Privacy Policy

1. Data controller

The controller of personal data collected through the Rayonne platform is :

Sponge Theory 27 Rue Maximilien de Robespierre 78711 Mantes-la-Ville, France E-mail : contact@sponge-theory.ai Website : https://rayonne.sponge-theory.dev

2. Data collected

In connection with use of the Rayonne platform we collect and process the following categories of data :

2.1 Identification and account data

• First name, last name, e-mail (collected on registration or through the identity providers Google, Apple, Microsoft via our authentication provider Clerk).
• Unique account identifier.

2.2 Data relating to the User’s SaaS products

• URLs of websites submitted to crawl and product brief.
• Contents of crawled pages (text, metadata, HTML structure).
• Inferred ICP, persona, brand voice.
• Generated strategies (Bullseye, ninety-day plan, AARRR scoring).
• Generated content (directories, threads, posts, articles).

2.3 Submission data

• OAuth credentials to third-party platforms (G2, LinkedIn, X, Bluesky, etc.) when the User provides them voluntarily.
• Status, timestamp, external URL and external reference of submissions.
• Evidence screenshots (Mode B / extension), kept on our access-restricted file storage.
• Browser extension: the screenshots and short video clips of their product that the User takes by clicking the extension's icon, sent with their caption to their workspace's gallery; the address of the listing published by a Mode B submission; the inventory of a directory form's fields when the User runs the selector test. This data goes only to Rayonne, with the User's API key. The extension reads neither the browsing history nor any tab other than the one the User acts in.

2.4 Measurement data

• Clicks on tracked links /r/{token}, aggregated by channel.
• AARRR metrics per time window.

2.5 Payment data

• Payment information (card number, expiration date) is collected and processed exclusively by our payment provider Stripe. We never store banking data on our servers.
• We only retain the Stripe customer identifier, subscription type and billing history.

2.6 Usage and analysis data

• IP address, browser type, operating system, pages visited, session duration.
• Technical error logs (Sentry — anonymised at the e-mail level).

3. Purposes and legal bases for processing

4. Recipients of the data

Your personal data may be communicated to the following categories of recipients, strictly within the purposes above. The exhaustive and up-to-date list is published on the Subprocessors page.

• Clerk (Clerk, Inc., USA) — authentication and user account management.
• Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing and subscription management.
• Resend (Resend, Inc., USA) — transactional e-mails.
• SPT Models (Sponge Theory, France) — sovereign inference, run in France on self-hosted infrastructure. Writing, analysis and review send no data to OpenAI, Anthropic, Mistral, Google (Gemini), Groq or any other external AI provider. This sovereignty is a locked decision, not a marketing argument.
• Audigeo (Sponge Theory, France) — GEO audit run at each product analysis (brief), including when the User re-runs the analysis; on the Pro plan and above, a full GEO audit every month and a weekly reading of AI assistants’ answers to the tracked questions. Rayonne sends it the product’s public URL and, for the tracking, its name, category, the competitors it names and the tracked questions. The one exception: the GEO measurement (Audigeo, a Sponge Theory service) asks public AI assistants — ChatGPT, Gemini and Perplexity, run from the United States — the questions of the User’s market, to measure whether they mention it; those questions carry the product’s name, its category, its competitors and its audience’s problems as its brief describes them, plus the questions the User adds themselves — never private data.
• NeoRAG (Sponge Theory, France) — per-workspace knowledge base, integrated for product context retention.
• Hosting — our servers are hosted in Europe on the Sponge Theory Docker Swarm cluster. The PostgreSQL database is hosted in Europe.

4.1 Publishing platforms and YouTube API Services

When the User connects a publishing platform to their workspace (YouTube, TikTok, LinkedIn, X), Rayonne transmits to that platform, only on the User's instruction, the content they chose to publish there (video, title, description, tags, visibility). Each platform then processes that content under its own terms and privacy policy.

Rayonne uses YouTube API Services. By connecting a YouTube channel, the User agrees to be bound by the YouTube Terms of Service and acknowledges that the data transmitted to YouTube is handled according to the Google Privacy Policy.

In that context Rayonne accesses and stores the following data:

• OAuth authorisation token (refresh token) issued by Google, via the "Sign in with Google" flow, under Rayonne's single Google Cloud project, with the single "upload videos" scope (youtube.upload). It is encrypted at rest and only used to obtain a short-lived access token for each upload. It is kept until the User disconnects the platform, or until Google revokes it.
• Upload metadata (title, description, tags, visibility status, synthetic-content disclosure), kept in the workspace's submission history for evidence and measurement. The identifier of the published video, its YouTube URL and the upload evidence (the API response kept as proof) are automatically deleted 30 days after publication (YouTube API Services Developer Policies); the corresponding history row is kept, stamped "YouTube data deleted after 30 days". This data is not shared with any third party other than Google.

Rayonne neither reads nor stores any other data from the User's YouTube channel (subscribers, comments, analytics, other videos). No YouTube data is used for advertising or transmitted to any external AI provider.

Revocation. The User can withdraw Rayonne's access to their YouTube channel at any time from the Third-party apps with account access page of their Google account, or by disconnecting the channel from their workspace's Connect guide; disconnecting immediately deletes the token and the associated data (video identifier, URL, upload evidence). They can also request deletion of this data by writing to contact@sponge-theory.io; the request is honoured within 7 days.

