Privacy Policy

01Who we are

Layrcake (“Layrcake”, “we”, “us”, “our”) provides go-to-market infrastructure for AI agents. Through one API key and one prepaid credit balance, your agents and software can find business leads, check buying intent, enrich contacts to verified work emails, verify deliverability, provision warmed sending capacity, draft and launch outbound email campaigns, read replies, and call large language models (together, the “Service”).

Layrcake is registered in the United Kingdom.

In relation to your account, your API keys, your credit balance, billing records and correspondence with us, we act as a data controller. In relation to the audiences, lead lists, campaign content, replies and other material you or your agents submit to or retrieve through the Service (“Customer Content”), we act as a data processor and process it on your documented instructions. Our Data Processing Addendum sets out those terms.

If you have a question about this policy, or wish to exercise a right described in it, contact founders@layrcake.dev.

02Scope of this policy

This policy governs all personal data processed in connection with the Service, namely:

• our marketing website at layrcake.dev and our documentation at docs.layrcake.dev;
• the console at app.layrcake.dev (the “Console”);
• the API at api.layrcake.dev and the hosted MCP server at mcp.layrcake.dev (together, the “API”); and
• the emails and notifications we send you about your account.

Layrcake is a business-to-business service. We do not market or sell to consumers, and the Service is not intended for personal or household use.

This policy does not apply to the AI assistants, coding agents, workflow tools or other software you connect to the API, or to the third-party websites we link to. Those services operate under their own privacy notices, which you should review before connecting them.

03Personal data we collect

We collect personal data directly from you when you create an account, create an API key, top up credits or contact us; automatically when you or your agents use the API and the Console; from third parties where you authorise a connection, for example when you sign in with Google; and from our data providers when your agents ask the API for business contact information.

Account data

Your email address, the name of your workspace, your email verification status and the date of your most recent sign-in. We hold no passwords. You sign in with a one-time link or code sent to your email, or with Google. Where you sign in with Google, we receive your Google account identifier, name, email address and profile image.

API keys and OAuth grants

The keys you create, stored only as a one-way cryptographic hash together with a name, scopes, spend limits and last-used time. The full key is shown to you once, at creation, and cannot be recovered by anyone at Layrcake. Where you connect an AI assistant through OAuth, we store the client’s registration details and the grants you approve.

Customer Content

The audiences you describe, the lead lists and company domains you submit, the campaigns and email copy you or your agents draft, the replies received by the mailboxes leased to you, and the prompts and completions passed through the LLM endpoint. Customer Content ordinarily contains the personal data of the business contacts you are prospecting (“Recipient Data”): typically name, job title, employer, work email address, work telephone number, professional profile URL and the company signals associated with them.

Provider Data

When your agent calls a data verb, we retrieve Recipient Data from specialist business-data providers on your instruction and return it to you. Each provider is an independent controller of its own database. Once returned to you, that data forms part of your Customer Content and you are responsible for it as controller.

Usage and ledger data

A record of every API request: the verb called, the key used, the parameters and result summary, the outcome (hit, miss or error), the credits charged and the immutable ledger entry that settled the charge. Your balance is derived from that ledger and nothing else.

Billing data

Your Stripe customer and checkout identifiers, the credits you purchased and the amounts paid. We never receive or store card numbers. Payment credentials are collected and held by Stripe, which acts as an independent controller for its own compliance purposes.

Suppression data

The email addresses of people who replied, unsubscribed or bounced, held so that they are never contacted again from your workspace. Where a person asks us to erase their data, or tells us they have reported an email sent through the Service as spam, we also hold their address on a platform-wide block list, so that no customer can contact them through the Service again. The block list holds only the address and the reason.

Outcome record

A per-workspace diary of what your agents did and what happened next, so that you can account for every contact made in your name. For each event we record the kind of moment (an email verified, a recipient admitted to or removed from a draft, an approval requested, granted, declined or used, a campaign launch requested, confirmed or failed, a reply, bounce or opt-out received, a campaign paused, a reply sent), when it happened, which of your keys or users acted where applicable, and references to the campaign, request and lead within your workspace. Recipients appear only as a work email address and its domain; we never store recipient names, message bodies, reply text or our providers’ identifiers in the record. After a valid erasure request, the address and domain are removed and only an opaque, workspace-specific keyed token remains so that a later event cannot put the address back. The record is held separately for each customer. The one exception is anonymous company-level totals: across all customers, we count how many people at a company were emailed, replied, bounced, opted out or complained, and show those totals to other customers. A total is shown only when at least three customers contributed and no one customer makes up more than half of it. It never includes names, email addresses, message content or which customers contributed. You can read your own record through the API on a key that carries the trail:read scope, at no credit cost.

