Legal

Raya AI is an optional assistant that answers questions about your data and prepares work in it — filling in bills, expense vouchers, invoices, quotations and orders, finding stock, and producing forecasts. It prepares; a person approves. These additional terms apply whenever it is used.

1. It acts as your user, never above them

• Raya AI can only read and write what the user who asked is already permitted to read and write. It holds no separate privileges of its own.
• Nothing is saved to your books without a person. The assistant prepares a document and stops; a user with the right permission must approve it before it is posted. You can disable drafting entirely, or set a value above which it will refuse to draft at all.
• Every action is written to the audit trail alongside the prompt that produced it, the steps taken, and the user on whose behalf it acted.
• Anything approved and posted can be reversed through the same process as any other entry.
• An administrator can switch Raya AI off for the whole company at any time, and can assign or remove an individual user’s AI seat from one month to the next.

2. You remain responsible for your records

Raya AI is not a substitute for professional judgement, and its output is not accounting, tax, legal or financial advice. Statutory filings remain yours to verify and sign.

3. Accuracy and limitations

• AI output can be incomplete or wrong, particularly where your masters, rates or history are incomplete.
• Where a vendor, item, rate or ledger is ambiguous, Raya AI is designed to ask rather than guess — but this is a safeguard, not a guarantee.
• Forecasts are estimates derived from your own history. They describe a likely outcome, not a promised one, and should not be the sole basis of a purchasing or credit decision.
• We may change, improve or withdraw individual AI capabilities as the underlying technology changes.

4. How your data is used to answer a request

To carry out a request, Raya AI sends the prompt and the specific records needed to answer it to our AI provider for processing, served from infrastructure located in India. That processing is governed by a contract that prohibits using your content to train any model and requires deletion after the request is served. Your books are never training data — for us or for anyone else. Administrators can choose which model provider serves their requests, and the current list of AI subprocessors is set out in the Privacy Policy below and is available on request.

If you would prefer that no data leave the platform for AI processing at all, an administrator can switch Raya AI off for the whole company. The rest of the platform works exactly the same way without it.

5. Acceptable use of AI

• Do not use Raya AI to generate records you know to be false, or to disguise the nature of a transaction.
• Do not use it to produce content that is unlawful, or to make decisions about individuals that require human review under applicable law.
• Do not attempt to extract the underlying model, its instructions, or data belonging to another customer.

6. What it costs

Raya AI is ₹499 per enabled seat, per month. Seats can be added or dropped from one month to the next, and each one adds 100 questions and 5 actions to the pool your company shares.

This section explains what we collect, why, who else touches it, and how long we keep it. It applies to the Raya ERP & CRM platform and to this website.

1. Our role

For the business data you put into the platform — your customers, vendors, employees and transactions — you are the Data Fiduciary and we act as a Data Processor on your instructions. For the account we hold with you, such as your administrator’s contact details and your billing records, we are the Data Fiduciary ourselves. Both roles are used in the sense given to them by India’s Digital Personal Data Protection Act, 2023.

2. What we collect

• Profile information: name, business email, phone and company details used for account management and billing.
• Business data: the inventory, sales, purchase, finance, HR, project and CRM records you and your users create, held in your isolated tenant.
• AI usage data: counts of questions asked and actions taken, per user, together with the cost attributed to them, so that administrators can see usage on the Usage screen and we can meter your plan.
• AI prompt logs: the text of questions and answers. This is off by default. An administrator may switch it on for review, choose how many days it is kept, and it is never kept for HR or Payroll prompts. Where logging is on, PAN, Aadhaar, bank account and phone numbers are masked before anything is written down.
• Usage data: technical logs such as IP address, browser, device and timestamps, used to keep the system stable, secure and performant.
• Cookies: strictly necessary cookies for sign-in and session security. We do not use advertising cookies or sell audience data.

3. How we use it

To provide and secure the service, to process your instructions including AI requests, to bill you, to provide support, to detect and prevent abuse, and to meet legal and tax obligations. We do not use your business data to market to your customers, and we do not sell data to anyone.

4. Tenant separation

Raya uses strict logical isolation for every customer (“Tenant”). Your inventory, sales and financial records are never mixed with those of another company, and every query — including one made by Raya AI — is scoped to your tenant before it runs.

5. AI processing and subprocessors

When a user asks Raya AI to do something, the prompt and the records needed to carry it out are sent to our AI provider for processing and the result is returned to your tenant. We contract with those providers on terms that:

• prohibit the use of your content to train or improve any model;
• require your content to be deleted once the request has been served, apart from any short-lived abuse-monitoring window the provider operates;
• restrict onward sharing and require security measures at least as strong as our own.

We keep a current list of our AI and infrastructure subprocessors and will provide it on request to info@rayasolutions.in. We will give notice before adding a subprocessor that processes customer business data.

6. Who else we share with

We do not sell your data. We share it only with infrastructure and service providers required to run the platform — such as Microsoft Azure for hosting — with professional advisers under confidentiality, and where we are legally required to by an Indian regulatory authority or a valid court order. Where we are compelled to disclose, we will tell you unless the law forbids it.

7. Security

• Data is encrypted in transit and at rest, and is hosted in India.
• Access is role-based, least-privilege, and logged; Multi-Factor Authentication is available to every user and recommended for all.
• Our own staff access customer data only where needed to provide support or resolve an incident, and that access is recorded.
• Backups are taken regularly and restoration is tested.
• If a personal data breach occurs, we will notify you and the Data Protection Board of India as the DPDP Act requires, without undue delay.

8. Retention and deletion

Financial records are retained for 7 years to meet GST and company-law obligations. The audit trail for an approved AI-assisted document is retained with that document. AI prompt logs, where an administrator has switched them on, are kept for the number of days that administrator sets; usage and audit records have their own, longer retention. If you cancel your subscription, your data is kept for 30 days so you can export it, after which it is permanently purged from live systems and rolls out of backups on the normal backup cycle. You can ask us to delete sooner, subject to any retention the law requires of us.

Under India’s Digital Personal Data Protection Act, 2023, an individual whose personal data we hold as Data Fiduciary may:

• ask what personal data of theirs we process, and who we have shared it with;
• ask us to correct or complete data that is inaccurate or out of date;
• ask us to erase personal data we no longer need for the purpose it was collected for;
• nominate another person to exercise these rights in the event of death or incapacity;
• withdraw consent, where we relied on consent to process the data;
• raise a grievance with us, and escalate it to the Data Protection Board of India if we do not resolve it.

Where the personal data belongs to your customers or employees and sits in your tenant, we hold it as a processor on your behalf. Send those requests to the company that operates the tenant — we will support them in answering it, but we cannot act on their data without their instruction.

Grievance Officer

Write to our Grievance Officer at info@rayasolutions.in with “Privacy Grievance” in the subject line, or by post to Raya Solution & Company, A-504, Eastface Building, Iscon Ambli Road, Ambli, Ahmedabad - 380058, Gujarat, India. We will acknowledge within 7 working days and aim to resolve within 30 days.

Changes to this policy

We will post any change here and update the date at the top of the page. If a change materially affects how we handle personal data, we will give notice in the application or by email before it takes effect.