← Back to techie_ray labs

Privacy Policy

Last updated: 23 August 2026

This Privacy Policy forms part of the Website Terms of Use and the Commercial Terms of Service, and is incorporated into both. If you are in the European Economic Area or the United Kingdom, clause 12 also applies to you. If you are in the United States, clause 13 also applies to you.

This Privacy Policy describes how Raymond Sun (ABN 39 348 769 519) trading as techie_ray® labs (Developer, we, us) collects, uses, discloses and secures personal information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where they apply, the laws described in clauses 12 and 13.

  1. Who and what this policy covers
    1. The Developer is the controller of the personal information described in this Privacy Policy.
    2. This Privacy Policy covers:
      1. www.techieray.com and every page on it, including the Global AI Regulation Tracker in its English and Chinese editions (Website);
      2. the paid services governed by the Commercial Terms of Service, being the API, the MCP Server, AI Search and the Widget (Services);
      3. the Google Forms linked from the Website, being the data contribution form and the feedback form; and
      4. correspondence you send to the Developer, including email to info@techieray.com.
    3. This Privacy Policy does not cover third party platforms that operate as their own controllers under their own privacy policies. In particular, the newsletter is operated by Substack and social posts are published on LinkedIn. Where you subscribe to the newsletter, the Developer receives your email address and subscription status from Substack and handles that information in accordance with this Privacy Policy, but Substack's own handling of your information is governed by Substack's privacy policy.
    4. Personal information in this Privacy Policy means information or an opinion about an identified individual, or an individual who is reasonably identifiable. In clause 12 it has the meaning given to personal data in the GDPR.
  2. What personal information is collected
    1. Account information. If you sign in, we collect your email address and the unique account identifier assigned by Google Firebase Authentication. If you sign in using Google, we also receive the basic profile information that Google returns for your account.
    2. Subscription and billing information. If you purchase a subscription plan, we collect and store your billing email address, the customer and subscription identifiers assigned by Stripe, your plan tier, and the status and dates of your subscription. We do not collect, receive or store your card number, expiry date or security code. Those are submitted directly to Stripe and handled by Stripe as a separate controller and processor.
    3. API keys. If your plan issues one or more keys, we store the key together with its expiry, tier and usage count, linked to your account.
    4. AI Search questions and responses. When you use the AI search function, we record the question you typed, the response returned, the sources cited in that response, the jurisdiction or topic the question related to, the time of the request, how long it took, and your account identifier. We do not record your IP address in that record. Where a question is refused because you have reached an allowance, we record the topic of the refused question so that we can see what people are asking for.
    5. Usage and metering information. To enforce daily and monthly allowances and to prevent abuse, we derive your IP address from your request and convert it into an irreversible keyed hash. We store the hash, not the IP address itself. We also record request counts against your account identifier or that hash.
    6. Analytics and advertising information. Google Analytics and Google AdSense collect information about your device and your use of the Website. This is described in clause 5.
    7. Information you send us. If you complete one of the Google Forms, email us, or send us feedback or a correction, we collect whatever you choose to include, which will usually include your email address.
    8. Information stored in your own browser. Some information stays on your device and is never transmitted to us. This is described in clause 5.
  3. How personal information is collected
    1. Directly from you, when you sign in, subscribe, submit a question to AI Search, complete a form or write to us.
    2. Automatically, through your use of the Website and the Services, as described in clauses 2(d), 2(e) and 5.
    3. From third parties, being Stripe in relation to your subscription and payment status, Google in relation to authentication and analytics, and Substack in relation to newsletter subscriptions.
  4. Why personal information is used
    1. We use personal information to:
      1. provide the Website and the Services, including authenticating you and issuing and validating keys;
      2. process subscriptions, take payment and manage billing;
      3. meter usage against the allowances in your plan, and detect and prevent abuse, fraud and circumvention of those allowances;
      4. review the quality and accuracy of AI Search responses, including by reading questions and responses to find errors and correct the underlying data;
      5. understand which jurisdictions and topics people are asking about, so that we can decide what to research and publish next;
      6. maintain the security and integrity of the Website and the Services;
      7. respond to your correspondence, feedback and support requests; and
      8. comply with our legal obligations, and establish, exercise or defend legal claims.
    2. We do not use the questions you submit to AI Search, or the responses returned to you, to train, fine-tune or otherwise develop any artificial intelligence model. Those records are used only for the purposes in clauses 4(a)(iii) to 4(a)(vi). We do not sell them and we do not provide them to any third party for that party's own model development.
    3. We do not use personal information for automated decision-making that produces legal or similarly significant effects.
  5. Cookies, browser storage, analytics and advertising
    1. The Website itself does not set cookies. It does store the following information in your own browser, where it stays on your device unless you clear it:

      Scroll the table sideways to see every column.

