Privacy Policy

Effective date: June 8, 2026

1. About this policy

This policy explains how Razayya Technologies Inc. (“Razayya,” “we,” “us”) collects, uses, shares, and protects information when you use the Razayya Insights application, our marketing site at clearoffice.io (the “Clear Office” brand), and any related services (the “Services”). It also describes your choices and rights with respect to your information.

The Razayya Insights application is a business-to-business (B2B) product used by businesses (“Customers”) to manage payroll, financial reporting, and business metrics. Most of the information we process belongs to those Customer businesses; this policy explains how we handle it.

2. Who this policy applies to

  • Customer users — employees and contractors of our Customer businesses who sign in to and use the Razayya Insights application.
  • End-user consumers whose data appears in the application because a Customer business records them (for example, a service-business customer whose work order or transaction is recorded by our Customer).
  • Marketing site visitors to clearoffice.io.

3. Information we collect

3.1 Information you provide directly

  • Account information — name, email address, and a password you set when an account is created for you (passwords are stored only as a hash; we cannot see the original).
  • Profile information — role, tenant (Customer business) association, and any preferences you set.
  • Communications — support requests, demo requests, feedback, and other content you send to us.

3.2 Information our Customer businesses upload or connect

When a Customer business uses the Services, they upload, enter, or connect business records that may include:

  • Employee records held by the Customer — names, pay rates, schedules, role assignments, and store/location assignments.
  • Payroll data — pay runs, pay periods, and time entries.
  • Financial records — bank transactions, deposits, journal entries, and account balances.
  • Point-of-sale (POS) records — service work orders, customer and vehicle information recorded by the Customer's POS system, invoices, parts orders, and technician productivity.
  • Parts-vendor records — parts invoices retrieved on the Customer's behalf from vendor portals they have authorized.

In most cases, Razayya processes this information as a service provider (or “processor”) on behalf of the Customer business. The Customer business is responsible for ensuring it has the legal right to provide this information to us and that it has given any required notices to the individuals whose information appears in it. For the account, profile, and communications information you provide to Razayya directly (§3.1) and for marketing-site visitor information (§3.5), Razayya acts as a business/controller in its own right.

3.3 Information from connected services — Plaid

The Services use Plaid Inc. (“Plaid”) to connect to a Customer business's bank account, with the Customer's authorization, to retrieve bank transactions and account information. When a Customer connects an account through Plaid:

  • The Customer authenticates directly with their bank through Plaid; Razayya does not receive or store the Customer's bank credentials.
  • Plaid provides us with information about the connected accounts and transactions, which we use to support the Customer's use of the Services.
  • Plaid's own collection, use, and sharing of your information is governed by Plaid's End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy. You should review it before connecting an account.

By connecting a financial account through Plaid in our Services, you authorize us to receive information from Plaid as described in Plaid's End User Privacy Policy and to use it consistent with this Privacy Policy.

3.4 Information from connected services — Intuit / QuickBooks and others

At a Customer business's direction, the Services can connect to Intuit / QuickBooks Online and to third-party point-of-sale, payroll, and parts-vendor systems, including (non-exhaustive): AutoLeap, ROWriter, NAPA, AutoZone, Advance Auto Parts, O'Reilly Pro, Nexpart, UAP, TDG, and Stox Distribution. Each connection is made using credentials or authorizations the Customer provides. Data we receive from, or send to, these services on the Customer's behalf is handled in accordance with this policy. When you connect QuickBooks, you authorize us to exchange data with your QuickBooks company through Intuit's APIs solely to provide the Services you request; you may revoke that authorization at any time from within Intuit's settings or within the Services. Your use of Intuit's products is governed by your separate agreement with Intuit.

3.5 Information collected automatically

When you use the Services we automatically collect technical information through:

  • Application telemetry (Microsoft Application Insights) — page views, feature usage, performance metrics, and error reports, together with limited technical identifiers (IP address, browser, device type, session identifier).
  • Marketing-site analytics — we use Google Analytics on clearoffice.io to understand site traffic and usage, and Calendly to let you schedule demos.
  • Authentication cookies — HttpOnly, Secure cookies used to keep you signed in (access and refresh tokens) and an anti-CSRF cookie.
  • Operational logs — request logs retained for security and reliability purposes.

We do not use cookies for cross-site behavioral advertising, and we do not use retargeting pixels.

4. How we use information

We use the information described above to:

  • Provide, operate, and maintain the Services.
  • Authenticate users and protect against unauthorized access.
  • Process Customer business data (payroll, transactions, reporting) as instructed by the Customer.
  • Communicate with you about the Services, including service notices, support, and (where you have not opted out) product updates.
  • Monitor, troubleshoot, and improve the Services, including investigating security incidents.
  • Comply with legal obligations and enforce our agreements.

