Privacy policy.

1. Who we are

RayAI | CJ ("RayAI | CJ", "we", "us") is operated by Toss the Coin Ltd, a company incorporated in India, registered at 1a, Bheemanna Mudali St, Natesan Colony, Alwarpet, Chennai, Tamil Nadu 600018. This policy explains what personal data RayAI | CJ collects, why, where it is kept, for how long, and the choices you have. It works together with our Terms of Service. For your own account data, we decide how it is used. For the data of people in your network, we process it on your behalf, only to provide RayAI | CJ to you.

2. What we collect

• Your account. Your name and email, your sign-in records, and when you last used RayAI | CJ. You sign in with a 6-digit code we email to your address; we keep only a one-way hash of it until it is used or expires. If you set a password before sign-in moved to emailed codes, it stays only as a one-way scrypt hash (which can’t be turned back into the password) and is not used. Each signed-in browser is recorded with its IP address and browser type, to keep your account secure. The administrators of RayAI | CJ can see your account’s sign-in times and usage counts, never your password, chats or contacts.
• Your profile, if you add it. What you enter in Edit profile or ask CJ to save: name, title, company, company website, location, LinkedIn profile link, what you sell, a photo and your writing preferences.
• Your company workspace. When you sign up with a work email, you join your company's workspace, named from your email's domain; we create it if it doesn't exist. People who sign up with the same domain join it too. The workspace holds your company's website, its offerings, its use-case library and a few shared settings, and everyone in it sees them. To draft the offerings and the library, RayAI | CJ reads your company's public website (through Exa and our AI provider). People in your workspace don't see your chats, ICPs, accounts, network or LinkedIn data.
• Your ICPs. The descriptions you type, your website address and the pages RayAI | CJ read from it, and the tags you keep.
• Your chats with CJ. Your questions, CJ's answers and the event searches behind them.
• Events. Public details of business events found on the web, and how you mark them.
• Your agreements. Which version of the terms you agreed to, when, and the browser you agreed in.
• LinkedIn, once you connect it. Only what How we use LinkedIn data describes: your 1st-degree connections, the profiles you open (and, a few at a time in the background, the profiles of likely fits whose current employer is unknown), posts about events you choose, recent posts of the people in your Smart Feed (people in your accounts, ICP matches, people you ★ Shortlist and your 1st-degree connections, from the last 14 days), 2nd and 3rd-degree people a LinkedIn people search finds when you ask for them or open an account (people at that company who match your ICP), and companies a LinkedIn company search finds when you ask for them (company fields only, never people). RayAI | CJ never writes to LinkedIn.
• Account Intelligence. Public facts about the companies you track (company pages, press releases, public news and job postings), the people they name in public sources (name, title, why they matter; never an email or a phone number), and, once you connect LinkedIn, each one’s degree and how many mutual connections you share; or, when our team supplies them from one person’s LinkedIn network, each one’s degree, how many mutual connections and up to three of their names. Our AI provider gets companies, roles and signals for drafts, and CJ sees degrees and mutual-connection counts; never people’s or mutual connections’ names.
• Public company information. For the companies your connections (and the people found beyond your network) work at: their LinkedIn company pages (industry, size, headquarters) and their own websites (what they sell and to whom), to score fit on the current employer. Company names and public web pages are sent to our AI provider; people’s names are not.
• Your LinkedIn connections export, if you upload it. Optional. We match it to the connections RayAI | CJ already read and keep only each match’s company and position. The emails in the file are discarded, and the file itself is not kept.
• The waitlist. When sign-up is limited, if you sign in before your access is ready, we keep your email, your name and when you visited, so we can let you in later.
• Usage and credits. A record of the web searches and AI requests made for you, with their time and cost, so we can keep within daily limits and count your credits. Never what they said.

3. People in your network

• You decide whom to approach and why. We process their data on your behalf, only to provide RayAI | CJ to you. We never sell it, and we never combine it with other customers' data, including other people in your company workspace.
• If someone asks us to remove them, we delete their data from your account. Anyone can ask us at gowtham@tossthe.co.in.

4. How we use it, and why we may

• To run your account and keep it secure (to provide the service you signed up for).
• To find events and rank people in your network against your ICP (to provide the service).
• To draft messages for you to copy and send yourself. RayAI | CJ never sends, reacts, comments or posts on LinkedIn.
• To keep within daily limits that protect your LinkedIn account and our costs, and to count your credits (our legitimate interest in running RayAI | CJ safely).
• To process the data of people in your network, for you (your and our legitimate interest in business networking).

