Privacy Policy

Welcome to Layter ("we," "us," or "our"), operated at layter.io. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our AI-powered social media management platform and related services (collectively, the "Service").

This policy applies to users worldwide, including residents of the European Economic Area ("EEA"), the United Kingdom ("UK"), the United States, Canada, Australia, and New Zealand. Jurisdiction-specific rights are detailed in Section 10.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent as a legal basis, we will obtain your consent before processing your data for that purpose.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address and password (hashed and stored securely by Supabase Auth)
• Business name, business type, and business description (optional, used to personalise your experience)
• Brand voice preferences and target audience settings
• Subscription tier and billing cycle information

1.2 Social Media Account Data

When you connect social media accounts, we collect:

• OAuth Tokens: Access tokens and refresh tokens required to post on your behalf. Tokens are stored encrypted in our database and are revoked when you disconnect an account.
• Profile Information: Platform user ID, username, account type (business/personal), and profile metadata provided by the platform.
• Platform-Specific Data: Board lists (Pinterest), page IDs (Facebook), channel info (YouTube), and creator info (TikTok).

We currently support connections to: Instagram, Facebook, TikTok, YouTube, Pinterest, and LinkedIn.

1.3 Content You Upload

• Media Files: Images and videos you upload for scheduling, including file metadata (file name, size, dimensions, duration, MIME type).
• Captions and Text: Captions you write or that are AI-generated, scheduling times, platform selections, and posting preferences.
• Posting Schedules: Recurring schedule templates and post ordering preferences.

1.4 Information Collected Automatically

• Usage Data: Features used, actions taken, credit consumption, and error logs. We record these in internal usage and audit log tables.
• Device & Browser Information: IP address, browser type and version, operating system, and device identifiers.
• Analytics Data: We use Google Analytics (GA4) to collect anonymised interaction data such as page views, session duration, and referral sources. See Section 7 for details.

1.5 Payment Information

Payment card details are collected and processed exclusively by Stripe. We never receive, store, or have access to your full card number. We store only your Stripe customer ID and subscription ID to manage your billing relationship.

2. How We Use Your Information

We use the information we collect for the following purposes:

3. AI Processing & Automated Decision-Making

Our Service uses artificial intelligence to provide core functionality. When you use AI-powered features, the following processing occurs:

3.1 LayterVision™ (Caption & Content Generation)

• Your uploaded images and videos are sent to Google Gemini (currently Gemini 2.5 Flash) for visual analysis.
• Google processes the media to generate descriptive captions, content recommendations, and visual analysis scores.
• Your business profile information (brand voice, target audience) may be included in prompts to personalise outputs.
• Google's use of this data is governed by their Gemini API Terms of Service. When using the paid API tier, Google does not use your prompts or responses to train their models.

3.2 AI Blog Content Generation

• We use Tavily for keyword research and search engine results analysis to inform blog content strategy.
• Blog drafts are generated by Google Gemini based on keyword briefs and competitor analysis.
• Generated content undergoes automated quality control checks before publication.

3.3 AI Schedule Optimisation

We may use AI to suggest optimal posting times based on aggregated, anonymised engagement patterns. No individual user data is shared for this purpose.

No Solely Automated Decisions with Legal Effect: Our AI features assist with content creation and scheduling but do not make decisions that produce legal effects or similarly significantly affect you. You always retain control over what content is published and when.

4. How We Share Your Information

We do not sell your personal information. We share data only as described below:

4.1 Service Providers (Data Processors)

We use the following third-party providers to operate the Service:

4.2 Social Media Platforms

When you connect your accounts and schedule posts, we transmit your content (media, captions, metadata) to the respective platforms via their official APIs. Each platform processes your data under its own privacy policy:

• Meta (Instagram & Facebook) Privacy Policy
• TikTok Privacy Policy
• Google (YouTube) Privacy Policy
• Pinterest Privacy Policy
• LinkedIn Privacy Policy

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice on our Service before your information is transferred and becomes subject to a different privacy policy.

5. Data Retention

We retain your data for the following periods:

When you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (e.g., billing records, audit trails). Media files stored in our cloud storage are permanently deleted upon account deletion.

