1. Who we are
LayerAdapt (layeradapt.com) is a web application that helps businesses manage the website or database they already have. LayerAdapt is in early access and is currently run by its founder, Ahmed. In this policy, "LayerAdapt", "we", "us" and "our" mean the operator of LayerAdapt. "You" means anyone who visits our website, joins the early-access list, or uses LayerAdapt.
The full legal details of the business that operates LayerAdapt will be added to this page before launch. Until then, you can reach us about anything in this policy at support@layeradapt.com.
2. What this policy covers
This policy covers personal information about you that we collect through our public website, the early-access list, demo and contact requests, orders, and your LayerAdapt account.
It works together with these pages:
- Data handling: exactly what LayerAdapt accesses, stores and sends when you connect a website or a database.
- Cookie Policy: the one cookie we use and what we keep in your browser.
- Terms & Conditions and Disclaimer: the rules for using LayerAdapt.
- Security: how LayerAdapt protects your website and your data.
3. Information we collect
When you join the early-access list
Your name and email address, and, if you choose to give them, your business name, your role, phone number, country, website address, what you want to use LayerAdapt for (website, database or both), what your website is built with, your team size and any message you write. We also record the IP address the form was sent from and the date.
When you ask for a demo or contact us
Your name and email address, and, if you give them, your company, phone number, website address, what you are interested in and your message, plus the IP address and date. If you email us, we keep the email and our reply.
When you place an order
During early access no payments are taken. When orders open, we will record your name, email address, company, country, phone number, any notes, the plan you chose, the amounts quoted, the payment method, the payment reference you give us, the IP address and the date. Payment is currently by bank transfer or invoice, so we never see or store your card details.
When you have an account
- Account details: your name and email address, whether your email is verified, when you last signed in, and which workspaces and roles you belong to.
- Password: we never store your password itself. We store only a one-way hash made with Argon2id, which cannot be turned back into your password.
- Sign in with Google: if you choose to sign in with Google, Google tells us your name, your email address and your Google account ID. Google never shares your Google password with us.
- Sign-in sessions: for each signed-in device we keep the IP address, the browser's user agent (a short text that describes your browser and device), when the session started, when it was last used and when it expires. You can see your sessions and sign other devices out.
- Sign-in attempts: for every attempt to sign in to an account we record the email address used, the IP address, the user agent, whether it worked, why it failed, and whether it looked unusual (for example, a new location after earlier sign-ins). After 5 wrong passwords in a row, the account is locked for 15 minutes.
- Audit log and activity: important actions in a workspace are recorded with who did them, when, from which IP address and browser, and what changed. See Data handling for details.
- AI assistant conversations: the questions you ask the assistant and its answers. See section 5.
- Email links: when we send you a link to verify your email or reset your password, we keep a hashed (unreadable) copy of the link's code until it expires.
What you connect
When you connect a website or a database, LayerAdapt processes its content on your instructions. That content may include personal information about other people, such as your team or your customers. How this is handled is described in section 11 and on the Data handling page.
What we do not collect
- We do not use analytics, advertising or tracking cookies, and our website loads no third-party tracking scripts. Our fonts are served from our own server.
- We do not buy personal information from other companies.
- We do not collect card or bank details through LayerAdapt.
4. How we use it
- To run LayerAdapt for you: to create and manage your account, connect your website or database, and do what you ask the product to do. This is necessary to provide the service you asked for.
- To keep accounts and data secure: sign-in records, account locks, sessions and the audit log help us spot and stop misuse. We have a legitimate interest in keeping LayerAdapt secure, and you do too.
- To run the early-access list: to decide which businesses to invite, set up your workspace with you, and tell you when your place is ready.
- To answer you: to reply to demo requests, questions and support emails.
- To handle orders and invoices when payments are switched on, and to keep the records the law requires.
- To send service emails: invitations, email verification, password resets, and important notices about your account or about changes to LayerAdapt. These come from support@layeradapt.com and are sent through our email provider's authenticated mail server. We do not send marketing newsletters without your agreement.
- To improve LayerAdapt: we look at how features are used inside the product (for example, how many AI questions a workspace asks) to plan capacity and fix problems. We do this from our own records, not with third-party analytics.
- To meet legal obligations and to protect our rights if there is a dispute.
We do not sell your personal information, we do not use it for advertising, and we do not make decisions about you that have legal or similar effects based only on automated processing.
5. AI processing
LayerAdapt includes AI features powered by Anthropic's Claude models through Anthropic's commercial API. AI is only used for specific tasks:
- Website analysis, when you ask for it: the AI receives the text of your pages, page names, short samples of repeated content (such as the first few service titles) and the names of the content fields LayerAdapt found. It never receives passwords, settings files or your hosting login.
- Database set-up: to suggest clear names for your tables, the AI receives table names, column names and your business's industry. It does not receive the records in your tables. You can scan a database without AI.
- AI assistant: the AI receives your question, your last few messages in that conversation, and a description of the tables and fields you are allowed to see (their names, types and the list of allowed values defined in your database structure), plus any business notes your workspace has added and the names of your workspace's roles. LayerAdapt turns the AI's answer into a query, checks it against your permissions, and runs it on your database itself. The records it finds are shown to you and are not sent to the AI.
