Privacy Policy

Controller and contact

ABVentures SAS, 60 rue François 1er, 75008 Paris, France, is the controller for the personal data described in this policy. Contact: [email protected].

Data we process

• Account: email, name and avatar, from Google sign-in or a one-time email code.
• Workspaces and collaboration: members, roles, invitations, share links and the people you share a model with.
• Your content: models, versions, templates, uploaded files (Excel, FEC, CSV), imported transactions, mappings and exports.
• Connected services: the access you grant to services such as Pennylane, Qonto, Stripe, Airtable or Metabase, stored encrypted, and the data you choose to import from them.
• Agent connections: the AI clients you authorize, API key metadata and a log of the requests they make (tool, model, time, outcome). Your AI agent acts under your own AI account.
• Billing: customer, subscription and invoice data handled with Stripe, and your country to set the billing currency. Card details are handled by Stripe only.
• Communications: support messages and the emails we send you.
• Study and report requests: email, answers and, if you choose to give them, your name, firm and role, with the date of each consent.
• Technical data: security events, error reports and aggregated, cookie-free audience measurement of the website.

Purposes and legal bases

• Contract: account access, models, workspaces, collaboration, imports, connections, exports, the API and MCP server, subscriptions and support.
• Legal obligations: invoicing, accounting, tax and security records.
• Legitimate interests: reliability, security, abuse prevention, debugging, product improvement, and emails about the product to account holders.
• Consent: marketing updates, and being named in a study report. You can withdraw consent at any time.

Emails

We send service emails (sign-in codes, invitations, shares, billing). After you sign up, we also send a few emails to help you get started; you can unsubscribe from them at any time. We send marketing updates only to people who agreed to receive them.

Recipients and subprocessors

• Supabase: database, sign-in and file storage (Ireland, EU).
• Vercel: hosting and website analytics (United States).
• Stripe: payments and invoicing.
• Sentry: error monitoring (Germany, EU).
• Resend: email delivery (United States).
• Google: sign-in, when you choose it.
• The people you invite to a workspace or share a model with see the content you give them access to.
• AI providers and the services you connect are not Layerz subprocessors: your use of them is governed by your own agreement with each provider.

AI processing and training

Layerz does not train any AI model on your data, and does not send your model content to AI providers. AI processing only happens when you connect your own AI agent, under your own AI account. In that setup the agent reads and writes your model through MCP or the API, and Layerz stores and serves the result.

International transfers

Some providers process data outside the European Economic Area and the United Kingdom, mainly in the United States. These transfers rely on the EU-US Data Privacy Framework and its UK extension, or on the European Commission’s standard contractual clauses with the UK addendum.

Retention

Account, workspace and model data, including version history, are kept while your account is active and deleted when you ask us to delete your account, except backups, which roll over within a limited period. Billing records are kept for the legal accounting period (10 years in France). Request logs, security events and support messages are kept for limited periods appropriate to security, debugging and audit. Study data is kept to produce and send the report; you can ask us to delete it at any time.

Cookies

Layerz uses only the cookies needed to keep you signed in, secure your session and remember how you last signed in. Website audience measurement uses Vercel Analytics, which sets no cookie. There is no advertising cookie.

Your rights

Wherever you are, you may ask to access, correct or delete your personal data. Depending on applicable law (including the GDPR, the UK GDPR, US state privacy laws and the Australian Privacy Act), you may also request restriction, portability, objection, withdrawal of consent, or ask us not to sell or share your data: we never sell it. To exercise these rights, contact [email protected]; we answer within one month. You may also lodge a complaint with your data protection authority, such as the CNIL (France), the ICO (United Kingdom) or the OAIC (Australia).

Security

Layerz uses access controls, authenticated sessions, row-level security, encryption in transit, encrypted credentials for connected services, hashed API keys, restricted admin access and log redaction. No online service can be guaranteed completely secure.