Privacy Policy

Last Updated: March 30, 2026

Layer UI, a wholly-owned division of BamCor Digital LLC ("Company," "we," "us," or "our"), operates Skyline (layerui.io/skyline). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service. By accessing or using the Service, you agree to the practices described in this policy.

This policy applies to all users of Skyline, including residents of California whose rights are additionally protected under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA").

1. Information We Collect

1.1 Information You Provide Directly

  • Account registration data (name, email address, password via Clerk)
  • Billing and payment information (processed and stored by Stripe; we do not store full card numbers)
  • Workspace content you create or upload: chat messages, files, documents, task data, whiteboard data
  • Communications you send to us, including support requests

1.2 Information Generated Through Your Use

  • AI-generated metadata created as a result of using AI Features (summaries, embeddings, transcriptions)
  • Usage logs, session data, feature interaction records, and audit logs
  • Device information (browser type, operating system, IP address, device identifiers)
  • Cookies and similar tracking technologies (see Section 6)
  • Behavioral usage data — including login frequency, feature activation events (messages sent, files uploaded, tasks created/completed, pages viewed), and session recency. This data is used to calculate an internal account health score to assess product engagement, inform customer success outreach, and improve retention. Retention period: 12 months from collection. GDPR lawful basis: legitimate interests (B2B accounts). To opt out of behavioral profiling for marketing purposes, email privacy@layerui.io.

1.3 Information from Third-Party Services

When you authenticate via Clerk, we may receive profile information such as your name and email address. If you connect third-party integrations, we collect data necessary to power those integrations.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • To provision, operate, and maintain your Workspace and the Service
  • To process payments and manage your Subscription via Stripe
  • To authenticate your identity and secure your account via Clerk
  • To power AI Features including chat assistance, audio transcription, and semantic search
  • To respond to support requests, questions, and communications
  • To send transactional communications (account confirmations, billing notices, security alerts)
  • To send product updates, newsletters, and promotional content (you may opt out at any time)
  • To analyze usage patterns and improve the Service
  • To calculate account health scores and send proactive customer success outreach (based on engagement signals described in Section 1.2)
  • To send NPS (Net Promoter Score) surveys to measure customer satisfaction (opt-out available in account settings)
  • To detect, prevent, and investigate fraud, abuse, and security incidents
  • To comply with applicable legal obligations
  • To enforce our Terms of Service

We do not sell your personal information to third parties. We do not use your Workspace Content (chat messages, files, tasks) to train AI models.

3. How We Share Your Information

3.1 Service Providers (Sub-Processors)

We share data with the following third-party service providers strictly as necessary to operate the Service:

ProviderData SharedPurpose
AnthropicMessage content sent to AI chatAI language model processing
OpenAIAudio files for transcriptionWhisper transcription feature
PineconeText embeddings (anonymized vectors)Semantic search indexing
StripeBilling info, email, IP addressPayment processing
ClerkEmail, authentication tokensIdentity and session management
SupabaseAll workspace dataDatabase and file storage
VercelRequest data, IP addressHosting and delivery

3.2 Legal Requirements

We may disclose your information if required to do so by law, court order, subpoena, or governmental authority, or if we reasonably believe disclosure is necessary to: (a) comply with legal process; (b) protect the rights, property, or safety of Layer UI, our users, or the public; or (c) detect, prevent, or address fraud, security, or technical issues.

3.3 Business Transfers

In the event of a merger, acquisition, asset sale, or other business transfer, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service prior to your information becoming subject to a different privacy policy.

3.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

  • Active accounts: Data is retained for the duration of your account and Subscription.
  • Post-termination: Workspace data is retained for 30 days following account termination to allow for data export. After 30 days, Workspace Content is permanently deleted from our primary systems.
  • Billing records: Payment and transaction records are retained for 7 years as required by applicable tax and financial regulations.
  • AI metadata: Vector embeddings and AI-generated metadata are deleted when the associated Workspace Content is deleted.
  • Backup systems: Deleted data may persist in encrypted backup systems for up to 90 days before being permanently purged.