      Stored item What it holds How long it lasts
      ai_reg_chat_sessions Your AI Search conversation history, being the questions you asked and the responses returned, up to a capped number of recent conversations Until you clear it, or until it is displaced by newer conversations
      ai_reg_account_hint A flag recording that you are signed in, so the sign-in libraries can be loaded early Until you sign out
      emailForSignIn The email address you entered, so that the sign-in link can be completed when you return Until the sign-in is completed
    2. Third parties set their own cookies and similar technologies on the Website:
      1. Google Analytics (measurement ID G-94RXF4EKYD) collects information about your visit, including pages viewed, approximate location derived from your IP address, device and browser type, and referring site. We use it in aggregate to understand how the Website is used;
      2. Google AdSense (publisher ID ca-pub-2410627758500445) serves advertisements on the Website and may use cookies and device identifiers to personalise those advertisements and measure their performance;
      3. Stripe sets cookies necessary to process payments and detect fraud; and
      4. Google Firebase sets storage entries necessary to keep you signed in.
    3. The Website does not currently present a cookie consent banner. You can control this collection yourself:
      1. you can turn off personalised advertising, including for Google AdSense, at myadcenter.google.com;
      2. you can prevent Google Analytics from collecting your visit by installing the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout;
      3. you can block or delete cookies through your browser settings, and clear the items in the table above through your browser's site data controls; and
      4. you can ask us to act on a request under clause 11, 12 or 13.
    4. Blocking cookies or clearing browser storage may stop parts of the Website from working, including staying signed in and keeping your conversation history.
  6. Who personal information is disclosed to
    1. We disclose personal information to the following recipients, each of which handles it for the purpose described and under its own terms:
      1. Google, being Google Cloud and Firebase for hosting, authentication, databases and logging, Google Analytics for analytics, Google AdSense for advertising, and Google Forms for form submissions;
      2. OpenAI, which processes the questions submitted to AI Search together with the supporting material we provide, in order to generate a response;
      3. Stripe, which processes payments and manages subscriptions; and
      4. Substack, which operates the newsletter.
    2. We may also disclose personal information where we are required or permitted to do so by law, to respond to a lawful request from a regulator or law enforcement agency, to enforce the Website Terms of Use or the Commercial Terms of Service, or to establish, exercise or defend a legal claim.
    3. If the Developer's business or any part of it is transferred to another person, personal information may be transferred as part of that transaction, subject to this Privacy Policy continuing to apply.
    4. We do not sell personal information for money. Clause 13 explains how the use of advertising cookies is treated under United States state privacy laws.
  7. Where personal information is held
    1. The Website and the Services are hosted on Google Cloud Platform and Firebase. Personal information is stored in databases located in the United States and in Singapore, and is processed by cloud functions running in those regions.
    2. Our other recipients process personal information in the countries in which they and their sub-processors operate, which include the United States and the European Union.
    3. By using the Website and the Services, you acknowledge that your personal information will be handled outside Australia. Clause 12 describes the basis on which information is transferred out of the European Economic Area and the United Kingdom.
  8. How long personal information is kept
    1. We keep personal information only for as long as we need it for the purpose we collected it for, and then delete it or allow it to expire.
    2. In deciding how long that is, we consider:
      1. whether the information is still needed to give you the Website or the Services, which for account and key records means for as long as your account is open;
      2. how long we are required to keep records by law, which for records of payments and subscriptions means the period required under Australian tax and corporations legislation;
      3. whether the information is still needed to meter usage against an allowance for the current and immediately preceding billing periods;
      4. whether the information is still needed to investigate abuse, fraud or a security incident;
      5. whether the information is still needed to review the quality of AI Search responses and to correct the underlying data;
      6. whether the information is still needed in connection with an actual or anticipated legal claim, complaint or regulatory request; and
      7. the retention period applied by the third party holding it, where the information sits in a third party system such as Google Cloud Logging, Google Analytics or Stripe.
    3. Conversation history stored in your own browser under clause 5(a) is not held by us, and stays on your device until you clear it.
    4. If you close your account, we delete or de-identify the account record, subject to any retention required under clause 8(b).
  9. Security
    1. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Those steps include serving the Website over encrypted connections, holding databases behind access rules that deny direct client access, restricting administrative access, holding secrets in a managed secrets service, and hashing IP addresses rather than storing them.
    2. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
    3. You are responsible for keeping your account credentials and any key issued to you confidential.
    4. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the notifiable data breaches scheme, and any other regulator we are required to notify.
  10. Accessing and correcting your personal information
    1. You may ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.
    2. Send your request to info@techieray.com. We may ask you to verify your identity before we act on it.
    3. We will respond within a reasonable period, and in any event within 30 days. If we refuse your request, we will tell you why, unless it would be unreasonable to do so.
    4. You may also close your account and stop using the Website at any time.
  11. Complaints
    1. If you think we have breached the Australian Privacy Principles or otherwise mishandled your personal information, contact us first at info@techieray.com with the details. We will acknowledge your complaint and respond within 30 days.
