Rory Privacy & Data Retention Policy

Rory · United States

Last Updated: September 8, 2026
Effective Date: September 8, 2026
Entity: Rory LLC ("Rory", "we", "us", or "our")
Contact: [email protected] / [email protected]
Websites & Services: joinrory.com, app.joinrory.com, rory.page, rorypay.com (the "Services")
Canonical Registry: https://joinrory.com/privacy

Rory LLC is committed to protecting your privacy and maintaining the integrity and confidentiality of your personal information. This Privacy & Data Retention Policy explains what information we collect, why we collect it, how it is processed, with whom it may be shared, and our explicit statutory data retention periods.

1. Information We Collect

We collect information across three primary channels: directly from you, automatically through your use of the Services, and from authorized third-party verification partners.

1.1 Information You Provide Directly

• Identity & Contact Data: Full legal name, preferred display name, email address, postal address, and telephone number.
• Account Credentials: Username, password hash, multi-factor authentication (MFA/TOTP) keys, and WebAuthn/Passkey registration public keys.
• Creator Profile & Media: Biographical descriptions, headline copy, linked social handles (Twitch, YouTube, X, Kick), profile avatars, banners, and audio/voice notes.
• Payment & Banking Information:
  • Fans: Payment card billing details, card brand, last four digits, expiry, and PayPal account references (full credit card PAN and CVV are processed directly via PCI-DSS compliant processors and are never stored on Rory servers).
  • Creators: Bank routing and account numbers (encrypted at rest), tax identification numbers (SSN/EIN where required for Form 1099 compliance), PayPal email addresses, or Venmo handles.

1.2 Information Collected Automatically

• Append-Only Ledger & Transaction Logs: Complete records of coin package purchases, coin spend transactions, platform fees, tips, recurring tier pledges, and creator USD payouts.
• Device & Connection Telemetry: IP address, browser type and version, operating system, device identifiers, and timestamped request headers.
• Interaction Data: Engagement with creator hubs, vanity links, and payout flows.

1.3 Information from Third-Party Service Partners

• Identity Verification & Biometric Data Partners (KYC/IDV): Didit and Plaid provide identity verification outcomes, document validation signals, and name-matching verification to prevent money laundering and fraud. During creator verification, our identity partner (Didit) may process biometric facial geometry extracted from your government ID photograph and verification selfies to confirm authenticity. Rory does not store raw biometric templates on platform servers. Biometric data processed by Didit is permanently destroyed upon verification completion or within three (3) years of capture, in compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14/) and Texas CUBI.
• Social SSO Integrations: When you sign in via Twitch, Steam, Discord, Google, or Microsoft, we receive authenticated account identifiers and verified email addresses according to your permissions.

2. Legal Bases & Purposes for Data Processing

We process personal data under the following lawful bases:

3. Comprehensive Data Retention Schedule

To ensure regulatory compliance, protect the integrity of our financial ledger, and satisfy statutory tax and anti-money laundering mandates, Rory enforces the following formal data retention periods:

When statutory retention windows expire, personal data is permanently deleted, overwritten, or cryptographically anonymized so that it can no longer be associated with an individual.

4. Third-Party Data Disclosures

Rory does not sell, rent, or trade your personal information. We disclose data solely to the following categories of trusted service providers under strict data protection agreements:

1. Payment Gateways & Disbursers: PayPal, Venmo, card network processors, and Hyperwallet (solely for creator USD disbursements).
2. Identity Verification & Banking Rails: Plaid Inc. (bank account authentication) and Didit (automated identity verification).
3. Cloud Infrastructure & Communications: Amazon Web Services (AWS) for encrypted database storage and transactional email delivery (Amazon SES).
4. Legal & Regulatory Authorities: When required by subpoena, court order, search warrant, or mandatory legal process, or to protect the safety, rights, and property of Rory LLC, our users, or the public.