We do not use your content to train AI models. Anthropic processes the information it receives under its own commercial terms and privacy commitments, which you can read on anthropic.com. AI output can be wrong, so please read what to keep in mind about AI.
Your assistant conversations (your questions, the answers and the query plans, but not the records found) are stored so you can come back to them, and are deleted automatically after the retention period described in section 8.
6. Who we share it with
We share personal information only with the service providers we need to run LayerAdapt, only as much as they need, and only for that purpose:
| Provider | What for | What they receive |
|---|---|---|
| Our server hosting provider | Runs the servers and database LayerAdapt is stored on | Everything stored in LayerAdapt, in encrypted or protected storage they operate for us |
| Our email provider (Hostinger) | Sends and receives our emails | Your email address, name and the content of emails we send you or you send us |
| Anthropic | AI features | Only what is described in section 5 |
| Google (only if you choose Sign in with Google) | Signing you in | Google already has your account; it tells us your name, email address and Google account ID |
LayerAdapt also connects to your own hosting and database, because you asked it to. Those are your systems, not third parties we share with.
We may also share information when the law requires it, when it is needed to protect someone's safety, or to investigate fraud or a security incident. If LayerAdapt is ever reorganized, merged or sold, your information would move with it under the same protections, and we would tell you before that happens.
7. Where it is processed
Our providers may process information in countries other than the one you live in. Where the law requires it, we rely on recognized safeguards for these transfers, such as standard contractual clauses. Before launch we will list on this page the countries where LayerAdapt's servers and providers process data. If you need this information sooner, email us.
8. How long we keep it
| Information | How long |
|---|---|
| Early-access list entry | Until early access ends or until you ask us to remove you. If your business is invited, the entry is linked to your workspace. |
| Demo and contact requests, emails | As long as needed to answer you and follow up, then deleted on request. |
| Orders and invoices | As long as tax and accounting law requires. |
| Account details | As long as you have an account. When you delete your account in your settings, your name, email address, password and Google link are removed at once; records of what you did in a workspace stay, shown as "Deleted user". |
| Sign-in sessions | Up to 14 days. Expired and signed-out sessions are deleted by a daily clean-up. |
| Email verification and password reset codes | Until they expire, then deleted by the daily clean-up. |
| Sign-in attempts | Kept for 180 days to protect your account, then deleted by the daily clean-up. |
| Audit log | Kept as the long-term record of changes in a workspace. It is not deleted when you remove a website or database. |
| AI assistant messages | Deleted automatically after the retention period set for LayerAdapt, currently 90 days. |
| Website and database content | See Data handling. |
When information is no longer needed, we delete it or make it anonymous. Where backups of our servers are kept, copies may stay in those backups for a limited time until the backups are replaced.
9. How we protect it
We use measures suited to a service that holds website and database access, including:
- Passwords stored only as Argon2id hashes.
- Hosting passwords, database passwords and the AI key encrypted at rest with authenticated encryption (libsodium secretbox), never sent to your browser, never written to logs and never shown to the AI.
- Sign-in sessions in a cookie your browser's scripts cannot read (HttpOnly), limited to our own site (SameSite=Lax), and sent only over secure connections in production.
- Account locks after repeated wrong passwords, sign-in history you can review, and an audit log of changes.
- Separate workspaces: each business sees only its own websites, data and people.
No online service can be guaranteed to be completely secure, and we do not claim that LayerAdapt is. If we become aware of a security incident that affects your personal information, we will tell you without undue delay and do what the law requires. More on our Security page.
10. Your rights
Depending on where you live, you may have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong;
- delete your account yourself in your account settings, or ask us to delete your information;
- ask us to limit how we use it, or object to how we use it;
- ask for your information in a format you can take elsewhere;
- withdraw your agreement at any time, where we rely on it;
- complain to your local data protection authority.
To use any of these rights, email support@layeradapt.com from the address on your account. We may need to confirm it is you before acting. We aim to reply within one month. Some information we may have to keep, for example invoices the law requires us to keep, or audit records needed to show what happened in a workspace; if so, we will tell you what and why.
11. Data in your website or database
When you connect a website or a database, you decide what is in it and what LayerAdapt does with it. For personal information in your website or database (for example, your customers' details), you are responsible for having a lawful reason to process it and for telling those people how you use their data. LayerAdapt processes it on your behalf and on your instructions, to provide the service.
LayerAdapt does not automatically know what your website or database contains, or whether it holds personal information, unless that is visible through what you connect. If someone asks us about their data in your systems, we will refer them to you. If your business needs a data processing agreement with us, email us.
12. Children
LayerAdapt is a tool for businesses and is not meant for children. We do not knowingly collect information from anyone under 16. If you think a child has given us information, email us and we will delete it.
13. Changes to this policy
We will update this policy when LayerAdapt changes, and before launch after review by a legal professional. The date at the top shows when it last changed. If a change matters to how we use your information, we will tell account holders by email or in the product before it takes effect.
14. Contact
Questions, requests or concerns about privacy: support@layeradapt.com.