Privacy Policy

1. Overview & Data Controller

The data controller for personal data collected through this website is Alayer.AI LLC, 150 N Main #37, Wichita, KS 67202, United States. For questions about this policy or your personal data, contact us at privacy@alayer.ai.

This policy covers the personal data we collect, as a controller, from website visitors, buyers of our products, email subscribers and people who contact us with inquiries. If you are a client, information you or your organization share with us during a paid engagement is handled under that engagement's contract (including any data processing terms in it), not under this policy.

This policy explains your rights under the European Union (EU) General Data Protection Regulation (GDPR), the United Kingdom (UK) GDPR and United States (U.S.) state privacy laws where they apply to you.

2. Data We Collect

2.1 Data You Provide Directly

• Contact & inquiry data: Name, email address, company name, phone number, service interest, and message content when you complete our contact form.
• Partner program data: Business information, referral details, and payment information for Edge Alliance partners.
• Service delivery data: Contact details of the people we work with at a client. Documents and other information shared during a paid engagement are covered by that engagement's contract.
• Account data: Login credentials if you access any client portal or Aristotle AI tool.
• Purchase data: When you buy a readiness pack, we collect your name, email address, billing address and order details. Card payments are processed by Stripe; we do not see or store your full card number. Your name and a license number are stamped on the files you download, as described in our End User License Agreement (EULA).
• Free resource data: When you download a free checklist or template, we collect your work email address, first name and job title, which resource you downloaded and the date of your download. You can also choose to give your last name, company name, company size and the country where your company is headquartered. These extra details are optional.
• Email list data: If you tick a box to receive emails about new free templates or The Workflow Layer Digest newsletter, we record which lists you chose to join and a record of your consent: the date and time you clicked the link in our confirmation email, and the Internet Protocol (IP) address used when you clicked it.

2.2 Data Collected Automatically

• Usage data: Pages visited, time on site, referring web address (uniform resource locator, URL), and browser/device type — collected via analytics tools.
• Cookie data: See our Cookie Policy for full details.
• Server logs: IP addresses, access timestamps, and error logs retained for security purposes.
• Order records: When you place an order, our store records the IP address and browser type (user agent) used at checkout, and keeps them with the order.

2.3 Data from Third Parties

• Partner referral information provided by Edge Alliance partners.
• Professional profile information from LinkedIn where relevant to business relationships.

3. How We Use Your Data

Purpose	Data Used	Legal Basis
Responding to inquiries and providing quotes	Contact data, service interest	Legitimate interest / Contract
Delivering audit and compliance services	Service delivery data, contact data	Contract performance
Processing and delivering your order, and licensing your files	Purchase data	Contract performance
Preventing fraud and keeping accurate order records	Order IP address, browser type	Legitimate interest
Processing Edge Alliance partner commissions	Partner data, payment information	Contract performance
Improving our website and services	Usage data, analytics	Consent for visitors from the European Economic Area (EEA), the UK and Canada; legitimate interest elsewhere, and you can opt out at any time
Providing the free resource you requested, keeping a record of the download, and finding your record if you ask us to delete it	Work email, resource downloaded, download date	Legitimate interest / steps you asked us to take
Knowing who downloaded our free resources and which roles use them, so we know which to improve or write next	First name, job title	Legitimate interest
Understanding which organizations use our free resources, their size and where they are based, to decide what to cover next	Optional details you choose to give: last name, company name, company size, company headquarters country	Legitimate interest
Emailing you when new free templates are available (only if you tick that box)	Email list data	Consent
Sending The Workflow Layer Digest newsletter (only if you tick that box)	Email list data	Consent
Keeping a record of your consent	Consent record (confirmation date and time, IP address)	Legal obligation / Legitimate interest
Legal obligations and dispute resolution	All relevant data	Legal obligation
Security and fraud prevention	Server logs, IP addresses	Legitimate interest

4. Legal Basis for Processing (GDPR)

Under GDPR and UK GDPR, we process your personal data on the following legal bases:

• Contract (Art. 6(1)(b)): Processing necessary to perform services you have engaged us for.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests (responding to inquiries, providing free resources you request and understanding who uses them, improving services, security), where these don't override your rights.
• Consent (Art. 6(1)(a)): Analytics and marketing cookies (including our store's order attribution cookies) for visitors from the EEA, the UK and Canada, template-alert emails and The Workflow Layer Digest newsletter, where you have actively opted in. You can withdraw consent at any time with the unsubscribe link in any email or by contacting us; this does not affect emails sent before you withdrew.
• Legal Obligation (Art. 6(1)(c)): Where processing is required to comply with applicable law.

