Privacy
This site has no analytics. What follows is a description of what actually happens, not a template.
What we collect
Six forms on this site store anything. Each is described below exactly as it is stored. Nothing else on the site asks you for personal information.
Release notes and Insights email
If you give us your email address to get release notes and new Insights posts, we store four things:
- Your email address, lowercased.
- The time you submitted it.
- A fixed label recording which page the form was on (the home page or Insights).
- A two-letter country code, derived by our host from the connecting IP address. We do not store the IP address itself.
We also pass your email address to EmailOctopus (see “Who else is involved” below), the service that sends these emails, with a tag saying whether you signed up on the website or on Insights. EmailOctopus sends you a confirmation email first, and you are not subscribed until you click the link in it. It does not receive the country code or label we keep ourselves.
These emails tell us whether they were opened and which links were clicked: EmailOctopus adds a tiny image that loads when you open the email, and routes links through its own address before sending you on. We use that only to see which releases and posts are useful. Email apps that block images stop the open count; the links still work either way.
The form contains a hidden field labeled “Company”. It is a spam trap: it is positioned off-screen, browsers do not show it to you, and anything submitted in it is discarded along with the request. It is never stored.
Download form
The downloads page offers a short form before the download. It is optional: you can skip it and download anyway. If you fill it in, we store:
- What you typed: your company, name, email address and country, and — if you gave them — your phone number, your role and what you plan to use Raylux for.
- What we record alongside it: the version you downloaded, when you first and most recently used the form, how many times you have used it, whether your email is at a free webmail provider, and a country code derived from the connecting IP address the same way as above.
Partner application
If you apply to become a partner on the partners page, we store:
- What you typed: your company, name, email address, country, website if you gave one, and what you told us about the systems you build and where they are deployed.
- What we record alongside it: the application’s status, when you first and most recently submitted it, whether it was resubmitted, whether your email is at a free webmail provider, and a country code derived from the connecting IP address.
Contact form
If you send a message from the contact page, we store:
- What you typed: your name, email address, company if you gave one, the topic you chose and your message.
- What we record alongside it: the time you sent it, whether it was emailed to us successfully, a country code derived from the connecting IP address the same way as above, and the first part of your browser’s user-agent string (which browser and operating system you used). We do not store the IP address itself.
A copy of the message is also emailed to our inbox, so it is held there as well until we delete it. That form has the same hidden spam-trap field as the others; anything in it is discarded and nothing is stored or sent.
License activation
If you upload a request file on the license activation page, we store:
- What you gave us: your name, email address, company and note if you gave them, and the request file itself — your license key, a hash of each of the gateway’s hardware identifiers and the salt used to make them (as described under “What a Raylux gateway sends us” below; never the identifiers themselves), its host name and operating system, the Raylux year, and when the file was made.
- What we record alongside it: the time you uploaded it, the file’s name, whether it was emailed to us successfully, a country code derived from the connecting IP address the same way as above, and the first part of your browser’s user-agent string. We do not store the IP address itself.
While we sign licenses by hand, all of the above is stored and a copy is emailed to our inbox. Once our license server takes these uploads, it keeps only the request file, your email address and the time, in its activation records, and nothing is emailed to our inbox. Either way, the license file we issue is emailed back to the address you gave. The same hidden spam-trap field applies.
Shop
The shop is for Raylux partners. If you buy from it, we store your name, email address, company, PO number if you gave one, what you bought and what you paid, and the identifiers Stripe gives the payment. Card and bank details go to Stripe and never reach us. For each license, the partner who buys it also gives us the end customer’s company name, a contact name and work email, and the site’s name and location. We keep these for as long as the license exists and as part of our sales records, so that the customer’s license can be found, serviced and moved. The partner can see them, and Raylux support can see them. License keys are emailed to you. So that we can help if you lose a key, we keep each key encrypted in our order records, together with a one-way hash and its last four characters. Only authorized Raylux support staff can decrypt it, each time is logged, and the encrypted copy is kept while the key is in use and deleted a year after a key is revoked. A key is also held in the clear only where needed: in the outgoing email until it has been sent (one we cannot deliver is cleared 30 days after it was written); in an activation request until that request has been signed or refused, or in an upload on the license activation page as described above; and in the register our license-signing program keeps of every license it signs, which is kept on our own storage, not at Cloudflare, as our permanent record of what we have signed.
When a partner opens the shop from the partner portal, the site sets a cookie named rlx_partner: it holds the partner’s account number, email address, company and partner tier, is signed so it cannot be altered, cannot be read by scripts, and expires after eight hours or when you choose Sign out of the store. It is used only to price and address that partner’s orders.
What we do with it
- Release notes and Insights email: once you confirm, we email you the release notes when a version of Raylux ships and a note when a new post goes up on Insights. Every email has an unsubscribe link, and that is the only thing the address is used for.
- Download form: we use it to tell you when a release matters to you and to follow up on how a trial is going.
- Partner application: we use it to review your application and, if it is approved, to set up and run the partnership.
- Contact form: we use it to answer your message. It does not add you to any list.
- License activation: we use it to issue the license file for that gateway, to keep a record of which key is licensed to which machine, and to answer you about it. It does not add you to any list.
- Shop: we use it to deliver your license keys, invoice you, answer you about your order, and keep the sales records the law requires. It does not add you to any list.