    2. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
  12. If you are in the European Economic Area or the United Kingdom
    1. This clause applies in addition to the rest of this Privacy Policy if you are in the European Economic Area or the United Kingdom, and the General Data Protection Regulation or the UK General Data Protection Regulation (together, GDPR) applies to our handling of your personal information. Where this clause conflicts with another clause, this clause prevails.
    2. The Developer is the controller. You can contact us about this clause at info@techieray.com.
    3. We rely on the following legal bases:
      1. performance of a contract, for creating and operating your account, issuing and validating keys, delivering the Website and the Services, and taking payment;
      2. legitimate interests, for metering usage against allowances, preventing abuse, fraud and circumvention, securing the Website and the Services, reviewing the quality of AI Search responses, understanding which topics are being asked about so that we can decide what to publish next, responding to your correspondence, and establishing, exercising or defending legal claims. Our interest in each case is in running and improving a service that works and is not abused, and we have considered that this does not override your interests, in particular because we do not use these records to build a profile of you, we hash IP addresses rather than storing them, and we do not use your questions to train AI models;
      3. consent, where consent is required, including for analytics and advertising cookies and for the newsletter. Where we rely on consent, you may withdraw it at any time, and withdrawal does not affect the lawfulness of processing before withdrawal; and
      4. compliance with a legal obligation, for retaining records of payments and subscriptions.
    4. You have the right to request access to your personal information, and to request its rectification or erasure, to request restriction of processing, to object to processing carried out on the basis of legitimate interests, to receive your personal information in a portable form, and to withdraw consent. To exercise any of these rights, contact info@techieray.com. We will respond within one month, and may extend that period by two further months where the request is complex, in which case we will tell you.
    5. We transfer personal information outside the European Economic Area and the United Kingdom, as described in clause 7. Those transfers are made on the basis of the standard contractual clauses adopted by the European Commission, and the United Kingdom addendum to them, as incorporated into our agreements with Google, OpenAI and Stripe, or on another lawful transfer mechanism where one applies.
    6. The Developer is established in Australia and is not established in the European Economic Area or the United Kingdom. We have assessed the requirement in Article 27 of the GDPR to appoint a representative, and consider that the derogation in Article 27(2)(a) applies, because our processing of the personal information of individuals in the European Economic Area and the United Kingdom is occasional, does not include processing of special categories of data or of data relating to criminal convictions and offences on a large scale, and is unlikely to result in a risk to the rights and freedoms of individuals. We keep that assessment under review. In the meantime, you may contact us directly at info@techieray.com about any matter covered by this clause.
    7. You have the right to lodge a complaint with the supervisory authority in the country where you live or work, or where you consider the issue arose. In the United Kingdom that authority is the Information Commissioner's Office.
  13. If you are in the United States
    1. This clause applies in addition to the rest of this Privacy Policy if you are a resident of a State of the United States that gives you privacy rights, including California, Colorado, Connecticut, Texas and Virginia.
    2. The categories of personal information we collect are identifiers, being your email address, account identifier and hashed IP address, commercial information, being your subscription and payment history, and internet or other electronic network activity information, being your use of the Website, the questions you submit to AI Search and the analytics and advertising information described in clause 5. The sources, purposes and recipients for each are set out in clauses 2, 3, 4 and 6. We do not collect sensitive personal information, and we do not knowingly collect personal information from anyone under 16.
    3. We do not sell personal information for money. However, the use of Google AdSense on the Website involves the disclosure of information about your device and browsing to Google for the purpose of personalised advertising, which some State privacy laws treat as a sale or as sharing for cross-context behavioural advertising.
    4. To opt out of that disclosure, use the controls in clause 5(c), which turn off personalised advertising at the source. You may also send an opt-out request to info@techieray.com, and you may use an authorised agent to do so on your behalf.
    5. You may request to know what personal information we have collected about you, to receive a copy of it, to have it corrected, and to have it deleted. Send your request to info@techieray.com. We may ask you to verify your identity. We will respond within the period required by the law that applies to you, and in any event within 45 days, and may extend that period once where permitted, in which case we will tell you.
    6. We will not discriminate against you for exercising any of these rights.
    7. If we refuse your request, you may appeal that decision by replying to our response and saying that you wish to appeal. We will tell you the outcome of the appeal, and if we deny the appeal, how to complain to your State Attorney General.
  14. Children
    1. The Website is not directed at children, and is intended for legal, policy, academic and technical professionals.
    2. We do not knowingly collect personal information from anyone under 16, and accounts are not knowingly created for them.
    3. If you believe a child has provided us with personal information, contact info@techieray.com and we will delete it.
  15. Changes to this Privacy Policy
    1. We may update this Privacy Policy from time to time by publishing an updated version on this page. The "Last updated" date at the top of this page records when the current version took effect.
    2. Where a change is material, we will take reasonable steps to bring it to your attention, which may include a notice on the Website or an email to the address associated with your account.
  16. Contact
    1. Questions, requests and complaints about this Privacy Policy may be sent to info@techieray.com, addressed to the privacy contact, techie_ray® labs, Australia.