01Scope and roles
This Data Processing Addendum (the “DPA”) forms part of the Terms of Service between you (the “Customer”) and Layrcake (the “Provider”) and applies whenever we process personal data on your behalf in providing the Service. It applies automatically; you do not need to sign it. If you require a countersigned copy for your records, email founders@layrcake.dev.
For Customer Content and Recipient Data, as defined in our Privacy Policy, you are the controller and we are the processor. For your account, keys, ledger and billing records we are an independent controller, and this DPA does not apply.
We do not use Customer Content to build a database of our own, and we never make one customer’s Recipient Data available to another customer.
“Data Protection Law” means the UK GDPR and Data Protection Act 2018, the EU GDPR, and any other privacy law applicable to the processing. Terms defined in Data Protection Law have the same meaning here.
02Processing on your instructions
We process personal data only on your documented instructions, which are: the Terms, this DPA, and the API calls made with your keys, including calls made by agents you have connected. We will inform you if, in our opinion, an instruction infringes Data Protection Law, and may suspend that instruction until it is resolved.
We may process personal data otherwise than on your instructions only where required by law, in which case we will tell you before processing unless the law prohibits it.
Suppression records are maintained under our own legal obligation to honour opt-outs and are retained after this DPA ends; you agree that this is a lawful instruction.
You also instruct us to: add a short opt-out line, in the wording you choose from those the Service offers or your own, to the first email of every sequence; flag recipients in countries where business email needs prior consent before a launch, and record your choice; apply the platform-wide block list described in Assistance; and delete Customer Content on the retention schedule in our Privacy Policy.
03Confidentiality
We ensure that every person we authorise to process personal data is bound by an appropriate duty of confidentiality, and that production access is limited to personnel with a demonstrated need.
04Security
We implement the technical and organisational measures described in Annex 2, and we keep them under review. We may update them, provided the level of protection does not decrease.
05Sub-processors
You give general written authorisation for us to engage the categories of sub-processor listed in Annex 3, and the named providers within them. The current named list is available on request from founders@layrcake.dev.
We will give you at least 14 days’ notice by email before adding or replacing a sub-processor that processes Customer Content. If you have a reasonable objection on data protection grounds, tell us within that period and we will work with you in good faith; where no resolution is possible, you may close your account and receive a refund of unspent purchased credits.
We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain liable to you for their performance.
06International transfers
We may transfer personal data outside the UK and the EEA only under a lawful transfer mechanism: an adequacy decision, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor, as appropriate), together with any supplementary measures a transfer risk assessment requires. Where the Clauses apply between us, they are incorporated by reference, with you as data exporter and us as data importer, and the details in Annex 1 completing their annexes.
07Assistance
Taking into account the nature of the processing, we will assist you, by appropriate technical and organisational measures, in responding to data subject requests, and in meeting your obligations regarding security, breach notification, data protection impact assessments and prior consultation.
Where a data subject asks us directly to erase their personal data, you instruct us, once we have confirmed the request comes from the person concerned, to erase it from your workspace, to delete their records from our sending infrastructure provider, and to add their address to a platform-wide block list so that it cannot be contacted through the Service again. We record the erasure in your workspace. Where a data subject tells us that an email sent through the Service was spam, we add their address to the same list. Any other request from a data subject that reaches us directly is forwarded to you without undue delay.
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Content, and will provide the information reasonably needed for your own notifications as it becomes available.
08Return and deletion
You may export your Customer Content through the API and the Console at any time. While your account is open, Customer Content is deleted on the retention schedule in our Privacy Policy.
When you ask us to close your account, it stays open for 30 days so that you can change your mind, then closes. We erase Customer Content within 7 days of closing, except suppression records, the platform-wide block list and any data we are required by law to retain, which we continue to protect under this DPA for as long as we hold it.
09Audit
We will make available the information reasonably necessary to demonstrate compliance with Article 28, including a description of our measures, our sub-processor list and summaries of any independent assessments we hold. Where that information is insufficient to meet a requirement of Data Protection Law, we will allow an audit by you or an independent auditor bound by confidentiality, no more than once in any 12 months, on at least 30 days’ notice, during business hours, in a manner that does not disrupt the Service or compromise other customers, at your cost.
10Liability and precedence
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms. Where this DPA conflicts with the Terms on a data protection matter, this DPA prevails; where it conflicts with the Standard Contractual Clauses, the Clauses prevail.
