Privacy Policy

Effective: May 20, 2026 · Last updated: September 11, 2026

URAYF LLC ("urayf," "we," "our," or "us") is committed to protecting the privacy of our clients and the data they share with us. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding that information.

If you have questions about this policy, contact us at privacy@urayf.com.

1. Who We Serve

urayf is a business intelligence firm. Our clients are independent retailers, franchisees, and small business owners who hire us to analyze their store operations and produce regular reports. This policy applies to data we receive in the course of providing those services, and to information collected through urayf.com.

2. Information We Collect

From Our Clients (Account Holders)

When you become a urayf client, we collect:

• Your name, email address, and contact information
• Your business name(s) and store identifier(s)
• A password (stored in encrypted form — we never see your plaintext password)
• Optional profile information you provide (display preferences)

From Our Clients' Employees (Schedule Texts)

Clients who use urayf's scheduling feature enter their employees' names and mobile phone numbers in the urayf portal so that urayf can text each employee their own work schedule. See Section 5, "Text Messaging (SMS) Program."

From Our Clients' Operations

To produce the reports our clients pay for, we receive operational data from our clients' point-of-sale and inventory systems. This includes:

• Point-of-sale (POS) transaction data
• Invoice summary reports
• Daily merchandise reports
• Electronic journal reports
• Shift data, including employee names where present in the original data

This data is provided to us by our clients, who are responsible for having lawful authority to share it with us under their agreements with their own employees, vendors, and customers. Apart from Schedule Texts that an employee has personally opted in to (Section 5), we do not contact, market to, or otherwise interact with the individuals named in this data.

From Visitors to urayf.com

Our public website may collect:

• Standard server logs (IP address, browser type, pages visited, timestamps)
• Information you voluntarily submit (e.g., when you email us)

We do not currently use third-party analytics, advertising trackers, or social media pixels on urayf.com.

3. How We Use the Information

We use the information we collect to:

• Operate the urayf service and deliver the reports our clients pay for
• Communicate with our clients about their account, their reports, and service-related matters
• Improve our analysis methodologies and report quality
• Comply with legal obligations
• Detect and prevent fraud or abuse

We do not:

• Sell client data to third parties
• Share client data with advertisers
• Use client data to train AI models for other clients or for any purpose outside of generating that specific client's reports
• Contact, market to, or analyze individuals identified in our clients' operational data for any purpose other than producing the client's report

4. How We Share Information

We share information only in these limited circumstances:

With your authorization. If you ask us to share information with a third party (e.g., your accountant), we will.

With our service providers. We use third-party infrastructure providers to operate urayf — currently including Supabase (database and authentication) and Vercel (web hosting). These providers process data on our behalf under contracts that require them to protect it. They do not have rights to use your data for any other purpose.

When required by law. We will disclose information if required by valid legal process (subpoena, court order). When permitted, we will notify the affected client before disclosure.

With a successor. If urayf is acquired, merged, or sold, your information may be transferred to the successor entity. Any successor will be bound by the terms of this policy.

5. Text Messaging (SMS) Program

urayf sends work-schedule notification text messages ("Schedule Texts") to employees of client stores, on behalf of and at the direction of their employer (our client). Full program terms are published at urayf.com/sms.

• What we collect. The employee's name and mobile phone number, entered by the employer in the urayf portal, along with a record of the employee's own opt-in reply.
• Opting in (double opt-in). Entering a number does not by itself start messages: urayf first texts the employee a single invitation, and sends Schedule Texts only after the employee replies YES.
• How it is used. Solely to send that employee their own work schedule when their employer publishes or updates it. Message frequency varies with schedule changes. Message and data rates may apply.
• Opting out. Reply STOP to any Schedule Text to stop receiving them, or reply HELP for help. Employees may also ask their employer to remove their number at any time.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

6. Data Security

We protect your information using industry-standard practices:

• Data is encrypted at rest (AES-256) and in transit (TLS 1.3)
• Passwords are hashed using bcrypt; we never store or have access to plaintext passwords
• Access to client data is restricted to urayf personnel who need it to perform their job
• Our infrastructure providers (Supabase, Vercel) maintain SOC 2 Type II compliance for the services we use

We do not currently maintain SOC 2, ISO 27001, or HIPAA certification for urayf itself. If your business has compliance requirements that need certification, please contact us before becoming a client so we can discuss whether urayf is the right fit.

7. Data Retention

We retain your operational data — the point-of-sale, inventory, report, and 7BOSS credential data described above — only for as long as you are an active urayf client, and permanently delete it 21 days after your subscription ends (see Section 9 of the Terms of Service). We may retain limited billing and tax records (such as invoices and payment history) for the period required by law; those records do not include your store's operational data or your 7BOSS credentials.

You can request deletion of your data at any time by contacting privacy@urayf.com. We will honor deletion requests within 30 days, except where we are legally required to retain certain records.

8. Your Rights

Depending on your location, you may have rights regarding your personal information, including the right to:

• Access the information we hold about you
• Correct inaccurate information
• Request deletion of your information
• Object to or restrict certain uses

To exercise any of these rights, contact privacy@urayf.com. We will respond within 30 days.

Illinois residents: urayf does not collect biometric information (fingerprints, face scans, retinal scans, voiceprints, or hand geometry) and is not subject to the Illinois Biometric Information Privacy Act.

9. Children

urayf is a business-to-business service. We do not knowingly collect information from individuals under 18. If you believe we have inadvertently collected information from a minor, contact privacy@urayf.com and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Effective" date at the top. For material changes, we will notify clients by email at least 30 days before the changes take effect.

11. Contact

For any privacy-related questions or requests:

• Email: privacy@urayf.com
• Mail: URAYF LLC, 125 SW Jefferson Ave, Peoria, IL 61602