Technical data

Session cookies, IP address, browser and device characteristics, and the server logs generated when you use the Console or the API.

How you found us, and how you use our website

When you arrive at our website from an advertisement, the link carries the campaign, ad group and keyword that brought you and, for Google Ads, Google’s click identifier. If you go on to create an account, we record those values against your workspace so that we know which advertising works. We do this whether or not you accept cookies; if you decline, that record is used for our own reporting only and is never sent to Google.

If you accept cookies, or where the rules under Cookies allow it without asking, we also set one first-party cookie (lc_sid, a random identifier with nothing personal in it) and record the pages you view on our website and the “Get your free key” links you click, so that we can see which pages help people decide. Once you create an account that browsing history is linked to your workspace. With your acceptance, or in the United States, Canada outside Quebec, Australia and New Zealand unless you decline, we also tell Google Ads when a workspace that came from a Google click creates its first API key or buys credits, so Google can measure our advertising; that report carries the click identifier and, for purchases, the amount — never your name, email or content.

On the same basis as Google’s tag, a website analytics provider records how visitors move through our website and the free-key sign-up page (clicks, scrolling and what the page showed) so that we can see where a page confuses people. Anything you type is masked in your browser and never recorded, and no other part of the Console is recorded.

Whatever you choose about cookies, our website and Console send an anonymous count of how far a visit gets: a page viewed, the Claude Code setup prompt copied, the sign-in page opened, an email or code submitted, setup reached, a connection approved. Each count carries only the step, whether the visit came from an advertisement, and which of our pages it started on. No cookie is read or set for it and nothing in it identifies you; we keep only daily totals. New accounts may also tell us where they found Layrcake with one optional tap; the answer is stored with the workspace and used only to understand which channels work.

We do not request special category data within the meaning of Art. 9 UK GDPR — including data revealing health, racial or ethnic origin, political opinions or biometric identifiers — and you must not submit it to the Service.

04Purposes and legal bases

We process personal data only where a lawful basis under Art. 6(1) UK GDPR applies. Each purpose and its basis is set out below.

• Providing the Service you have signed up for, including executing your agents’ API calls and returning Provider Data on your instruction. Legal basis: performance of a contract (Art. 6(1)(b)).
• Charging credits, taking payment, issuing receipts and preventing payment fraud. Legal basis: performance of a contract (Art. 6(1)(b)); compliance with a legal obligation (Art. 6(1)(c)).
• Honouring opt-outs by maintaining suppression lists so that a person who has replied, unsubscribed or bounced is never contacted again from your workspace, and a person who has asked us to erase their data or reported spam is never contacted again through the Service. Legal basis: compliance with a legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)), namely protecting recipients and sender reputation.
• Telling recipients where their details came from and how to stop, by adding a short opt-out line to the first email of every sequence, and flagging recipients in countries where business email needs prior consent before a campaign launches. Legal basis: legitimate interests (Art. 6(1)(f)), namely protecting recipients and helping our customers meet their own transparency and marketing obligations.
• Maintaining the security, availability and integrity of the API, including rate limiting, abuse detection and pausing campaigns that present a risk. Legal basis: legitimate interests (Art. 6(1)(f)).
• Keeping the outcome record so that you can see, and if necessary demonstrate, what your agents did with each contact, which approvals were given and what the result was. Legal basis: performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)), namely accountability for automated outreach and protection of recipients and sender reputation.
• Responding to support requests and other correspondence. Legal basis: performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)).
• Improving the Service using aggregated statistics that do not identify you, your contacts or your campaigns. Legal basis: legitimate interests (Art. 6(1)(f)).
• Measuring which pages and which advertising lead people to Layrcake, as described under Cookies. Legal basis: consent (Art. 6(1)(a)) where you accept; where our rules allow measurement without asking (the United Kingdom for our own statistics; the United States, Canada outside Quebec, Australia and New Zealand), legitimate interests (Art. 6(1)(f)) in understanding what works, which you can object to at any time with one tap on Decline or with your browser’s Global Privacy Control signal.
• Sending service communications, including sign-in links, approval requests, low-balance and upkeep notices, security notices and billing notices. Legal basis: performance of a contract (Art. 6(1)(b)).
• Sending marketing communications. Legal basis: consent (Art. 6(1)(a)), or legitimate interests (Art. 6(1)(f)) where you are an existing business customer. Every marketing email carries an unsubscribe link, which we honour immediately.
• Meeting tax, accounting, audit and other statutory obligations. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).

Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms and concluded that our processing is proportionate. You may object at any time, as described in Your rights.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

05Business contacts your agents work with

The Service exists to help you reach business contacts. That means Recipient Data flows through it, and it is important to be clear about who is responsible for what.

• You are the controller of the Recipient Data you retrieve, store, enrich and contact through the Service. You decide whom to prospect, what to say and whether to launch. You must have a lawful basis for that processing and comply with the marketing laws that apply to you and to your recipients, as our Acceptable Use Policy requires.
• We are your processor. We execute your instructions, store the results in your workspace, and do not use Recipient Data for our own purposes, except to maintain suppression and to keep the Service secure. We do not build a database of people. Recipient Data stays in the workspace of the customer it belongs to and is never shared with, or served to, another customer.
• Our data providers are independent controllers of the professional databases they maintain. We pass them the minimum needed to answer your query — typically a name and company domain, a professional profile URL or an email address — and return what they hold.
• Human approval is enforced. No agent can purchase sending capacity or launch a campaign without a person confirming it in the Console. Suppression is applied when a campaign is drafted, re-checked at launch, and applied to live campaigns when a reply, unsubscribe or bounce arrives.
• Every first email says how to stop. The Service adds a short line to the first email of every sequence telling the recipient that their details came from business data sources and that a one-word reply will stop further contact. Replies asking to stop are honoured automatically.
• Consent countries are flagged. Before a campaign launches, the Service flags recipients in countries where business email needs the recipient’s prior consent — Germany, the Netherlands, Italy, Spain, Poland, Denmark, Austria and Belgium — and records whether the customer chose to send to them or leave them out. Addresses at personal email providers are flagged too, because in the United Kingdom they usually belong to sole traders, who need to have consented.

If you are a business contact who has received an email sent through the Service, reply to it asking to stop and that sender will not contact you again. To have your details erased, contact founders@layrcake.dev from the address that received the email. Once we have confirmed the request comes from you, we erase your details from every customer workspace that holds them, delete your record from our sending infrastructure provider, and block the address so that no customer can contact you through the Service again. To learn what a Layrcake customer holds about you, contact us the same way and we will forward your request to the customer concerned, as controller.

06AI models and your data

The LLM endpoint forwards the prompts you send to large language models operated by Anthropic and OpenAI, through an AI model routing provider, and returns the completions. We record the model called, the token counts and the charge; we do not use your prompts or completions for any purpose other than delivering the response and settling the charge.

We procure these services on business API terms under which the provider does not use the data we submit to train its models.

Where you use Layrcake from inside an AI assistant or coding agent, that assistant’s provider processes your conversation under its own terms. We see only the API calls the assistant makes with your key.

AI output is probabilistic, and providers revise their models without notice. Nothing returned by a language model is warranted to be accurate, complete or current, and you remain responsible for anything you send. See AI output, agents and results in our Terms.

07Recipients and sub-processors

We disclose personal data to the service providers (“sub-processors”) that help us operate the Service. Each is engaged under a written contract restricting processing to our documented instructions and imposing confidentiality and security obligations at least equivalent to our own.

We name our AI model providers and our payment provider below. For competitive reasons we identify the remaining providers by category, as Art. 13(1)(e) UK GDPR expressly permits.

