Privacy Policy

Last updated: October 8, 2026

This Privacy Policy describes how Layro ("we", "us", or "our"), operated by LLC "Layers" (ТОВ "Лейерс"), collects, uses, and shares information when you use our website at layro.ai and related services (collectively, the "Service").

1. Who is responsible for your data

LLC "Layers" (ТОВ "Лейерс") is the controller of the personal data described in this policy: we decide why and how it is processed. For anything about your data — a question, a request, or a complaint — write to our privacy contact at [email protected].

Company: LLC "Layers" (ТОВ "Лейерс")
Registration number (EDRPOU): 45972380
Registered address: 18 Marka Vovchka St., Building 3, Office 27, Kyiv 04073, Ukraine
Phone: +380 93 857 1237
Email: [email protected]

Payments are the one exception. Paddle is the merchant of record for all our orders and processes your payment and billing details as a controller in its own right, under the Paddle Privacy Notice.

2. Information we collect

Account information. When you create an account we collect your name, email address, and authentication credentials (via Google, or email and password). We do not store raw passwords — authentication is handled by Supabase Auth. If you enable two-factor authentication, the enrolment secret is held by Supabase, not by us.

Payment information. When you subscribe to a paid plan, payment is processed by Paddle, which acts as the merchant of record. We do not store your card number. Paddle provides us with a tokenized reference, your billing email, and transaction history.

User content. Scripts, voiceover text, images, videos, project files, and any other content you create or upload through the Service.

Usage data. We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, browser type, IP address, and device identifiers.

AI processing data. When you use AI features (script generation, image and video generation, voiceover, transcription), your prompts and content are sent to third-party AI providers for processing — each one is named on our Subprocessors page. We also log token usage and cost per operation, so that we can bill credits and answer questions about them. Before a prompt reaches an image or video generator, it is screened automatically against our Acceptable Use Policy, and a prompt that breaks it is refused.

Rights and copyright records. When you confirm that you hold the rights to outside material, we record the version of the text you confirmed, the time, and the IP address it came from. We also record where each file brought into a project came from, and keep the copyright notices and counter-notices we receive about an account.

Your conversation with the producer. The assistant that helps you build a video keeps its thread on our servers, so that closing the tab or moving to another device picks up where you left off. That thread — what you wrote and what the assistant replied — is stored with the project for as long as the project exists. The assistant also saves short notes about your stated preferences, your corrections, and the context of your projects, so it does not have to ask twice. You can clear a thread from inside the project, and deleting a project or your account removes both the thread and the notes as described in section 6.

The Picker browser extension. If you install Picker, it asks for your OK before it reads anything, and then works only with the Layro tab you have open. While Picker is open there, the extension tells that tab the address of the page in front of you, so it can offer the right button; the address is saved to your project only when you press Capture or Alt+Q. On YouTube it also sends the second of the video you are at. For a web page, and only when you ask for it, it sends a screenshot of what is visible in the tab. It sends nothing anywhere else: no browsing history, no page text, no tracking, and it never records video or downloads files.

3. How we use your information, and on what legal basis

Each use below names its legal basis — the reason the law allows it. Where we rely on our legitimate interests, we have weighed them against yours, and you can object (section 8).

Provide the Service — your account, projects and storage, the AI features you use, the producer's conversation and notes, and answers to your support requests. Basis: contract — we need it to deliver what you signed up for.
Payments and subscriptions — plans, credits, voice minutes and receipts. Basis: contract; keeping billing records for tax and accounting is a legal obligation.
Transactional email — account confirmation, password reset, invitations to a project, and billing notices. Basis: contract.
Security and abuse prevention — rate limits, protecting accounts, and enforcing our Acceptable Use Policy, including the automatic screening of generation prompts. Basis: legitimate interests — keeping the Service safe, lawful, and available.
Copyright and rights records — handling notices and counter-notices, applying our repeat-infringer policy, and keeping proof of the rights confirmations you gave. Basis: legal obligation where the law requires a notice-and-takedown process, and otherwise legitimate interests — responding to rightsholders and defending legal claims.
Improving the product — aggregated, anonymized usage analytics and error monitoring. Basis: legitimate interests — finding and fixing what breaks.
Features you switch on yourself — the Picker browser extension and the screenshots it takes when you ask. Basis: consent, which you can withdraw at any time by turning the feature off or removing the extension.
Complying with the law — answering lawful requests from courts and authorities. Basis: legal obligation.