5. Security & Technical Safeguards

• Encryption at Rest & in Transit: All network communication is strictly enforced over HTTPS (TLS 1.3 / modern TLS 1.2). Sensitive database columns (including credentials and API tokens) are encrypted at rest using AES-256.
• Server-Side Credential Isolation: Passwords utilize high-work-factor Argon2id or PBKDF2 hashing with unique cryptographic salts. Client sessions employ HttpOnly, Secure, and SameSite=Lax cookies.
• Zero Raw PAN Storage: Rory never stores unencrypted credit card primary account numbers (PAN) or security verification codes (CVV/CVC).

6. Your Privacy Choices and Legal Rights

Depending on your jurisdiction (such as California under CCPA/CPRA, or other US state privacy laws), you may possess the following rights:

• Right to Know / Access: Request details regarding the categories and specific pieces of personal data we have collected about you.
• Right to Rectify: Request correction of inaccurate or incomplete personal records.
• Right to Delete: Request deletion of your personal information, subject to mandatory statutory retention exceptions (such as our 7-year financial ledger retention mandate).
• Right to Non-Discrimination: We will not discriminate against you in pricing, service quality, or platform availability for exercising your statutory privacy rights.
• Opt-Out of Sale / Sharing: Rory does NOT sell your personal data or share your personal data for cross-context behavioral advertising.

To exercise any of these rights, email your request to [email protected] or [email protected]. We verify all requests against the authenticated account email before processing.

7. Contact Us

For questions, requests, or concerns regarding this Privacy & Data Retention Policy:

• Data Protection Officer / Legal Inquiries: [email protected]
• Corporate Entity: Rory LLC, Orange County, California, USA
• Website: https://joinrory.com

Rory · UK and EU

Last Updated: September 7, 2026
Effective Date: September 7, 2026
Controller: Rory LLC ("Rory", "we", "us", or "our")
Contact: [email protected] / [email protected]
Canonical URL: https://joinrory.com/privacy

This Privacy Policy applies to data subjects in the United Kingdom (under the UK GDPR and Data Protection Act 2018) and the European Economic Area (under the EU General Data Protection Regulation 2016/679).

1. Data Controller Identification

Rory LLC is the Data Controller responsible for your personal data processed through joinrory.com, app.joinrory.com, rory.page, and rorypay.com.

2. Personal Data We Collect & Lawful Bases

We collect and process personal data strictly in accordance with Article 6 of the GDPR:

• Contractual Necessity (Art. 6(1)(b)): Processing usernames, email addresses, password hashes, coin purchases, ledger transactions, and creator USD payouts.
• Legal Obligation (Art. 6(1)(c)): Retaining financial records, tax data, and identity verification outcomes under anti-money laundering (AML) and financial reporting regulations.
• Legitimate Interests (Art. 6(1)(f)): Protecting platform security, investigating fraud, maintaining system stability, and enforcing our terms.
• Consent (Art. 6(1)(a)): Non-essential cookies and analytics signals on joinrory.com.

3. Statutory Data Retention Schedule

Under Article 5(1)(e) (Storage Limitation), personal data is retained only for as long as necessary to satisfy the purposes for which it was collected or to comply with mandatory statutory requirements:

1. Financial Ledger & Transaction Records: Retained for 7 years following the transaction date to comply with corporate tax laws, accounting standards, and statutory audit obligations.
2. KYC & Anti-Money Laundering Verification: Retained for 5 years following the termination of the creator relationship in compliance with statutory AML directives.
3. Account & Profile Records: Retained for the duration of the active account relationship plus 30 days following verified account closure.
4. Direct Messages & Media: Retained for up to 3 years or until deleted by account holders.
5. Session Cookies & Audit Logs: Stored for 7 to 90 days for operational security.

4. International Data Transfers

When transferring personal data outside the UK or EEA (such as to our servers in the United States), Rory ensures appropriate safeguards pursuant to Article 46 of the GDPR, including Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office (ICO).