• AI model providers — Anthropic, OpenAI and TypeSafe, reached through an AI model routing provider. We submit the prompts you send to the LLM endpoint and collect the completions. The checks Layrcake runs for you, such as whether a web page found while researching a company is about that company, send them only the data the check needs.
• Payment processing — Stripe.
• Business-data providers — lead search, contact enrichment, email verification, social post and company-signal providers. We send them the query your agent makes and receive the Recipient Data they return.
• Web research providers — search and page-retrieval services we use to research companies on your instruction. We send them the query and receive public web pages.
• CRM and marketing email providers — managing sign-ups to our own newsletter and resources, and sending them.
• Integration provider — connecting our own advertising account to Google Ads for the measurement described under Cookies.
• Code hosting and deployment provider — storing our source code and running the automated checks and deployments that change our production systems.
• Business email and office software provider — our own mailboxes, including the address that receives privacy requests.
• Sending infrastructure provider — the provider through which we register domains, provision and warm mailboxes, send your campaigns and receive replies on your behalf. It holds your campaign content, recipient lists and reply threads for the mailboxes leased to you.
• Cloud hosting, database and backup providers — operating our website, the Console, the API and our stored data.
• Email delivery providers — transmitting our sign-in links, notifications and service communications to you.
• Website analytics provider — recording visits to our website and free-key sign-up page, with typed text masked, only under the rules in Cookies.
• Google Ads — advertising measurement, as described under Cookies. Google acts as an independent controller for the data its tag collects; see how Google uses data from sites that use its services.

If you require the named list of our current sub-processors — for example, to complete your own vendor assessment — email founders@layrcake.dev and we will provide it.

We also disclose personal data to our professional advisers, and to a regulator, court or law enforcement body where we are legally required to do so. In the event of a merger, acquisition or sale of assets, personal data may transfer to the acquirer, and this policy will continue to apply until we notify you otherwise.

08International transfers

Most of our sub-processors are established outside the United Kingdom, principally in the United States. Where personal data is transferred outside the UK or the European Economic Area, we rely on one of the following safeguards:

• an adequacy decision made by the UK Government or the European Commission;
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; or
• the EU Standard Contractual Clauses, supplemented by a transfer risk assessment where one is required.

Copies of the safeguards applicable to a particular transfer are available on request from founders@layrcake.dev.

09Retention

We retain personal data only for as long as is necessary for the purposes described in this policy, after which we delete or anonymise it.

Where we are required to retain data to establish, exercise or defend a legal claim, we will keep it for as long as that purpose requires and no longer.

10Security

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest;
• no stored passwords — sign-in is by single-use emailed link or code, or by Google;
• API keys stored only as one-way hashes, scoped to the verbs they may call, with optional spend caps;
• human confirmation, enforced at the server, before any purchase of sending capacity or launch of a campaign;
• an append-only credit ledger and an append-only audit log of administrative actions;
• encrypted backups taken every 12 hours and retained in two independent locations, with restores tested; and
• access controls limiting production access to personnel with a demonstrated need.

No system can be guaranteed secure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will notify you without undue delay where the risk to you is high.

11Your rights

Under UK and EU GDPR you have the right to:

• Access — obtain confirmation that we process your personal data, and a copy of it (Art. 15).
• Rectification — have inaccurate or incomplete data corrected (Art. 16).
• Erasure — have your data deleted where one of the statutory grounds applies (Art. 17).
• Restriction — require us to limit our processing in defined circumstances (Art. 18).
• Portability — receive the data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller (Art. 20).
• Object — object to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
• Withdraw consent — where processing is based on consent, withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, email founders@layrcake.dev. We respond within one month, which we may extend by up to two further months for complex or numerous requests, in which case we will tell you within the first month (Art. 12(3)). We do not charge a fee unless a request is manifestly unfounded or excessive.

If your request concerns Recipient Data held in a customer’s workspace, write from the address concerned. Once we have confirmed the request comes from you, we carry out an erasure request ourselves: we erase your details from every customer workspace that holds them and from our sending infrastructure provider, and block the address across the Service. Any other request is forwarded to the customer concerned, as controller.

You may also lodge a complaint with the Information Commissioner’s Office at ico.org.uk, or with your local supervisory authority in the EEA. We would ask that you raise the matter with us first so that we can resolve it.

12California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know what personal information we collect, to request its deletion or correction, to opt out of any sale or sharing of it, and not to be discriminated against for exercising those rights.

In the preceding 12 months we collected the following categories of personal information, in each case for the business purposes set out in Purposes and legal bases.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding 12 months. Google’s tag measures our own advertising and is never allowed to personalise ads on the basis of our notice; Decline or your browser’s Global Privacy Control switches the measurement off. We do not knowingly collect or sell the personal information of minors under 16.