We do not sell your personal data, and we do not use it for advertising. Prompt screening decides only whether a single generation runs; it has no legal or similarly significant effect on you, and if you think a request was refused by mistake, write to us and a person will look at it.

4. Who we share data with

We use the following third-party services that may process your data:

Infrastructure — hosting of the application, database, and file storage, and the network edge that every request to the Service passes through
Identity and payments — authentication, sign-in with Google, subscriptions, transactional email
AI providers — text generation, voiceover, image and video generation, speech recognition
Research and stock sources — web search and licensed footage libraries
Operations — error monitoring

The complete, current list — every provider by name, what it is used for, and exactly what data reaches it — is maintained on our Subprocessors page. We keep it there rather than here so that it is updated whenever the stack changes.

Each provider processes data in accordance with their own privacy policy. We only share the minimum data necessary for each service to function.

Beyond these providers, we disclose data only when the law requires it — for example, a valid order from a court or authority — and in the copyright procedure: when you send a copyright notice or a counter-notice, we pass it on, with your contact details, to the other side, as our Copyright Policy describes.

5. YouTube API Services

Layro uses YouTube API Services to show the title, channel, length and thumbnail of the YouTube videos you add to a project, and plays them in YouTube’s own embedded player. By using these features you agree to the YouTube Terms of Service. What YouTube does with data is governed by the Google Privacy Policy.

What we keep: the video’s ID and the moment you chose, inside your project, for as long as the project exists
Video details from YouTube are cached for up to 24 hours
The embedded player is YouTube's own, in its privacy-enhanced mode; once you play a video, YouTube may store information in your browser under its own policy
These features never access your Google or YouTube account

You can remove a YouTube video from a project at any time, and deleting the project or your account removes what we keep as described in section 6.

6. Data retention

We retain your account data and content for as long as your account is active. When you delete a project, its data is permanently removed within 30 days. When you delete your account, all associated data is deleted within 30 days, except:

where retention is required by law (e.g., billing records for tax purposes — up to 7 years)
the rights and copyright records described in section 2, which we keep as long as they may be needed to apply our repeat-infringer policy or to establish or defend a legal claim

7. Data security

Traffic to the Service is served over TLS. Access to your projects is checked on every request rather than once at sign-in, and administrative access is a per-user flag re-checked the same way. Provider keys you connect yourself are encrypted at rest with AES-256-GCM under a master key held outside the database. Our infrastructure runs in the European Union. What we do and do not claim is set out in more detail on our Security page. No method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

8. Your rights

Depending on your jurisdiction, you may have the right to:

Access and receive a copy of your personal data
Rectify inaccurate personal data
Request deletion of your personal data
Object to or restrict processing of your data
Data portability (export your projects and content)
Withdraw consent at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with a data protection supervisory authority:

In the European Union or the European Economic Area — the authority in the country where you live or work (listed by the European Data Protection Board)
In the United Kingdom — the Information Commissioner's Office
In Ukraine — the Ukrainian Parliament Commissioner for Human Rights

We would appreciate the chance to resolve your concern first, but you do not have to.

9. Cookies

We use essential cookies for authentication and session management. We do not run third-party advertising, tracking, or analytics cookies, and we do not use an analytics vendor.

10. Children's privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. International data transfers

Our own infrastructure is in the European Union, but the providers listed on our Subprocessors page operate in the United States and in other countries outside the EU, so data you send to an AI feature may be processed there. We ensure appropriate safeguards are in place for such transfers.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance.

13. Contact us

If you have questions about this Privacy Policy, contact us at: