Privacy Policy

1. Who is responsible for your data

The controller is Iliya Oblakov, a sole trader trading as RayaStats, based in London, United Kingdom. Email: iliyaoblakov@gmail.com. We follow UK data protection law: the UK GDPR and the Data Protection Act 2018.

2. What we collect

• When you buy an audit. Stripe collects your card and billing details. We receive your name, email address, billing country, the amount and status of the payment, and the card brand and last four digits. We never see your full card number.
• Your intake answers. Your business name, website, the location to audit, your services, your competitors and anything else you choose to tell us.
• Public business information. To run the audit we look at public information about your business and its competitors: listings, reviews, websites and AI engine answers. Public reviews can show the reviewer's name; we quote only what we need to explain a finding.
• Messages and calls. Emails you send us and, for the Audit + Fix Kit, our notes from the call. We do not record calls unless we ask first and you agree.
• Accounts. Only the site owner and invited clients have one. We store your email address, a hashed password and the security records that protect the account, such as failed sign-in attempts.
• The contact form. Your name, email address and message, plus your phone number, company and subject if you add them.
• Website visits. We count visits with our own analytics: no cookies, no advertising trackers and no stored IP addresses. For each page view we store the page, the referring website, your country as reported by the network, your browser's user agent and a code made from your IP address and browser that changes every day and cannot be turned back into your IP address.
• Server logs. Our hosting keeps standard technical logs, such as IP address, time and page requested, for security and troubleshooting, for a limited time.

3. Cookies

The public website sets no cookies. Only signing in to an account, which is limited to the site owner and invited clients, uses a cookie or browser storage, and only because the account cannot work without it.

4. Why we use your data

• To deliver what you bought (contract): the intake email, the audit, the report, the call, the re-test and support.
• To meet legal duties (legal obligation): keeping accounting and tax records.
• To run the business sensibly (legitimate interests): answering messages, keeping the site secure, counting visits without tracking people, improving our services and using anonymized, combined findings that never identify you or your business.
• To publish a testimonial (consent): only with your approval. You can withdraw it at any time and we will take it down.

We do not sell your data, we do not use it for advertising and we do not send you marketing email unless you ask for it. We do not sell or share personal information for cross-context behavioral advertising.

5. Who processes it for us

• Stripe processes payments. It also uses payment data to prevent fraud and meet its own legal duties, under its own privacy policy.
• Google stores our email: our support address, iliyaoblakov@gmail.com, is a Gmail account.
• Mailgun (part of Sinch) sends and receives email for rayastats.com, including contact form notifications.
• Hetzner Online hosts the website, its database and its server in Nuremberg, Germany.
• AI engines. For the audit we type the kind of questions your clients ask, about your market, your business and its competitors, into AI engines. We do not enter your personal details or your clients' data into them.
• Advisers and authorities. Our accountant, and public authorities when the law requires it.

6. Transfers outside the UK

Some of these providers process data in the United States and other countries. When data leaves the UK, we rely on the safeguards those providers offer, such as UK-approved contract clauses or the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

7. How long we keep it

• Payment and order records: six years after the end of the tax year, as UK tax rules require.
• Intake answers, reports and call notes: two years after delivery, then deleted.
• Emails and contact form messages: up to two years after our last contact, unless they form part of an order.
• Website visit records: up to 13 months.

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, limit or object to how we use it, or send it to you in a portable format, and you can withdraw consent at any time. Email iliyaoblakov@gmail.com and we will reply within one month. You can also complain to the UK Information Commissioner's Office at ico.org.uk, though we would like the chance to put things right first.

If the EU GDPR applies to you, for example because you are in the European Union, you have the same rights under it and can also complain to your local data protection authority. In Bulgaria, that is the Commission for Personal Data Protection at cpdp.bg.

9. Security

The website runs over HTTPS, the server sits behind a firewall and only the owner has access to the data. No system is perfectly secure; if a breach puts your data at risk, we will tell you as the law requires.

10. Children

Our services are for businesses and are not aimed at children.

11. Changes

If we change this policy, we update the date at the top of this page. For how we handle orders and refunds, see the Terms of Service and the Refund Policy.