To exercise these rights, email founders@layrcake.dev. You may use an authorised agent, in which case we will ask for written proof of authorisation and may verify your identity directly.

13Cookies

What we ask depends on where you are. When you first visit our website we work out, from your connection, which of three rules applies, and we remember only the rule, never your location:

• European Economic Area, Switzerland, Quebec, and anywhere we cannot place you: nothing of ours is stored until you accept. Accept and Decline carry equal weight.
• United Kingdom: our own first-party cookie counts which pages help, so that we can improve our website, as UK law allows for statistics of this kind; one tap on Decline stops it. Google’s advertising cookies are set only if you accept.
• United States, Canada outside Quebec, Australia and New Zealand: our own cookie and Google’s tag measure our website and our advertising unless you decline. Declining takes one tap, and we treat your browser’s Global Privacy Control signal as a decline. On this basis Google’s tag measures our advertising but never personalises ads.

An explicit choice always overrides these rules, and you can change your mind at any time from the Cookie settings link in the footer of every page and in the Console. If you reach the Console without first visiting our website, the first rule applies.

Strictly necessary

• lc_consent — remembers your choice (accept or decline), the date you made it and the version of this notice. Set on .layrcake.dev for 12 months. Contains no identifier. If a withdrawal cannot reach our servers, a temporary preference-control receipt (lc_revoke_pending) remembers the identifier to revoke and is removed after acknowledgment; it is never used for analytics.
• lc_region — remembers which of the three rules above applies to you (not your location), set on .layrcake.dev for 7 days.
• The Console session cookie, without which the Console cannot operate. Our internal administration tool sets an equivalent session cookie for staff only.
• The documentation remembers your light-or-dark preference in your own browser’s local storage; nothing is sent to us.

Set if you accept, or where the rules above allow it unless you decline

• lc_sid — our own first-party visitor identifier, 128 random bits, set on .layrcake.dev for 12 months. Used to record the pages you view on our website and the links you click, and to link that history to your workspace if you create an account. Never shared.
• Google Ads cookies (_gcl_aw and related) — set by Google’s tag to measure whether our advertising leads to sign-ups.
• Website analytics cookies (_clck, up to 12 months, and _clsk, one day) — set by our session-recording provider, on the same basis as Google’s tag and never where you have not accepted in the European Economic Area, Switzerland, Quebec or the United Kingdom, to group the pages of one visit into a recording with typed text masked.

Google’s tag before you choose, and if you decline

Google’s tag loads on our marketing pages in what Google calls “consent mode”. Where you have not accepted (in the European Economic Area, Switzerland, Quebec and the United Kingdom), and whenever you decline, it sets no cookies and stores no identifier; it may send Google a cookieless signal that a page was viewed, which Google uses only for aggregate modelling. Our own visitor cookie and browsing record are never set or sent without your acceptance.

Withdrawing

Choosing Decline after having accepted, or after measurement that our rules allow without asking, tells our servers to stop associating anything further with your visitor identifier, removes the identifier from your browser and removes Google’s advertising cookies for our site, and stops session recording. Data already sent to Google before you withdrew cannot be recalled from Google; we stop sending person-linked conversion uploads. Google’s tag continues to operate in denied mode with cookieless signals.

14Children

The Service is offered to businesses and is not directed to anyone under 18. We do not knowingly collect personal data relating to children. If you believe a child has provided us with personal data, contact founders@layrcake.dev and we will delete it.

15Automated decision-making and profiling

The Service classifies replies, scores deliverability and ranks results so that your agents can act on them. We do not carry out automated decision-making that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Art. 22 UK GDPR.

Agents acting under your key can retrieve and draft freely, but every purchase of sending capacity and every campaign launch requires a person to confirm it in the Console. The decision to contact anyone always rests with a human on your side.

16Changes to this policy

We may update this policy to reflect changes to the Service, to our sub-processors or to applicable law. The date of the most recent revision appears at the top of this page. Where a change materially affects how we process your personal data, we will notify you by email before it takes effect.

17Contact us

Privacy and legal enquiries: founders@layrcake.dev

Support and complaints: founders@layrcake.dev

Layrcake is registered in the United Kingdom.