Privacy notice
Version 1.5 · In force from 2 November 2026
Who we are.
LightRay's company reports service is provided by LightRay Inc., 600 Third Avenue, 2nd Floor, New York, NY 10016, USA. This notice covers people who use the service on WhatsApp, at www.lightray.ai, inside Claude or ChatGPT, or by forwarding an email to LightRay ("readers"), people and companies named in reports, visitors to our websites, and anyone who writes to us. Questions and requests about your data go to hello@lightray.ai, where a person able to answer them reads every message.
What we collect about readers, and why.
Your WhatsApp number, or on the website your network address and browser, so that we can send you your report and count the three reports each number or browser may start without charge. The company names you send and the replies you give, so that we can make and count the reports you ask for. The reports made for you, so that you can open them again and so that "reports" in the chat lists them. Documents you choose to add to a report: we read them to make your report and do not store the files; we keep the report built with them, their names, a short summary and the facts read from them, and a record that you accepted the terms for documents, with each file's fingerprint. An email address, only if you give us one: to receive a report, on the feedback form, by forwarding an email to our forward address, or when you write to us, including through the website's Contact page. Feedback you send on a report. Whether you accepted the terms, when and in which version. Delivery receipts for the messages we send you. If you arrive by a LightRay link that carries a code, that code, so that we can see which of our links bring readers: on WhatsApp, the first such code, kept with your number's keyed hash; on the website, a count of the day's arrivals by code, with nothing kept against your browser.
What we do not collect.
Dates of birth, payment details, your location or your contacts. We do not research individuals, and we do not let the service be asked to.
How we keep readers' data.
Your number is kept in encrypted form only while a report is being built, or while we wait for your reply (two days at most), and is then erased. Otherwise our records keep it as a keyed hash, a one-way code from which the number cannot be recovered, with its country calling code; the record of your acceptance of the terms for documents also keeps it masked, showing only its first two and last four digits. If you ask for our order form, your number is emailed to our team so that we can send it to you. A website visitor's network address is kept only as a keyed hash. The reports database sits on our hosting provider's volume and is backed up daily and weekly. Our logs show numbers and email addresses masked.
LightRay inside Claude or ChatGPT.
If you use LightRay inside Claude or ChatGPT, we use the email address you sign in with to send you a one-time sign-in link and code, and we keep it only in a form that cannot be read back, to count your reports and keep you signed in. We also keep, in the same form, the network you first signed in from, to limit misuse. We receive the names of the companies you ask LightRay to check, as with any other report, and nothing else from your Claude or ChatGPT account; ChatGPT also sends hints with each request, such as your language, and LightRay keeps none of them. We keep the list of the reports you ask for inside Claude or ChatGPT for 365 days.
Emails forwarded to check@lightray.ai.
When you forward an email to LightRay's forward address, LightRay reads it to find the company it is about and to answer you: your address, any words you add, and the forwarded email's sender, subject, text and signature. It does not open attachments, except to read the sender and subject of an email forwarded as one. Where its own rules cannot tell which company an email names, it sends our research provider only the few lines that may name it: your words, the sender's name or the signature. It keeps the company found and a protected form of your address that cannot be turned back into it, to count your reports and our replies and to record your acceptance of the terms of use. Your address is one reader across the forward address and LightRay inside Claude or ChatGPT: the same three free reports, and one list of your reports, kept for 365 days. For seven days after each reply, and until your report has been sent, it also keeps your address and the email's subject encrypted, so that the link in the reply works and later replies stay in your thread. It keeps no copy of the email's text, its attachments or anyone else's address. LightRay answers only an email that passes its sending domain's own checks, and sends its answers only to the address the email came from. The email itself is deleted from LightRay's mailbox within 30 days of being read.
LightRay's browser extension.
If you use LightRay's browser extension, it reads the page you are on only when you ask, to find the company's name: the text you select, or the page's title, site name, structured data and address. It sends LightRay the company's name, its place and a code that says the check came from the extension, in the check page's address, only when you choose to check. It keeps nothing.
For the Chrome Web Store: LightRay's use of this information follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
For Microsoft Edge Add-ons: the extension works the same way in Microsoft Edge.
LightRay's Outlook add-in.
If you use LightRay's Outlook add-in, it reads the email you have open only when you press Check company, to find the company's name: the sender's name and address, the subject and the email's text, and your own address, so that your own firm is left out. It sends LightRay the company's name, its place and a code that says the check came from the add-in, in the check page's address, only when you press Check on LightRay. Nothing else from the email or your mailbox leaves your device, and the add-in keeps nothing.
Our lawful basis.
Making the report you asked for and sending it to you is the performance of a contract with you (our terms of use). Counting reports, keeping the service secure, keeping proof of your acceptance of the terms, and reading how the service is used so that we can improve it are our legitimate interests. Reading your documents is by your consent, which you give when you add them and may withdraw by asking us to delete the report built with them. Where India's Digital Personal Data Protection Act 2023 applies, you give your number and your requests voluntarily for the purpose of receiving a report, and we use them for that purpose.