5. Data Security

We implement industry-standard technical and organizational security measures to protect your information, including:

  • Encryption of data in transit using TLS 1.2 or higher
  • Encryption of data at rest in Supabase databases
  • Secure authentication via Clerk with support for multi-factor authentication
  • Access controls limiting employee access to user data on a need-to-know basis
  • Regular security reviews of our infrastructure and dependencies

Despite these measures, no system is 100% secure. We cannot guarantee the absolute security of your information. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable California law (California Civil Code Section 1798.82) within the required timeframes.

6. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

  • Essential Cookies: Required for authentication (Clerk session tokens) and core Service functionality. These cannot be disabled.
  • Analytics Cookies: We use PostHog to collect anonymized usage analytics to understand how users interact with the Service and to improve product features.
  • Performance Cookies: Used to monitor Service performance and detect errors.

You may configure your browser to block or delete cookies; however, doing so may impair Service functionality. We do not currently respond to browser "Do Not Track" signals, though we will update this policy if we adopt such a practice.

7. AI Features and Your Data

When you use AI Features, your Content (including chat messages, uploaded files, and audio) may be transmitted to our AI providers (Anthropic, OpenAI, Pinecone) to generate responses, transcriptions, and embeddings. These providers process your data in accordance with their respective privacy policies and our data processing agreements with them.

We do not use your Workspace Content to train AI models, and we contractually prohibit our AI providers from using your data for model training purposes where permitted by their enterprise agreements.

AI-generated outputs (including summaries, suggestions, and transcriptions) may be stored as part of your Workspace data subject to the same retention and deletion policies as other Content.

You should not input into AI Features any information that is: (a) legally privileged; (b) subject to confidentiality obligations; (c) personally identifiable health information regulated by HIPAA; or (d) financial information regulated by applicable law, unless you have assessed the applicable legal requirements and accepted the associated risks.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.

Right to Delete

You have the right to request deletion of your personal information that we have collected, subject to certain exceptions (e.g., information necessary to complete a transaction, comply with a legal obligation, or detect security incidents).

Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing

We do not sell your personal information and do not share it for cross-context behavioral advertising. If this practice changes, we will update this policy and provide an opt-out mechanism.

Right to Limit Use of Sensitive Personal Information

To the extent we process sensitive personal information, you have the right to limit its use to purposes permitted by the CPRA.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you services, charge different prices, or provide a different quality of service because you exercised a privacy right.

How to Submit a CCPA/CPRA Request

To exercise any of the above rights, submit a verifiable consumer request to: serge@skylinetg.us with the subject line "California Privacy Request." We will respond within 45 days. If we need more time (up to 90 days total), we will notify you in writing. We may need to verify your identity before processing your request.

Categories of personal information collected in the last 12 months: Identifiers (name, email, IP address), commercial information (subscription and billing records), internet activity (usage logs, session data), and inferences drawn from usage data to personalize the Service.

9. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us personal information, please contact us at serge@skylinetg.us and we will take steps to delete that information.

10. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States where our servers and service providers are located. U.S. privacy laws may differ from the laws of your country.

If you are located in the European Economic Area (EEA) or United Kingdom, you may have rights under the General Data Protection Regulation (GDPR) or UK GDPR. We are in the process of implementing GDPR compliance measures. For any GDPR-related requests, please contact us at serge@skylinetg.us.

11. Your Choices and Controls

  • Email communications: You may opt out of promotional emails by clicking "unsubscribe" in any marketing email or by contacting us. You cannot opt out of transactional emails (billing confirmations, security alerts).
  • Account data: You may access and update most account information through your account settings.
  • Data export (GDPR Article 20): Download a machine-readable copy of all your personal data at any time from Settings › Privacy & Data or by submitting a request to privacy@layerui.io. We respond within 30 days.
  • Account deletion: You may request deletion of your account and associated data by contacting us. See Section 4 for retention timelines.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and provide notice via email or an in-app notification. We encourage you to review this policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

Contact Us

For privacy-related questions, requests, or concerns, contact our privacy point of contact:

Layer UI / BamCor Digital LLC

Attn: Privacy

3315 Cherokee Trail

Loomis, CA 95650

Email: serge@skylinetg.us

Website: layerui.io/skyline

We will respond to all verifiable requests within 45 days as required by California law.

Layer UI — AI Business Software for Small Teams