We do not sell or rent your personal data to third parties for commercial purposes.

5. International data transfers

Some of our sub-processors (Clerk, Resend) are located in the United States. These transfers are framed by :

• The EU-U.S. Data Privacy Framework for certified providers.
• Standard Contractual Clauses (SCC) adopted by the European Commission, where applicable.

All of Rayonne’s AI inference runs in France, on Sponge Theory’s own infrastructure. No prompt or User content is sent to an external AI provider to be processed by a large language model; only the GEO measurement’s questions (product name, category, its competitors and its audience’s problems as its brief describes them, questions the User adds) reach public AI assistants — ChatGPT, Gemini and Perplexity —, all operated in the United States. The main database and generated reports are hosted in Europe.

6. Retention periods

• Account data : kept as long as the account exists. When it is deleted, the e-mail address, name and photo are erased immediately; only an internal identifier, holding no personal data, remains for the integrity of the history.
• Brief, strategy, content, submission data : kept as long as the workspace exists, including after the subscription is cancelled. They are deleted — database, stored files and knowledge base — when the User deletes the workspace or the organisation, or on request.
• Photos imported as avatars : a real photo is only imported with the consent of the person it shows, which the User attests. It is kept until the User deletes it from the Avatars page — to be done as soon as the person withdraws their consent — or with the workspace; the photo and its cutout are then erased. Videos already rendered that show it remain until they are deleted themselves.
• Billing data : kept for 10 years pursuant to French accounting and tax obligations (Commercial Code, art. L123-22).
• Measurement data (clicks, AARRR metrics) : kept as long as the workspace exists; deleted with it, or on request.
• GEO audit : the audited site and its audits are kept by Audigeo, a Sponge Theory service separate from Rayonne. When the workspace or the organisation is deleted, Rayonne deletes the tracked questions and their readings at Audigeo — if Audigeo cannot be reached at that moment, at the first weekly reading where Audigeo answers; the audited site and its audits stay there, and their deletion is requested separately at contact@sponge-theory.ai.
• Backups : a copy of the data above remains in the local backups for up to fourteen days after its deletion; the off-site copy of the database, when enabled, is not purged automatically at this time.
• Technical logs (Sentry) : 90 days maximum.

7. Your rights

Pursuant to the General Data Protection Regulation (GDPR) and French Act n° 78-17 of 6 January 1978 as amended, you have the following rights :

• Right of access (art. 15 GDPR) : obtain confirmation that your data are processed and receive a copy of them.
• Right to rectification (art. 16 GDPR) : correct inaccurate or incomplete data.
• Right to erasure (art. 17 GDPR) : request deletion of your data, subject to legal retention obligations.
• Right to restriction of processing (art. 18 GDPR) : restrict processing in certain cases.
• Right to portability (art. 20 GDPR) : receive your data in a structured, commonly used and machine-readable format.
• Right to object (art. 21 GDPR) : object to processing based on legitimate interest.
• Right to withdraw consent : withdraw at any time your consent for processing based on it, without affecting the lawfulness of prior processing.

To exercise your rights, contact us at : contact@sponge-theory.ai

We undertake to respond to your request within a maximum of one (1) month from receipt.

8. Complaint to the CNIL

If you consider that processing of your data constitutes a GDPR breach, you have the right to lodge a complaint with the French Data Protection Authority (CNIL) :

CNIL 3 Place de Fontenoy, TSA 80715 75334 Paris Cedex 07 Website : www.cnil.fr

9. Cookies and trackers

The Rayonne platform uses cookies and similar technologies for the following purposes :

9.1 Strictly necessary cookies

Session, authentication (Clerk) and security cookies. These are essential for the platform to operate and do not require your consent.

9.2 Audience measurement cookies

We may use analytics tools to understand platform usage and improve performance. These cookies are set only after obtaining your consent.

You can manage your cookie preferences at any time through your browser settings or our consent banner.

10. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration, including :

• Encryption in transit : connections to the Platform and the calls we make to third-party services go over HTTPS (TLS).
• Encryption at rest of secrets : third-party platform access tokens and API keys are encrypted in the database (Fernet), with a key kept outside the database. Other data — the database, stored files (images, videos, evidence screenshots) and their backups — is not encrypted at rest at this time : it is protected by Sponge Theory’s self-managed hosting and by access restriction.
• Authentication delegated to Clerk (OAuth 2.0).
• Access restricted to data on a least-privilege basis, and isolation per organisation and per workspace.
• Daily backups of the database and of stored files, kept for fourteen days on Sponge Theory’s infrastructure; the off-site copy of the database, when enabled, is not purged automatically at this time.
• Automated monthly watch of the rules third-party platforms publish, reviewed by a human before any change to our publishing rules.

11. Privacy policy amendments

We reserve the right to amend this privacy policy at any time. Material changes will be notified by e-mail or in-platform. The last update date appears at the top of this document.

12. Contact

For any question regarding this policy or the protection of your personal data, contact us :

Sponge Theory 27 Rue Maximilien de Robespierre 78711 Mantes-la-Ville, France E-mail : contact@sponge-theory.ai Website : https://rayonne.sponge-theory.dev

© Sponge Theory. All rights reserved.