Data and AI at RAYN

Where your data lives

Guest and venue data is held in a managed PostgreSQL database provided by Supabase, hosted on Amazon Web Services in the Seoul region (ap-northeast-2). The application and API run on Vercel, with server functions in the same Seoul region to sit next to the database. Traffic to and from the platform is served over HTTPS with TLS. Product and website analytics are handled by PostHog in its EU region.

Who processes it

RAYN shares data with third-party providers only to run the service, and does not sell personal data. The providers that can receive guest personal data are:

• Anthropic (and Google as a failover) — AI generation of concierge replies and extraction of booking details.
• OpenAI — menu extraction and transcription of guest voice messages.
• ElevenLabs — the voice concierge, for venues that use it.
• Twilio — WhatsApp and SMS delivery (guest phone number and message content).
• Meta — the Instagram direct-message concierge.
• Postmark — transactional and campaign email.
• Stripe and Network International (N-Genius) — payment and deposit processing.
• Supabase (database and authentication) and Vercel (hosting).

Where a venue connects its own reservation system or point-of-sale (for example OpenTable, SevenRooms, Resy, serVme or Oracle Simphony), booking data is also sent there — but only for that venue and only once it connects the account. The current provider list and processing regions are set out in the privacy policy.

How we use AI

RAYN uses AI to draft concierge replies over WhatsApp, voice and Instagram, to pull booking details out of a conversation, and to write summaries for venue teams. To do this, guest data is sent to our AI providers (Anthropic, with Google as a failover). Depending on the conversation, that can include the guest's name and contact details, the message content, dietary and allergy notes, seating and occasion preferences, and past-visit history.

We do not state on this page whether these providers train their models on that data — that is governed by our agreements with them, and is only claimed once confirmed.

Who owns guest data

Guest data belongs to the guest and to the venue they booked with. RAYN processes it to run that venue's bookings, service and communication — not to resell or repurpose it. Each venue's guests are isolated from every other venue: access is enforced at the database with row-level security, so a venue reaches its own guests and not another operator's. That isolation is covered by an automated test on every change.

Access, export and deletion

A guest can ask for a copy of their data or ask for it to be deleted by contacting RAYN. Every request is recorded, and our team actions it — including erasure across bookings, feedback, messaging and profile data, while keeping the minimum financial records the law requires.

A venue can export its own guests — names, contact details, consent status, dietary and preference notes, and a per-visit summary — as a CSV, from one button in its venue settings. Every export is logged with who ran it, when, and how many guests it covered.

Message content is redacted on a schedule: campaign message text after 90 days, and WhatsApp, session and feedback content after longer windows. Booking records are kept so the venue can run its operations. The retention detail is in the privacy policy.

Payments

Card details never reach RAYN. Deposits and payments run through Stripe and Network International (N-Genius), which handle the card data through their own secure flow. RAYN stores a payment reference, not card numbers.

Contact

For access, export or deletion requests, or any question about how your data is handled, email legal@rayn-co.com. For general or security matters, email contact@rayn-co.com. The full legal detail is in the privacy policy.

Last updated: September 2026