5. Data Sharing & Disclosure

We do not sell your personal data, and we do not share it for cross-context behavioral (targeted) advertising. We may disclose data to:

• Service providers: Hosting, analytics, email delivery, and customer relationship management (CRM) tools used to operate our business, under data processing agreements.
• Email service provider: We use Brevo to keep the record of free resource downloads, send our emails and manage our mailing lists. Brevo processes your free resource data and email list data on our behalf under a data processing agreement.
• Website hosting: Our website and the data collected through it are hosted by Hostinger, under a data processing agreement.
• Payment processor: Stripe processes card payments for us.
• Edge Alliance partners: Only the data necessary to facilitate referral relationships and commission payments.
• Legal authorities: Where required by law, court order, or to protect rights and safety.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.

6. Data Retention

• Inquiry / contact data: 3 years from last contact, unless a service relationship develops.
• Engagement contact data: 7 years from completion of engagement (to meet professional and legal retention requirements). Retention of engagement documents is set in the engagement contract.
• Partner data: Duration of partnership plus 7 years for financial records.
• Purchase and order records (including order IP address and browser type): 7 years from purchase, for tax and accounting records.
• Email list data: Kept while you remain subscribed. When you unsubscribe, we stop emailing you and keep your email address on a suppression list so we never email you again by mistake. We keep the rest of your record, including your consent record, for 3 years after you unsubscribe, and delete it at our next quarterly review after that. Your email address stays on the suppression list.
• Free-download contacts not on any of our mailing lists: Deleted 12 months after your latest download.
• Mailing-list sign-ups never confirmed: If you tick a box to join one of our mailing lists but don't click the link in our confirmation email, we don't add you to that list. Our email provider keeps a log of the confirmation email we sent (your email address and when it was sent). We delete these logs at a monthly review, within 60 days of sending. Your download record is kept as described for free-download contacts.
• Website retry queue: If our email provider can't be reached when you send a form, our website keeps the details you gave (including your email address and any boxes you ticked) so it can pass them on. We delete them as soon as they reach our email provider, or after 14 days, whichever comes first.
• Analytics data: Google Analytics keeps detailed event data for 2 months and data linked to a cookie or device identifier for 14 months after your last visit, and then deletes it automatically. Our reports use aggregated data.
• Server logs: 90 days.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure ("right to be forgotten"): Request deletion of your data (subject to legal retention obligations).
• Restriction: Request that we restrict processing of your data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@alayer.ai. We will respond within one month under the GDPR and UK GDPR, which we may extend by up to two further months where the law allows, or within 45 days for U.S. state requests (see below). We may need to confirm your identity before acting on a request.

You also have the right to lodge a complaint with your supervisory authority (e.g., the Information Commissioner's Office (ICO) in the UK, your national data protection authority (DPA) in the EU).

U.S. State Privacy Rights

Several U.S. states give their residents rights over their personal data. Wherever you live in the United States, we will honor these requests:

• Know and access: Ask what personal data we hold about you and get a copy.
• Delete: Ask us to delete your personal data, subject to records we must keep by law (see Data Retention).
• Correct: Ask us to correct inaccurate personal data.
• Opt out: Opt out of the sale or sharing of your personal data, targeted advertising and profiling. We do not sell or share personal data or use it for targeted advertising, but you can still send us an opt-out request and we will record it. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out request for that browser.

To make a request, email privacy@alayer.ai with the subject line "Privacy Request". We will confirm your identity by matching details we already hold, such as the email address used for your order. Someone you authorize may make a request for you if they provide your signed permission. We will respond within 45 days. If we need more time, we will tell you why, and we may extend this once by up to 45 more days. We will not treat you differently for making a request.

Appeals: If we decline your request, you may appeal by replying to our decision with the subject line "Privacy Appeal". We will respond to your appeal in writing within 45 days and explain our reasons. If you are not satisfied, you may contact your state attorney general.

8. Cookies

We use cookies and similar technologies on our website. For full details of the cookies we use, their purpose, and how to manage your preferences, please see our Cookie Policy.

