Rayon

The Terms of Use explicitly state that the client retains full ownership of all intellectual property rights in content they upload to the platform. Rayon is granted only a narrow, purpose-limited licence to store, host, maintain, and reproduce content for backup purposes, which terminates when the client deletes their account or the content. This is a user-favorable position.

The Terms of Use are silent on who owns AI-generated outputs specifically. The client IP retention clause covers content the client uploads, and the AI training clause clarifies that AI training use does not grant Rayon ownership over the user's underlying intellectual property. However, there is no explicit statement that AI-generated outputs belong to the user, leaving some ambiguity.

Rayon distinguishes between public and private models. Public models may be used for AI training without any opt-out mechanism, which is a meaningful risk for users who designate content as public. Private models are subject to an explicit opt-in requirement, which is user-favorable. However, the broad availability of public content for training — with no opt-out — and the irrevocability of the licence for already-processed content are notable limitations.

The Privacy Policy provides specific retention periods for different data categories: contractual data is retained for the duration of the relationship plus the applicable statute of limitations; accounting/invoicing data is retained for 10 years under French commercial law; direct marketing data is retained for 3 years after account deletion. Users can request deletion via the GDPR right to erasure, and account deletion triggers immediate deletion of account data per the Terms. However, no deletion SLA is specified for data deletion requests beyond the general 1-month GDPR response window, and no security-specific retention obligations are mentioned.

The Privacy Policy discloses sharing with authorized employees, service providers/processors, and competent authorities. The Terms of Use additionally disclose that AI feature usage transmits data (prompts, text, screenshots, images, drawing data) to named third-party AI providers including OpenAI, Google, Anthropic, Mistral, Photoroom, and Black Forest Labs. Rayon explicitly disclaims control over these providers' processing and directs users to consult their own privacy policies. There is no indication of data being sold. The disclosure is reasonably transparent but the breadth of AI provider data flows and the disclaimer of control are notable.

Users have meaningful opt-out rights in several areas: private model AI training requires explicit opt-in and can be withdrawn at any time; GDPR rights including objection and restriction are available; account deletion triggers immediate data deletion. However, there is no opt-out from public model AI training use, and no opt-out from data transmission to third-party AI providers when using AI features. The GDPR right to object to direct marketing is implied by the policy's legal basis discussion but not explicitly enumerated.

Rayon explicitly structures its Privacy Policy around GDPR, citing legal bases, data subject rights, Standard Contractual Clauses for US transfers, and the CNIL as supervisory authority — all consistent with GDPR compliance claims. No other regulatory frameworks or certifications (SOC 2, ISO 27001, ISO 42001, NIST CSF, EU AI Act, CCPA/CPRA, VCDPA, CPA) are mentioned anywhere in the supplied documents. The GDPR alignment is claimed but not third-party attested.

The supplied documents are entirely silent on model explainability, interpretability, or enterprise audit rights. Rayon discloses which third-party AI providers it uses but explicitly disclaims control over their processing. There is no mention of audit logs, model cards, explainability tools, or any mechanism for users or enterprises to audit AI behavior. This is a significant gap for professional users.

The supplied documents disclose only that Vercel is the hosting provider. No security controls are described — there is no mention of encryption at rest or in transit, access controls, penetration testing, bug bounty programs, incident response procedures, or breach history. No dedicated security page or trust center is referenced. This is a significant transparency gap.

The Terms of Use describe differences in feature access between free, paid, and student tiers, but the supplied documents do not describe any material differences in data handling, privacy protections, or AI training use between tiers. The AI training provisions apply uniformly based on public/private model designation rather than subscription tier. No enterprise-specific data handling terms, DPA, or enhanced privacy commitments are referenced in the accessible documents.

The Privacy Policy states that personal data is shared with 'duly authorized employees' for purposes of performing the Terms of Use. The Terms of Use grant Rayon a right to store and reproduce content for backup purposes. However, there is no explicit statement that Rayon staff may review user prompts or design content, nor is there an explicit prohibition. The policy is ambiguous on this point.

The Privacy Policy references sharing data with 'competent authorities, if any, such as public authorities and administrative or tax authorities,' indicating cooperation with government requests. The Terms of Use establish exclusive jurisdiction of Paris courts and French law. No specific litigation history, government data request transparency reports, or law enforcement cooperation procedures are described.

The Privacy Policy identifies processing of personal data for contract performance, invoicing, marketing, and support, and references email addresses and payment-related data implicitly through invoicing. The Terms of Use reference IP address use for geographic determination. However, the policy does not provide an explicit inventory of PII categories collected, and no SPI categories are mentioned. The absence of a clear data inventory is a transparency gap, though there is no indication of SPI collection.

Both supplied documents are dated November 17, 2025, which is approximately 10 months before the analysis date of September 9, 2026 — within the 12-month recency threshold. The product surface describes an AI-powered CAD tool, and the Terms of Use explicitly address AI features, name specific third-party AI model providers (OpenAI, Google, Anthropic, Mistral, Photoroom, Black Forest Labs), and include a dedicated AI training use clause. The policies demonstrably cover the AI capabilities the product ships.

Two documents were analyzed: the Terms of Use and the document at the cookies-policy URL (which is actually titled 'Privacy Policy'). The documents are broadly consistent. One minor tension exists: the Terms of Use state that account deletion results in 'immediate deletion' of all data and content, while the Privacy Policy specifies that certain data (e.g., accounting records for 10 years, direct marketing data for 3 years post-deletion) is retained after account deletion. This is a reconcilable tension — the Terms appear to address platform content while the Privacy Policy addresses personal data subject to legal retention obligations — but a user reading only the Terms might expect complete and immediate deletion of all data.