5. Services we use

These companies process personal data for us, only to provide RayAI | CJ:

• Railway (United States) runs our app, sign-in and database in the United States.
• Brevo (France) sends your sign-in codes by email. It receives only your email address and the code, and sends nothing else to you.
• Unipile SAS (France) connects your LinkedIn account. You sign in on its secure page, so we never see your LinkedIn password. While you are connected, Unipile keeps your sign-in session and a copy of your LinkedIn messages, stored in France.
• OpenRouter (United States) passes our AI requests to the model provider with zero data retention: they keep no copy and never train on your data.
• Anthropic (United States) makes the Claude models that answer those requests, reached through OpenRouter. We build requests without people’s names where we can (scoring, the Smart Feed and drafts); what you type to CJ is sent as you wrote it. OpenRouter may send them to Claude models run by Anthropic or by its cloud partners (Amazon Web Services or Google Cloud), under the same no-retention rule.
• Exa (United States) searches the web for events, reads the pages of your website when you build an ICP from it, reads your company's website for its offerings and use-case library, and reads the public websites of the companies your connections work at. It receives search terms and web addresses, not your name or email, and never a person’s name.
• Apollo (United States), when your workspace has it switched on, supplies company data for Account Intelligence (company facts and job postings). It receives company website domains, never your network or anyone’s name.
• Sentry (United States) receives error reports from our servers so we can fix problems: what went wrong, where in the app it happened and when. It never receives your messages to CJ, CJ’s answers, your LinkedIn data or your email address.

6. International transfers

We are based in India. Your data is stored in the United States (Railway), and the services above process it in the United States and France. Where the law requires it, these transfers are covered by our providers' data processing terms, including the EU Standard Contractual Clauses.

7. How long we keep it

• Your account, profile, ICPs and Account Intelligence accounts: while you have an account.
• Sign-in records, with their IP address and browser type: until you sign out, or 7 days after you last used RayAI | CJ in that browser.
• Sign-in codes: until used, or 10 minutes after they are sent.
• A one-way record of the networks you have signed in from (so a stranger’s wrong guesses can’t lock you out): 90 days after you last signed in from that network.
• LinkedIn message text: up to 180 days. A record that a message existed (its direction, status and times): up to 24 months.
• People you never act on: removed after 30 to 90 days.
• Public posts about events: deleted 90 days after they were posted, or 30 days after they were found when the author is neither a connection nor on your Shortlist.
• Smart Feed posts: shown for up to 14 days, and deleted 90 days after they were posted at the latest.
• Error reports at Sentry: up to 90 days.
• Chats with CJ: while you have an account. You can delete any chat in History at any time.
• When sign-up is limited, a waitlist entry: until you are let in, or ask us to remove it. Usage records (counts and costs of the calls RayAI | CJ makes, never what they said): while you have an account.
• Your company workspace's website, offerings and use-case library: while the workspace is in use. Closing your own account doesn't remove them, because your colleagues use them.
• When you disconnect LinkedIn, RayAI | CJ stops all LinkedIn activity at once and asks Unipile to delete its copy of your data within 30 days.
• When you close your account, we delete your data within 30 days. Copies in backups expire within 89 days.

8. Your choices and rights

• Change your profile in Edit profile or by asking CJ, and delete chats in History and ICPs on Home.
• Disconnect LinkedIn in Connectors → LinkedIn (RayAI | CJ never writes to LinkedIn, so there is nothing to switch off).
• Delete your account and its data yourself, from Edit profile. Or ask us at gowtham@tossthe.co.in and we will do it.
• Ask for a copy of your data, a correction, its deletion, or anything else about your privacy at gowtham@tossthe.co.in. We answer within 30 days.
• We never sell your personal data or share it for advertising.

9. If you are in the EU or the UK

You have the right to access your data, correct it, delete it, take a copy with you (portability), restrict or object to how we use it, and withdraw consent where we rely on it. You can also complain to your data protection authority (in the UK, the ICO). Write to gowtham@tossthe.co.in to use any of these rights.

10. If you are in India

Under the Digital Personal Data Protection Act, 2023, you can ask for a summary of your data and how we use it, have it corrected, completed or erased, name someone to act for you, and raise a grievance with us. Write to gowtham@tossthe.co.in. If you're not satisfied with our answer, you can complain to the Data Protection Board of India. Our grievance officer is our founder, at gowtham@tossthe.co.in.

11. Cookies and browser storage

RayAI | CJ uses cookies only to keep you signed in and to remember interface choices, such as a collapsed sidebar. Your browser also keeps your theme. A question you asked on this site waits in that browser tab until RayAI | CJ opens for you and asks it, you sign out, or you close the tab. These are all essential to how RayAI | CJ works, so we don't ask for cookie consent. There are no advertising or analytics trackers. If we add analytics, we will update this policy first and ask for your consent where the law requires it.

12. Who can use RayAI | CJ

RayAI | CJ is for business use by people aged 18 or over. We don't knowingly collect data about children.

13. Changes to this policy

If we change this policy, we will tell you in the app, and ask you to agree again for important changes.

14. Contact

• Email: gowtham@tossthe.co.in
• Address: Toss the Coin Ltd, 1a, Bheemanna Mudali St, Natesan Colony, Alwarpet, Chennai, Tamil Nadu 600018

End of privacy policy.