We use Google Analytics and Jetpack Stats to understand how visitors use our website. How we ask for your choice depends on where you are, which we estimate from your IP address:

• European Economic Area (EEA), United Kingdom and Canada: our site is set up so that analytics and marketing cookies stay off until you accept them in our cookie banner. Because we estimate your location from your IP address, if that estimate places you outside these regions (for example, when you use a virtual private network), the rules for the United States and other regions apply instead, and you can still turn cookies off at any time or send a GPC signal. In rare cases, for example when Google's estimate of your location differs from ours, Google Analytics may set its cookies for a few seconds before our site removes them.
• United States and other regions: we do not ask for your choice before analytics runs or marketing cookies are set. You can turn analytics and marketing cookies off at any time through "Manage Cookie Preferences" at the bottom of every page. This turns off analytics and marketing cookies and deletes the ones our site has already set in your browser. After that, Google Analytics sends only limited information without cookies, as described below.
• Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a choice to turn off analytics and marketing cookies, wherever you are, unless you later accept them in our cookie banner.

Google Analytics uses Google Consent Mode. In the EEA, the United Kingdom and Canada until you accept analytics cookies, whenever your browser sends a GPC signal, and anywhere after you turn analytics cookies off, Google Analytics does not set or read cookies. It still sends Google limited information without cookies, such as the page you visited, the time, the referring page, how far you scrolled, basic browser and device details (for example browser type, language and screen size) and a random identifier that changes each time you load a page. On the page where you turn analytics off, Google Analytics may keep using the identifier it already had until you leave or reload that page. Your IP address also reaches Google when this information is sent. In the United States and other regions, if you have not made a choice, Google Analytics sets its cookies when the page loads, and our site tells Google not to use the data for advertising or ad personalization.

Our store software (WooCommerce, with Jetpack, both from Automattic) also sets two first-party cookies or sets of cookies. tk_ai is a random identifier that WooCommerce Analytics uses to count visits to our store and how it is used; it expires after 1 year, and store usage information linked to it is sent to Automattic only if our cookie banner allows analytics. sbjs_* cookies (WooCommerce order attribution) remember how you arrived at our site, such as the referring site, the campaign tags in the link you followed, the page you landed on, your number of visits and your browser type. Most of them are deleted when you close your browser, and sbjs_session expires after 30 minutes. This information reaches us only if you place an order, and we then keep it with your order record (see Data Retention). We do not use it for advertising. tk_ai follows your analytics choice: in the EEA, the United Kingdom and Canada it is not set until you accept analytics cookies, and it is not set if your browser sends a GPC signal. If you turn analytics cookies off, it is deleted and no longer used. The sbjs_* cookies follow your marketing choice, not your analytics choice: in the EEA, the United Kingdom and Canada they are not set until you accept marketing cookies, they are deleted if you turn marketing cookies off, and they are not set if your browser sends a GPC signal.

When you send our free checklist form, we set a strictly necessary cookie, alayer_ft_access, that keeps the checklist open in this browser so you don't have to fill in the form again. It is signed, can't be read by scripts, does not contain your email address and expires after 180 days.

We use Google reCAPTCHA to protect our forms from spam and Google Fonts to display text. Both load on every page of our website, so each time a page loads your browser connects to Google, which receives your IP address and browser details. reCAPTCHA also uses information about your device and how you interact with the page to tell people apart from automated programs.

9. Security

We apply rigorous security controls to protect your personal data, including:

• Secure Sockets Layer / Transport Layer Security (SSL/TLS) encryption for all data in transit
• Access controls and role-based permissions
• Regular security assessments aligned with International Organization for Standardization (ISO) 27001
• Staff training on data protection and security
• Incident response procedures

No method of transmission over the internet is 100% secure. In the event of a breach affecting your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

10. International Data Transfers

Alayer.AI LLC is based in the United States, and we process personal data in the United States. If you are in the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, the personal data you give us, for example through our website forms, by email or when we invoice a business purchase, comes to us directly in the United States.

Our service providers may process personal data in the United States, the EEA or other countries. They do so under data processing agreements that include the Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum (UK Addendum) where these apply.

You can ask us for more information about these safeguards by contacting us at privacy@alayer.ai.

11. Contact Us & Updates

For privacy-related inquiries, requests, or complaints:

For U.S. state privacy requests: Please email privacy@alayer.ai with the subject line "Privacy Request" and we will respond within 45 days (see Your Rights).

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated by posting a notice on our website.