6. Data Security

We implement appropriate technical and organisational measures to protect your information, including:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Authentication: Supabase Auth with secure password hashing (bcrypt); OAuth 2.0 with PKCE for social connections.
• Row-Level Security (RLS): Database policies ensure users can only access their own data.
• Access Controls: Service role keys are restricted to server-side operations only.
• Input Validation: All user inputs are validated and sanitised using schema validation (Zod).
• Webhook Verification: Social media platform webhooks are verified using cryptographic signatures.
• Token Revocation: When you disconnect a social account, we actively revoke the OAuth token with the platform before deleting it from our database.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

7. Cookies & Tracking Technologies

7.1 Cookies We Use

7.2 Managing Cookies

You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using certain features of the Service. For Google Analytics, you can opt out by installing the Google Analytics Opt-out Browser Add-on.

8. International Data Transfers

Our Service is hosted in the United States via Vercel and Supabase. If you access the Service from outside the United States, your personal data will be transferred to, stored, and processed in the United States.

For EEA and UK residents: Where we transfer personal data outside the EEA/UK, we rely on appropriate safeguards including:

• The EU-U.S. Data Privacy Framework (where our processors are certified).
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• The UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs for UK transfers.

For Australian and New Zealand residents: By using the Service, you consent to the transfer of your personal information to the United States. We take reasonable steps to ensure that overseas recipients handle your information in accordance with the Australian Privacy Principles and the New Zealand Information Privacy Principles.

9. Data Deletion

9.1 Disconnecting Social Accounts

You can disconnect any social media account at any time from your dashboard. When you disconnect, we immediately revoke the OAuth token with the platform and delete it from our database.

9.2 Meta (Facebook & Instagram) Data Deletion

We provide a compliant Data Deletion Callback endpoint as required by Meta. If you remove the Layter app from your Facebook or Instagram settings, Meta notifies us and we:

• Immediately deactivate the connection and clear access tokens.
• Log the deletion request with a confirmation code.
• Complete data deletion within 30 days.
• Provide a status page where you can check the progress of your deletion request using the confirmation code.

9.3 Full Account Deletion

To request full deletion of your Layter account and all associated data, please email privacy@layter.io. We will process your request within 30 days, deleting all personal data except where retention is required by law.

10. Your Privacy Rights

10.1 Rights for All Users

Regardless of your location, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information.
• Disconnect: Disconnect any social media account and revoke our access at any time.

10.2 European Economic Area & United Kingdom (GDPR / UK GDPR)

If you are located in the EEA or UK, you additionally have the right to:

• Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Restriction of Processing: Request restriction of processing in certain circumstances.
• Object to Processing: Object to processing based on legitimate interests, including profiling.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a Complaint: File a complaint with your local data protection authority (e.g., the ICO in the UK, CNIL in France, BfDI in Germany).

10.3 California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Opt-Out of Sale: We do not sell personal information. No opt-out is necessary.
• Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights.

In the preceding 12 months, we have collected the categories of personal information described in Section 1. We have not sold personal information nor shared it for cross-context behavioural advertising.

10.4 Canada (PIPEDA)

Canadian users have the right to access, correct, and challenge the accuracy of their personal information. You may withdraw consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions. Contact us at privacy@layter.io to exercise these rights.

10.5 Australia (Privacy Act 1988)

Australian users have rights under the Australian Privacy Principles (APPs) including the right to access and correct your personal information, and to complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs. We take reasonable steps to ensure that personal information we hold is accurate, up-to-date, complete, and relevant.

10.6 New Zealand (Privacy Act 2020)

New Zealand users have rights under the Information Privacy Principles (IPPs) including the right to access and request correction of your personal information. You may complain to the Office of the Privacy Commissioner if you believe we have interfered with your privacy. We collect personal information directly from you and only for lawful purposes connected to our functions.

To exercise any of these rights, please contact us at privacy@layter.io. We will respond within 30 days (or the timeframe required by your applicable law). We may need to verify your identity before processing your request.

11. Children's Privacy

Our Service is not directed to individuals under 16 years of age (or 13 in jurisdictions where this is the applicable age of digital consent). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@layter.io.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page with a revised "Last Updated" date.
• Sending an email notification for significant changes that affect how we handle your data.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of those changes, except where additional consent is required by law.