We do not sell personal information and we do not “share” personal information for cross-context behavioral advertising (as those terms are defined under applicable state privacy laws). We do not use Customer business data to train machine-learning or generative-AI models, and we do not send Customer business data to third-party AI providers for any purpose outside delivering the Services to that Customer.

5. How we share information

We share information only as described below. We do not sell personal information.

  • With the Customer business whose tenant the information belongs to. Information you enter or that is collected through your use of the Services is visible to other authorized users within the same Customer tenant based on their assigned roles.
  • With connected services named in §3.3 and §3.4 (Plaid, Intuit / QuickBooks, and the POS and parts-vendor systems the Customer authorizes), only to the extent required to maintain the connection the Customer has authorized.
  • With service providers that operate the Services on our behalf, including:
    • Microsoft Corporation — Microsoft Entra ID (identity and authentication), Microsoft 365 (corporate email and productivity), and Microsoft Azure (cloud hosting, Azure SQL, Blob Storage, Service Bus, Key Vault, App Service, Azure Functions, and Application Insights telemetry).
    • Plaid Inc. — bank-account connection and transaction retrieval (§3.3).
    • Intuit Inc. — QuickBooks Online accounting and payroll integration, where a Customer connects it (§3.4).
    • Google LLC — Google Analytics on the marketing site (§3.5).
    • Calendly LLC — demo scheduling on the marketing site.
    • GitHub, Inc. and Atlassian Corporation — internal source-code hosting and work tracking; these do not receive Customer business data.
    We maintain a current subprocessor list and provide it to Customers on request.
  • For legal reasons — when required to comply with applicable law, valid legal process, or a lawful government request; to protect the rights, property, or safety of Razayya, our Customers, our users, or others; or to investigate and prevent fraud or security incidents.
  • In a business transfer — if Razayya is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality terms and (where required) advance notice.

6. How long we keep information

We retain personal information for as long as needed to provide the Services and to comply with our legal obligations.

  • Account information is retained while the account is active. After an account is deactivated, we anonymize its personal identifiers while preserving audit references needed for integrity.
  • Customer business data is retained for the life of the Customer's subscription. When a subscription ends, the Customer may export data via standard Platform functionality for 30 days, after which we may delete it.
  • Azure SQL database backups persist according to the platform's point-in-time-restore retention (currently approximately 7 days).
  • Transaction-import file uploads are deleted approximately one day after processing. Other tenant documents are retained for the life of the subscription and deleted with the tenant's data.
  • Application Insights telemetry and operational logs are retained for 30 days.
  • Security audit logs (such as sign-in and permission-change events) are retained for security and compliance purposes.

Anonymized data (information processed so it can no longer identify a Customer, Authorized User, or any individual) may be retained and used for analytics, benchmarking, and product improvement.

7. Your rights and choices

Depending on where you live, you may have rights with respect to your personal information, which can include the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate personal information.
  • Delete personal information, subject to exceptions.
  • Port your personal information to another service.
  • Object to or restrict certain processing of your personal information.
  • Opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising (we do not engage in either).
  • Not be discriminated against for exercising these rights.

For most Customer business data, you should direct requests to the Customer business that uses our Services to record information about you, as they are the controller of that data. For information Razayya itself controls (for example, your individual user account at Razayya), contact us at the address in §11.

8. Security

We take reasonable steps to protect personal information against loss, theft, misuse, and unauthorized access. Measures include:

  • Staff access to internal systems federated through a single corporate identity provider (Microsoft Entra ID), with multi-factor authentication enforced for staff accounts.
  • Role-based access control inside the Services with least-privilege defaults.
  • Secrets managed in Azure Key Vault under role-based access control; CI/CD authenticates to Azure via OIDC-federated identities, avoiding shared long-lived production credentials.
  • Encryption in transit (TLS) and at rest for production data stores.

No method of transmission or storage is perfectly secure. We will notify affected Customers and, where required, regulators and individuals, of a security incident involving personal information consistent with applicable law.

9. Children

The Services are intended for use by businesses and their employees. They are not directed to children, and we do not knowingly collect personal information from children directly through user accounts, the marketing site, or other Razayya-controlled channels. Customer business records uploaded to or pulled into the Services may incidentally contain information about individuals; the Customer business is responsible for the legality of including such records and for any required notices or consents. If you believe a child's personal information has been collected through a Razayya-controlled channel, please contact us at the address in §11.

10. International users

The Services are operated from the United States, and personal information you provide will be processed in the United States and in any other country where our service providers operate. By using the Services, you understand that your information may be transferred to countries with different data-protection laws than your country of residence.

11. How to contact us

If you have questions about this policy or want to exercise a privacy right, contact us atsupport@razayya.com.

12. Changes to this policy

We may update this policy from time to time. When we do, we will post the updated policy and update the “Effective date” above. If the changes are material, we will provide additional notice (for example, by email or an in-app notice) before they take effect.