None of it is sold, shared with anyone other than the processors listed below, or used for advertising.
What we do not do
- No analytics. There is no Google Analytics, no Plausible, no Fathom, and no product-analytics script of any kind on this site.
- No tracking cookies. The site sets two cookies, both described on this page:
raylux-theme, your light or dark choice, and, for Raylux partners only,rlx_partner, the shop sign-in described under Shop above. Neither is used for tracking. - No advertising, and no advertising or social pixels.
- No profiling, and no automated decision-making.
If you use the theme switch, the page’s script remembers whether you chose light or dark in two places, both named raylux-theme: a localStorage entry, which stays on your device, and a cookie, so the partner portal at portal.rayluxscada.com opens in the same theme. The cookie holds only the word “light” or “dark”, lasts one year, and is sent with your requests to rayluxscada.com and the partner portal; it is not used for tracking. Clearing your site data removes both.
Who else is involved
| Processor | Role |
|---|---|
| Cloudflare | Hosts this site and stores the records from all six forms, runs the small services that hand the contact and license activation forms’ email copies to Microsoft 365, and runs the license server (Workers and D1), which stores activation and check-in records. As the host it processes connection data, including IP addresses, to serve pages. |
| EmailOctopus | Holds the mailing list and sends the release notes and Insights emails: your email address, the website-or-Insights tag, when you signed up and confirmed, and whether you opened each email and which links you clicked. It sends the confirmation email and puts an unsubscribe link in every message. |
| Microsoft (Microsoft 365) | Hosts our email. The contact form’s email copy, partner-application notices, the emails that carry license keys and license files, and any email you send to a rayluxscada.com address are delivered to, and sent from, mailboxes at Microsoft. |
We have no other processors. Stripe processes payments for the shop (we never see card numbers).
What a Raylux gateway sends us
Apart from this section, nothing on this page describes the Raylux software. A gateway you install runs on your hardware and your network.
A gateway contacts our license server only after someone enters a license key on it. It does so to activate, once a day to check in, and to unactivate. A gateway running the built-in trial with no license key does not contact the license server.
- Activation: the license key; a hash of each hardware identifier the machine exposes (up to three: the network adapter’s permanent address, the system UUID or board serial, and the serial of the disk that holds the license) and the salt used to make those hashes; the Raylux year; the time; the host name; and the operating system name.
- Daily check-in: the license key and license ID; the same hardware hashes as the machine has them now, whether they still match the license, and since when if they do not; the host name; the Raylux version; a check-in token we issued; and a copy of the license file we issued.
- Unactivation: the license key and license ID, the hardware hashes and salt from the license, the time, and a random value.
Like any request, each one reaches us with the network address it came from. None of them carries process data, tag values, screens, camera video, map requests, documents, or AI conversations.
The hardware identifiers are hashed before they leave the gateway, with a salt that is different for every license key, so we never receive the raw address, UUID or serial number. Hashing does not make them secret: someone willing to try every possible network address could work one back out. We treat them as identifiers.
We use them only to check that a license runs on the machine it was issued for, to recognize that machine when it is reactivated, and to notice one license running on two machines. A gateway that cannot reach us is never penalized for that.
We keep activation and check-in records for as long as the license exists and for one year after it ends. The license server runs on Cloudflare (Workers and D1).
How long we keep it
- Release notes and Insights email: until you unsubscribe or ask us to delete it. Unsubscribing in any email stops them; our own copy of the address stays until you ask us to delete it, and we delete it on request. If you never confirm, EmailOctopus does not subscribe you.
- Download form: the record expires automatically two years after you last used the form.
- Partner application: until you ask us to delete it.
- Contact form: the stored record expires automatically two years after you sent it. The emailed copy stays in our inbox until we delete it; ask and we will.
- Shop: orders are kept as our sales and tax records, together with each key’s one-way hash, encrypted copy (deleted a year after the key is revoked) and last four characters, what the key carries, and when it was issued, extended, revoked or reinstated. Nothing deletes them automatically; we keep them at least as long as the law requires sales and tax records to be kept.
- License activation: while we sign licenses by hand, the stored upload expires automatically two years after you sent it. The emailed copy stays in our inbox until we delete it. The hardware hashes, host name and operating system, with the rest of the request once its license key has been removed, are kept in our record of issued licenses for as long as the license exists and for one year after it ends, because that record is how a key is tied to one machine. A license ends on a machine when it is unactivated there or moved to another machine, or when its key is revoked after a refund or an unpaid invoice; a machine that keeps checking in after that is kept until one year after its last check-in. Licenses do not expire, so the record of a key that is still active is kept.
Your choices
Email support@rayluxscada.com and we will tell you what we hold about you, correct it, or delete it. There is no form to fill in and no account to sign into. We do not require you to prove a legal basis for asking.
Depending on where you live you may have rights under the GDPR, the UK GDPR or the CCPA. Whatever the request, the practical answer is the same: write to the address above and we will action it.
Children
This is industrial control software. The site is not directed at children and we do not knowingly collect anything from them.
Changes
If this policy changes we will update the date at the top. We do not use the release-updates list to notify you of policy changes, and we would rather say so than imply otherwise.
Contact
Raylux L.L.C., a Colorado limited liability company.
4845 Pearl East Cir Ste 118 #837445, Boulder, CO 80301, USA.
support@rayluxscada.com