Layr helps product teams turn customer and project signals into evidence-backed priorities. This Privacy Policy explains what we collect, why we collect it, how we protect it, and how you can control it. If you are evaluating Layr for real project data, also read our public security documentation for the operational detail security reviewers usually ask for.
Our stance
We treat your product data as customer data, not training fuel. We do not use your product content to train shared Layr models.
We design Layr so you start narrow, expand deliberately, and keep humans in control of anything that writes back into your tools. Connecting a tool is not the same as ingesting everything. Sources stay excluded until an authorized user confirms them.
We support enterprise review, including data processing agreement (DPA) discussion, as you move from evaluation into production. We walk security teams through the controls we run and do not claim certifications we do not hold.
Who this covers
This policy covers visitors to uselayr.com, people who create Layr accounts, and workspace members who connect tools or use product features.
Layr is operated for business use. If you use Layr on behalf of a company, that company may control the workspace and decide how product data is retained or deleted.
Information we collect
What we collect depends on how you interact with Layr.
- Account and workspace data: name, email, password (hashed), role, membership, session and authentication records, and billing or entitlement metadata when applicable.
- Marketing and website data: pages you visit, device and browser information, approximate location derived from IP, referrer, and form submissions such as waitlist or contact requests.
- Content you include: messages, issues, comments, pages, conversations, and related metadata from tools you connect and sources you confirm for inclusion.
- Product memory we derive: evidence records, problems and opportunities your team reviews, links between evidence and problems, and review decisions such as approve, reject, assign, or merge.
- Security and operational data: encrypted integration credentials, webhook verification outcomes, and security-relevant events needed to run and protect the service.
How your data enters Layr
When you connect an integration, you authorize Layr through that provider's OAuth flow. We store the credentials needed to access what you authorized, not your password to that tool.
Layr discovers available sources such as channels, projects, pages, and inboxes. Sources remain excluded until an authorized user confirms inclusion. Unconfirmed sources are not ingested.
After confirmation, we import recent history for included sources, keep them current through sync and provider events where available, and reject payloads that fail verification or fall outside your included sources.
How we use information
We use the information we collect to:
- Operate, maintain, secure, and improve the Layr product and marketing site
- Create and serve product memory, recommendations, answers, and drafts inside your workspace
- Authenticate users, enforce roles, and protect accounts
- Communicate about the service, onboarding, security, and important product changes
- Process billing and entitlements where applicable
- Comply with law and respond to lawful requests
AI processing
Some Layr features use AI, for example embeddings for meaning-based search, classification of related evidence, answers over product memory, and drafting help from an opportunity.
Model calls run on Layr's backend. Your browser talks to Layr; Layr calls the model provider. Customers do not send product content from the browser directly to a model API.
Today model inference for these features runs on Layr's servers through contracted model providers. We do not train shared Layr models on your product data. Provider handling of inference content follows that provider's terms and the configuration we run for customer workloads.
When we share information
We do not sell your personal information.
We may share information with trusted subprocessors that help us host, secure, send email, process payments, or run AI inference, only as needed to provide Layr, and under contractual confidentiality and data-protection terms.
We may also disclose information if required by law, to protect Layr or our users from fraud or abuse, or in connection with a merger, financing, or sale of assets, subject to appropriate protections.
Subprocessor detail for enterprise review, including AI inference providers, is available through our privacy channel.
Security
We encrypt integration OAuth tokens at the application layer before storage, hash account passwords with a one-way scheme, use TLS in transit, verify inbound webhooks, and scope product and search access by workspace.
No method of transmission or storage is perfectly secure. We design for defense in depth and continuous hardening, and we are ready to walk security teams through the controls we run.
Retention, deletion, and offboarding
We retain workspace data so the product keeps working for your team while the workspace is active and sources remain connected under your settings. Initial sync lookback controls how far back a first import goes; it is not an automatic deletion timer.
In product, authorized users can disconnect integrations, remove sources from inclusion, deactivate accounts, and remove workspace members. Excluding a source stops new ingest from that source.
Full workspace or account erasure is handled on request. Contact privacy@uselayr.com. We confirm scope with an authorized admin and communicate what is removed. Legal or billing records we are required to keep may remain in minimized form where the law or payment rules require it.
Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, restrict, or export personal data, or to object to certain processing. Workspace admins control much of the product data path through source selection, membership, and offboarding requests.
You can manage many marketing-site preferences through your browser and cookie settings. See our Cookie Policy for details.
To exercise privacy rights, or to request a DPA or security review, contact privacy@uselayr.com. We may need to verify your identity and the scope of the request before acting.
International transfers
Layr may process data in the United States and other countries where we or our subprocessors operate. When we transfer personal data internationally, we use appropriate safeguards required by applicable law, including contractual protections where needed.
Children
Layr is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@uselayr.com so we can delete it.
Changes to this policy
We may update this Privacy Policy as Layr evolves. When we make material changes, we will update the date on this page and, where appropriate, provide additional notice through the product or by email.
Contact
For privacy questions, rights requests, DPAs, subprocessors, or offboarding, email privacy@uselayr.com.