This English translation is provided for convenience. The French version is the legally binding one. View the French version

1. Preamble

This Privacy Policy describes how RayorConnect collects, uses and protects your personal data when you use our single sign-on (SSO) authentication service. We undertake to never sell, rent or commercialize your personal data to third parties for advertising purposes.

2. Data collected

When you use the Service, we collect the following data:

• Account data: Email address, unique user identifier and, where applicable, your last name, first name and avatar.
• Technical data (logs): IP address, date and time of sign-in, browser type, URL of the site requesting the sign-in.

3. Age verification and biometric data

Rayor Connect offers an optional age verification. If you use it, we process biometric data (special category — Article 9 of the GDPR):

• Selfie and identity document: a photo of your face (liveness check) and, depending on the flow, a photo of your identity document (and a reading of its MRZ strip).
• Face comparison: a facial template is computed, for the duration of the verification, to confirm that the selfie matches the document.

Legal basis: your explicit consent (Article 9(2)(a) of the GDPR), obtained before any capture. You can withdraw it at any time.

Retention: the media (selfie, document, facial template) are processed ephemerally and then deleted: automatically at the end of the instant verification or — in the case of a manual verification — immediately after review by an authorized person. We keep no biometric data; only the result is kept (your date of birth, an “age verified” status and age predicates).

Sharing the result: when a third-party site that you authorize requests an age verification, we only send it the result (“age over N” predicates and, where applicable, your age / date of birth) — never your images or your biometric template.

4. Data sharing

Your data is only shared with the following entities:

• Third-party sites (Clients): When you use RayorConnect to sign in to an external site, you consent to our sending your profile information (Email, ID) to that specific site in order to establish your session.
• Payment: for the paid services of the ecosystem (e.g. Rayor Plus), payment processing is entrusted to our provider Stripe; no bank card data is stored by Rayor.
• Hosting: Our infrastructure is hosted by OVH Cloud. Your data remains stored within European territory.
• Competent authorities: In accordance with the law, we may disclose your connection logs to administrative or judicial authorities (Government, Police, Courts) only upon a lawful request.

5. Retention period

• Account data: Kept for as long as your account is active.
• Connection logs: Kept for the legal period of 1 year, in accordance with Article L.34-1 of the French Postal and Electronic Communications Code (CPCE).

6. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time (in particular for age verification) and to set post-mortem directives. To exercise them, contact our data protection officer: dpo@group.rayor.fr. You can also lodge a complaint with the CNIL (www.cnil.fr).

Some services of the Rayor ecosystem (for example RayorFit or Rayor Transfer) may process additional data, described in their own notices.