5. Your Rights Under GDPR & UK DPA

You possess the following statutory rights:

• Right of Access (Art. 15): Obtain confirmation and a copy of your personal data.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of data, subject to legal and statutory retention mandates (such as our 7-year financial recordkeeping obligation).
• Right to Restriction (Art. 18) & Portability (Art. 20): Request limits on processing or export of your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

To exercise any right, contact [email protected].

Corporate services · United States

Welcome to Rory Financial. Rory Financial Group, Inc. and its affiliates (collectively, "Rory Financial", "we", "us", or "our") provide institutional ledgering, virtual account management, and multi-rail payment routing infrastructure. This Privacy Policy describes how we collect, use, process, and safeguard personal information of our business customers' representatives, developers, and visitors to our corporate platform.

1. Information We Collect

In connection with our business services, we collect information necessary to establish, maintain, and secure institutional accounts, including:

• Business Contact Data: Representative name, corporate email address, business telephone number, and physical office address.
• Developer Credentials: API keys, access tokens, and administrative credentials.
• Compliance & Screening Data: Identity documentation, corporate registry records, and screening details required under AML/KYC regulations.
• Infrastructure Logs: IP address, browser type, operating system, and routing activity logs.

2. How We Use Information

We process personal information to:

• Provision and secure API access and platform dashboards.
• Execute and reconcile transactions across routing networks.
• Comply with regulatory requirements, including sanction list screening and transaction monitoring.
• Improve our infrastructure performance, reliability, and security metrics.

3. Data Sharing and Transfers

We do not sell business contact or personal data. We share information only with:

• Financial Network Partners: Banking institutions, payment networks, and clearing houses involved in transaction routing.
• Compliance Vendors: Watchlist screening and risk intelligence providers.
• Legal Authorities: Regulatory agencies or law enforcement when required by legal process or regulatory directives.

4. Security Measures

Rory Financial implements institutional-grade security controls, including transit and rest encryption (TLS/AES-256), strict access isolation, and audit logging. We review our physical and digital security protocols regularly.

5. Contact Information

For inquiries regarding this Privacy Policy or corporate data protection standards, contact our compliance team:

• Email: [email protected]
• Website: roryfinancial.com

Corporate services · UK and EU

This Privacy Policy is provided by Rory Financial Group, Inc. and its UK/EU affiliates (collectively, "Rory Financial", "we", "us", or "our") to developers, business customers, and representatives residing in the United Kingdom (UK) and the European Economic Area (EEA). We process personal data in compliance with the UK GDPR, EU GDPR, and local data protection regulations.

1. Data Controller & Representatives

The data controller is Rory Financial Group, Inc. For our operations in Europe, we designate our UK office as our main representative:

• Representative: Rory Financial UK Ltd., 128 City Road, London, EC1V 2NX, United Kingdom
• Email: [email protected]

2. Legal Bases for Processing

Under GDPR regulations, we process personal data under the following lawful bases:

• Contract Performance: Setting up and managing your developer accounts and routing agreements.
• Legal Compliance: Screening transactions against financial sanctions lists, AML compliance, and maintaining audit trails.
• Legitimate Interests: Securing our network infrastructure, preventing platform fraud, and optimizing API performance.

3. Data Protection Rights

You possess the following rights in relation to your personal data:

• Access and Portability: Requesting copies of personal data and transferring it in structured format.
• Rectification and Erasure: Requesting corrections to inaccurate data or deleting personal data.
• Object and Restrict: Objecting to legítimate interest processing or requesting suspension of processing.

To exercise these rights, please email [email protected].

4. International Transfers

Data is stored and processed on servers outside the UK/EEA (principally in the US). We secure international transfers using standard contractual clauses (SCCs) approved by the UK Government and the European Commission to ensure equivalent safety standards.

5. Complaints

You have the right to lodge a complaint with your local data protection authority, such as the Information Commissioner's Office (ICO) in the UK (www.ico.org.uk).