11Annex 1 — Details of the processing
| Subject matter | Provision of the Layrcake Service: lead discovery, contact enrichment, email verification, company signals, sending capacity, campaign drafting and launch, reply handling and LLM passthrough, executed on the Customer’s instructions. |
|---|---|
| Duration | For as long as the Customer holds an account, subject to the retention schedule in the Privacy Policy, plus the closing and deletion periods in the Terms. |
| Nature and purpose | Retrieval, storage, enrichment, verification, transmission and classification of business contact data for the Customer’s own outbound sales and marketing. |
| Categories of data subject | The Customer’s prospects, leads and correspondents (business contacts in their professional capacity); the Customer’s own users. |
| Categories of personal data | Name, job title, employer, work email address, work telephone number, professional profile URL, company and role signals, email content and reply content, deliverability status, opt-out status. |
| Outcome record | On the Customer’s behalf, Layrcake keeps a per-workspace, append-only record of the moments in each contact’s journey (verification verdict, admission to or removal from a draft, approval lifecycle, launch, reply, bounce, opt-out, pause, reply sent), holding for each recipient only the work email address and its domain, never names, message bodies or provider identifiers. Events are retained for 24 months; the address and domain are removed 24 months after last contact or on erasure. After an erasure request, an opaque workspace-specific keyed token remains for the life of the workspace solely to prevent reintroduction of the erased address. The record is the Customer’s and is readable by the Customer through the API. It is never combined with another customer’s record, except to produce anonymous company-level totals (how many people at a company were emailed, replied, bounced, opted out or complained), which are shown to other customers only when at least three customers contributed and no one customer makes up more than half of a total, and which never include names, email addresses, message content or which customers contributed. |
| Special category data | None. The Customer must not submit it. |
| Frequency | Continuous, as the Customer’s agents call the API. |
| Competent supervisory authority | The Information Commissioner’s Office (UK), or the authority of the Customer’s EEA establishment where EU GDPR applies. |
12Annex 2 — Technical and organisational measures
- Encryption: TLS for all data in transit; encryption at rest for databases and backups; backups additionally encrypted with a key held outside the storage provider.
- Authentication: no stored passwords; single-use emailed sign-in links or codes, or Google sign-in; API keys stored only as one-way hashes, scoped per verb, with optional spend limits; OAuth grants revocable from the Console.
- Authorisation and human control: server-enforced human confirmation before any purchase of sending capacity or campaign launch; suppression applied at draft, re-checked at launch and propagated to live campaigns.
- Integrity and accountability: append-only credit ledger; append-only audit log of administrative actions, including the actor and the authentication method; append-only per-workspace outcome record of what each agent did, enforced at the database so that no event can be edited or deleted outside the scheduled retention run.
- Resilience: encrypted backups every 12 hours held in two independent locations, with point-in-time recovery on the primary database and tested restores; every backup is deleted within 90 days of being taken, and an alert fires before a backup could fail to send.
- Data minimisation and retention: saved request results and the contact cache are deleted 90 days after they are made; campaign leads, replies and sent replies 12 months after the campaign ends; processed webhook logs after 30 days; the deletions run every day.
- Erasure and opt-outs: one erasure request removes a person from every workspace and from the sending infrastructure provider; a platform-wide block list stops erased and complaining addresses from being contacted again; replies asking to stop are suppressed automatically; the first email of every sequence carries an opt-out line.
- Outreach safeguards: recipients in countries where business email needs prior consent are flagged before launch, and the Customer’s choice is recorded.
- Account closure: a closed account’s Customer Content is erased within 7 days of closing, across every data store, with billing records kept for six years as UK tax law requires.
- Isolation: every resource is namespaced to a workspace; provider references are never exposed to customers; lookups run only through mapping tables.
- Containment: the ability to pause every campaign in a workspace, confirmed with the sending provider, within minutes of an abuse or compromise signal.
- Least privilege and change control: production changes ship only through the deployment pipeline from committed, reviewed code; irreversible operations require founder approval and a verified backup.
- Sub-processor management: written contracts, category disclosure, named list on request, 14 days’ notice of change.
13Annex 3 — Authorised sub-processor categories
| Category | Purpose | Location |
|---|---|---|
| Business-data providers (lead search, enrichment, verification, social posts, signals) | Answering data verbs on the Customer’s instruction | United States, EU, UK, Canada, Australia, New Zealand, India |
| Web research providers (search and page retrieval) | Researching companies on the Customer’s instruction | United States |
| Sending infrastructure provider | Domains, mailboxes, warming, sending and reply retrieval | United States |
| AI model providers (Anthropic, OpenAI, TypeSafe) via an AI model routing provider | LLM passthrough, and the checks the Service runs on the Customer’s results | United States |
| Payment processing (Stripe) | Credit purchases | United States, EU |
| Cloud hosting, database and backup providers | Running the Service and storing data | United States |
| Code hosting and deployment provider | Running the automated checks and deployments that change production systems | United States |
| Email delivery providers | Sign-in links, notifications and service email to the Customer | United States |
The named list of current providers within each category is available from founders@layrcake.dev.