• provide technical support and investigate faults you report to us;
• operate, secure and maintain this website and our infrastructure, including defending against abuse;
• meet our accounting, tax and other legal obligations, and to establish, exercise or defend legal claims.

Where the EU or UK General Data Protection Regulation applies, we rely on the performance of a contract (to supply and support what you have requested from us), our legitimate interests (to respond to enquiries and to secure our systems), compliance with a legal obligation (accounting and tax), and consent where we ask for it — which you may withdraw at any time without affecting the lawfulness of prior processing.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. The rules below differ between the RayX VPN app and the rest of our business, so they are set out separately.

Website, enquiries and business relationships. For the information described in clauses 5 and 6 — enquiry data, access code correspondence, support correspondence, billing records and website server data — we may disclose limited information to:

• service providers who support our business operations — website hosting, email delivery, payment processing and professional advisory services — each bound by written confidentiality and data protection obligations, and permitted to use the information only to provide that service to us;
• professional advisers, insurers and auditors where reasonably required;
• law enforcement or other authorities where disclosure is required by law or necessary to establish, exercise or defend legal claims;
• a purchaser or successor entity in connection with a merger, acquisition or sale of our business or assets, under equivalent confidentiality terms.

We are based in the United States, and information you send to us is processed there. Our infrastructure providers may operate facilities in other jurisdictions. Where personal information originating in the European Economic Area, the United Kingdom or Switzerland is transferred to us or our processors, we rely on an appropriate transfer mechanism, such as the European Commission standard contractual clauses together with the UK Addendum. Details applicable to a specific engagement are available on request.

We retain personal information only for as long as necessary for the purpose for which it was collected. Enquiry correspondence that does not lead to an engagement is generally retained for up to 24 months. Billing and tax records are retained for a minimum of seven years, or longer where required by law. Website server logs are retained for a short period for security and diagnostic purposes and then discarded.

RayX VPN. We do not maintain browsing-history, DNS-query or VPN traffic-content logs. Device and entitlement records are retained while access is active and for a period afterwards to support reinstatement, fraud prevention and administration. In the iOS enterprise flow, the Firebase account identifier, Apple provider linkage, email or private relay address where supplied, organisation membership and redemption/audit records are retained for as long as reasonably necessary for account administration, security and legal obligations. Requests to delete an iOS account or associated personal data are reviewed under applicable law; some security, activation, accounting and audit records may need to be retained. Where current operational policy retains activation history and operator audit logs indefinitely, a deletion request may not erase those records. Hosting provider request logs are described in clause 3, as are the temporary abuse-limiting data and optional diagnostics.

We maintain technical and organizational measures appropriate to the risk, including encryption of data in transit, encryption of the VPN tunnel, access control on a least-privilege basis, network segmentation, supplier due diligence and staff confidentiality obligations. Data minimisation is itself a security control: the information we never collect cannot be breached. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security; we will notify affected individuals and the relevant authority of a security incident affecting personal information where legally required to do so.

This website is designed to operate without non-essential cookies. It does not run third-party advertising or behavioural analytics. Any cookies used are strictly necessary for the operation and security of the site. Our applications, including RayX VPN, contain no advertising or tracking SDKs. Should we introduce analytics or other non-essential cookies, we will present a consent mechanism and update this policy accordingly.

Subject to the conditions and exemptions in applicable law, you may have the right to:

• know what personal information we hold about you and request access to it;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request a portable copy of information you provided to us;
• opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of;
• limit the use of sensitive personal information — we do not collect it;
• not be discriminated against for exercising any of these rights;
• where the GDPR applies, object to or request restriction of processing based on our legitimate interests, and withdraw any consent you have given.

California residents may exercise the rights afforded by the California Consumer Privacy Act as amended by the CPRA, and may use an authorised agent to do so. Residents of other US states with comparable privacy legislation have equivalent rights under their own state law.

To exercise any of these rights, including requesting deletion of an iOS enterprise account and its associated personal data, contact contact@raycentral.net or support@raycentral.net. The organisation administrator may also request that an employee’s business entitlement be revoked. Deleting access or signing out does not automatically remove all records subject to a legal retention requirement. We will acknowledge your request promptly and respond within the period required by applicable law. We may ask for information sufficient to verify your identity before acting on a request. Please note that the RayX VPN app does not keep records of user traffic, browsing history, DNS queries or IP addresses, so an access request cannot return them; the service data, including any iOS enterprise authentication records, is described in clause 3.

Our website, applications and services are not directed at children, and we do not knowingly collect personal information from anyone under the age of 13, or under the age of 16 where a higher threshold applies. If you believe a child has provided us with personal information, contact contact@raycentral.net and we will delete it.

This website and our applications may link to third-party sites and services. We are not responsible for the content or privacy practices of those third parties, and we encourage you to review their own privacy notices. Traffic you send through RayX VPN reaches destinations we do not control, and this policy does not govern what those destinations do with the information you send them.

We may update this policy from time to time to reflect changes in law or in our operations. The current version is always published on this page with the date it was last updated. We will not weaken the commitments in clause 3 or the platform VPN API limitation in clause 4 without giving clear, prominent notice to affected users in advance.

Privacy questions and rights requests: contact@raycentral.net. Technical and product support: support@raycentral.net. By post: RayCentral LLC, 1209 Mountain Road Pl NE, Albuquerque, NM 87110, United States.