Layer.ai procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Our use of personal data (as such term is defined under applicable data protection and privacy laws) that you and your Users provide us with in connection with our Services and Website is governed by the Privacy Policy, as amended from time to time. However, if we process personal data on your behalf of or at your direction, then Layer shall be deemed the processor/service provider and the Customer will be the controller/business, as such terms are defined under applicable privacy and data protection laws. In such situations the processing of such personal data shall be governed by a data processing addendum (DPA) between Layer and you.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Your Personal Information may be transferred to Layer and its service providers in countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country and may not provide the same level of protection as your country. In such cases we will ensure that applicable safeguards and legal mechanisms are used to ensure that the transfer is aligned with the applicable data protection laws.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 6. International Data Transfers from Europe ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We will retain Personal Information for the period necessary to fulfil the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. We will retain Personal Information that we process on behalf of our customers for the duration set forth in the applicable customer contract or as otherwise instructed by the customer. 5. Your Rights Depending on the jurisdiction in which you reside, you may have certain rights under relevant applicable laws regarding the collection and processing of your Personal Information. To the extent these rights apply and concern you, you can contact us via the contact details available below and ask to exercise the following rights: Receive confirmation as to whether or not personal information concerning you is being processed, and access your stored personal information, together with supplementary information. Receive a copy of personal information you directly volunteer to us in a structured, commonly used and machine-readable format. Request rectification of your personal information that is in our control. Request erasure of your personal information. Object to the processing of personal information by us. Request to restrict processing of your personal information by us. Lodge a complaint with a supervisory authority. Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your Personal Information, you can report it to the data protection authority that is authorised to hear those concerns. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 4. Data Retention ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ In any case we will conclude that disclosure of Personal Information is necessary, we will only disclose that portion of the Personal Information that is required in order to satisfy the basis for disclosure. We will share the Personal Information under appropriate safeguards.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 9.1. Third Party Services. Certain features and functionalities of the Platform are integrated with, and the Platform may link to or call third party products and services, including by way of API or SDK (“ Third Party Services ”, which include the Models). Customer acknowledges and agrees that the Third Party Services are beyond Layer’s control, are subject to their own licenses, policies (including privacy policies) and legal terms and that Layer does not endorse any Third Party Services and other than as expressly set out in these Terms, shall not be in any way responsible or liable with respect to any Third Party Services, their update, inclusion or removal from Layer’s Platform and any changes to such Third Party Services’ legal terms and policies, as made by the Third Party Services providers from time to time. Layer’s integration or interaction with any Third Party Service such does not in any way imply, suggest, or constitute any sponsorship or approval by the Company, or by such Third Party Service provider of Layer, nor any affiliation between them. Layer may add, replace, enable or disable integrations with and update Third Party Services at its sole discretion and without notice. 9.2. Models. Without detracting from the foregoing Section 9.1, Layer will enable your interaction with and calls to third party graphic, audio, video, code and other artificial intelligence and machine learning models (including foundational and large language models) (together, “ Models ”) to generate the Generated Content. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In addition to the purposes listed in this Privacy Policy, we may share Personal Information with our trusted third-party providers, who may be located in different jurisdictions across the world, for any of the following purposes: Providing you with our Services, including providing a personalized display of our Website and marketing tools; Payment processing services; Communication tools, including phone and chat, event and meeting platforms and so on; Storing and processing such information on our behalf; Performing research, technical diagnostics or analytics; We may share information in the event of a corporate transaction (e.g. sale of a substantial part of our business, merger, consolidation or asset sale). In the event of the above, the transferee or acquiring company will assume the rights and obligations as described in this Privacy Policy. We may also disclose information if we have good faith to believe that disclosure of such information is helpful or reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce our policies, including investigations of potential violations thereof; (iii) investigate, detect, prevent, or take action regarding illegal activities or other wrongdoing, suspected fraud or security issues; (iv) to establish or exercise our rights to defend against legal claims; (v) prevent harm to the rights, property or safety of us, our users, yourself or any third party; or (vi) for the purpose of collaborating with law enforcement agencies and/or in case we find it necessary in order to enforce intellectual property or other legal rights. ” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.