Privacy Policy

Last Updated: September 2026.

We do not log any personally identifying information for anonymous guests. Guest sessions are accountless: no name, email, address, phone number or document contents are recorded on our side. A random, disposable session identifier is issued solely to count free daily usage; it contains no personal data and is wiped together with the guest session.

Registered profiles are managed through Lovable Cloud auth, which handles credential hashing, session tokens and account recovery.

Financial checkout details are processed entirely off-app by our payment network provider. No card number, CVC or billing address is ever entered into or stored by Layers.

Whiteboard grid elements pass through secure cloud database tables protected by Row-Level Security (RLS) firewalls, so only the owning account can read or write them.

Layers is operated by Abdullah Basem, an individual sole trader, trading as Layers.page. Abdullah Basem is the data controller responsible for the personal data described in this notice.

We process personal data on the following legal bases: performance of our contract with you (providing the service and your subscription), our legitimate interests (security, abuse prevention and service improvement), your consent where required, and compliance with applicable legal obligations.

Personal data is retained only as long as necessary for these purposes — account data for the life of your account, support messages for up to 24 months, and anonymised logs for a short security window — after which it is deleted or anonymised. To exercise your rights, contact us through the contact page.

Layers is a secure design and document formatting workspace. It combines private document utilities, a template studio, a file-format catalog and a whiteboard canvas.

Because the majority of processing happens inside our secure workspace, most of what you do in Layers never reaches our infrastructure. This policy explains the narrow set of data that does reach us, how we protect it, and what remains under your control.

Account information: when you sign up, we store your email address and a unique user identifier managed by our authentication provider. We do not collect names, addresses, phone numbers or payment details.

Workspace data: boards and their shape snapshots are stored only when you choose to save them. This data is scoped by row-level security so only the owning account can read it.

Local data: guest usage counters, template drafts, business branding and UI preferences are stored locally in your session. They are never sent to our servers.

Technical data: our hosting provider may log anonymised request metadata (IP address, user agent, timestamps) for reliability and abuse prevention. These logs are not linked to your documents.

To authenticate you and keep your session secure.

To persist the boards and projects you explicitly create.

To enforce free-tier usage limits tied to you.

To respond to support requests and keep the service reliable.

Layers uses a single authentication session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Guest mode relies on localStorage to count daily actions and remember drafts. You can clear this data at any time from your files settings.

Authentication is handled by Lovable Cloud auth. Paddle.com Market Limited acts as our Merchant of Record and handles all checkout, subscription management, payments, invoicing and sales-tax compliance — no card data is collected or stored by Layers.

We also share limited personal data with hosting and infrastructure providers (subprocessors), with professional advisers such as legal and accounting support, and with authorities where required by law.

File conversion: when you choose a format that cannot be produced in our secure workspace, the file is sent to our secure conversion network and deleted from it immediately after the converted result is returned.

AI and translation: when you use an AI document tool or document translation, the text you submit is sent to our AI processing partner or translation partner (DeepL) solely to generate the result. It is not used to train their models under our business terms, and we do not retain it after the response is delivered.

We do not embed social-media widgets, ad networks or analytics scripts inside the workspace.

Our hosting, authentication, conversion, AI and payment partners may process data outside your country, including in the United States. Where personal data leaves the UK or EEA, transfers rely on adequacy decisions or the European Commission's Standard Contractual Clauses agreed with each provider.

You can ask us for more detail about a specific provider or safeguard through the contact page.

Uploaded files are never retained. Files processed in our secure workspace stay in memory and are zeroed the moment the download is handed over, and files sent to our conversion network are deleted from it immediately after the converted result is returned.

Whiteboards follow a separate retention schedule: session-only for guests and free accounts, 24 hours on Plus and 7 days on Pro. You can request deletion of your account and its associated boards at any time by contacting us.

Anonymised server logs are retained for a limited period for security and reliability purposes.

Access and correction: signed-in users can review their account email from the account page.

Deletion: you can ask us to delete your account and any boards you own. Local data can be removed instantly from your files.

Objection and portability: because we store very little personal data, most export requests can be satisfied by downloading your documents directly from the workspace.

Restriction and consent: you can ask us to restrict processing of your data, and where we rely on consent you can withdraw it at any time without affecting processing carried out before withdrawal.

How to exercise your rights: contact us through the contact page. We respond within one month. If you are in the UK or EEA and are unhappy with our response, you have the right to complain to your local data protection supervisory authority.

Layers is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

Database access is protected by row-level security policies. Authentication tokens are short-lived and scoped to your session. We never store passwords or payment information.

Because files are wiped immediately after processing, bulk document storage simply does not exist in our architecture.

We may update this policy as the product evolves. Material changes will be posted on this page with a revised effective date. Continued use of Layers after changes means you accept the updated policy.