Reports are shared.
A report on a company is a snapshot of that company, not of you. If another reader asks about the same company, we may serve them the report made for you, refreshed as the report describes, and we may serve you a report made for someone else. A report that contains documents you added is private to you. We do not tell anyone who asked about a company.
Who handles your data for us.
Our research provider (United States) reads your documents and the lines of a forwarded email that may name its company; under its commercial terms it does not train on this content, and it deletes what we send it within 30 days unless it must keep it longer to enforce its usage policy or to comply with the law. Our messaging provider (India), which carries WhatsApp messages between you and us and holds files you send for 48 hours. The company that runs WhatsApp, under WhatsApp's own terms. Our hosting provider (United States), which hosts the service and its database. Our email provider, for hello@lightray.ai, for the forward address and for the emails we send. A search provider (United States), which runs court-record searches on the company's name. Another search provider (United States), which runs news searches on the company's name. A company data provider (United States), which supplies company facts. Public registers, official statistics bodies and international organisations, which supply public company, sector and trade data and receive nothing about you. A payment provider will be added when payments start, and this notice will say so first.
Where your data goes.
The service runs in the United States and India. Where the law of your country requires safeguards for such transfers, we rely on our providers' data processing agreements and, where required, standard contractual clauses.
How long we keep it.
Your encrypted number, until the report ends. Replies we are waiting for, and other short-lived records we use to answer you, such as a conversation's state or a report being started, two days at most. Reports, the research behind them and feedback on them, 24 months after a report was last opened or used, then deleted. The record that you accepted the terms of use or the terms for documents, for as long as we may need to show that you did. Your own records (the count of your free reports, the companies checked for that count, the reports LightRay gave you and the first link code that brought your WhatsApp number), 24 months after you last used the service, or until reports you bought expire, if later, then deleted. You use the service when you start or receive a report, open a report sent to your number, send us a message from your number or use LightRay inside Claude or ChatGPT; reports LightRay gave you count as use while they last. We record the day you last used the service, in protected form, to apply the 24 months, and delete it with your own records. Delivery receipts and service logs, 90 days. Backups of the reports database, 27 days at most. The files you add, not at all; what our research provider keeps is under Who handles your data for us. Emails to hello@lightray.ai, including feedback, orders and messages from the Contact page, are kept for 24 months, then deleted. Emails forwarded to check@lightray.ai, and the record that each was read, 30 days at most. We delete a number's data earlier if you ask.
Your rights.
You may ask us what we hold about you, ask us to correct or delete it, object to our use of it, ask for a copy, and withdraw a consent you gave. Send "delete" on WhatsApp for instructions, or write to hello@lightray.ai from, or naming, the number or email concerned; we answer within 30 days and confirm by email when a deletion is done. You may complain to the data protection authority where you live (in the United Kingdom, the Information Commissioner's Office; in the European Union, your national authority; in India, the Data Protection Board of India once it is constituted under the Digital Personal Data Protection Act 2023).
People and companies named in reports.
Reports name companies and the people connected with them: directors, officers, owners, parties to court cases and people in press reports, with their roles and their other appointments. This information comes from public registries (including the UK's register of companies, under the Open Government Licence), court and regulatory records, the press, the company's own statements, business data providers, and documents a reader adds. We use it because readers have a legitimate interest in understanding the companies they deal with and we have a legitimate interest in providing that service, and much of it is information made public under a legal obligation or by the person concerned. Because it comes from public records at a scale that makes telling each person individually disproportionate, this notice is how we inform people named in reports. We do not collect dates of birth, and the service does not make decisions about anyone. If you are named in a report and believe it is inaccurate, incomplete, out of date or about a different person, tell us through the feedback form on the report or at hello@lightray.ai with the report's link; we review every request within one business day and correct or remove anything we find inaccurate, and you may send a response we may add to the report. You have the same rights as readers.
Cookies.
The website and the report pages set only the cookies the service needs to work: among them one that counts the free reports started from your browser (one year), one that records your acceptance of the terms (one year), and one that lets a page opened from WhatsApp take you back to the chat (30 days). The cookies page, at www.lightray.ai/cookies, lists every cookie with its purpose and how long it lasts. Report pages also keep your display choices, such as light or dark, in your browser's own storage, which is never sent to us. When a report is opened from a link someone forwarded, we count the opening with no cookie and keep nothing about whoever opens it: only a count for each report and day. We set no analytics or advertising cookies or tags. If that changes, we will ask for your consent first and update this notice.
Children.
The service is for business use by adults and is not directed at anyone under 18.
Changes.
The version and date are at the top. We post changes here and, for a material change, tell readers in the chat or by email.
Contact.
hello@lightray.ai · LightRay Inc., 600 Third Avenue, 2nd Floor, New York, NY 10016, USA.