Scope

This policy describes how OutLayer (“we”, “us”) handles information in connection with the OutLayer website, dashboard, API and related services (the “Services”). By using the Services you agree to this policy. It should be read together with our Terms of Service.

Information we collect

Depending on how you use the Services, we may collect:

• Information you provide, such as account identifiers, the inputs you submit to the Services, and any messages you send us.
• Usage and technical information, such as IP address, browser and device information, request metadata, and logs of how the Services are used.
• Transaction and payment information, such as balances, charges and the records needed to provide and bill for the Services.
• Public blockchain information, such as account names, transactions and contract state, which are public by the nature of a blockchain.
• Information from third-party services you choose to connect, as described below.

Keys and secrets

The Services are designed so that wallet private keys and the secrets you store are protected by hardware-isolated environments and are not accessible to our staff in readable form. Secrets are encrypted before they are stored and are used only to perform the operations you request.

How we use information

We use information to:

• provide, operate, maintain and improve the Services;
• process transactions and payments;
• secure the Services, prevent abuse and enforce our terms;
• communicate with you about the Services; and
• comply with legal obligations.

We do not sell personal information, and we do not use it for advertising.

How we share information

We may share information:

• with service providers that help us operate the Services, such as hosting and network providers;
• with third-party services when you direct us to, for example by calling a connector;
• if required by law, or to protect the rights, safety and security of our users and the Services; and
• in connection with a merger, acquisition or sale of assets, subject to this policy.

Connectors and third-party services

Connectors act on third-party services on your behalf, such as email providers, banks or trading venues. When you use one, the information needed for the request is sent to that service, and its own terms and privacy policy govern what it receives.

Google user data

The Gmail connector lets an agent send email from a Gmail account whose owner has connected it. It requests only the https://www.googleapis.com/auth/gmail.send scope, which allows sending email on the account’s behalf. It does not read, list, modify or delete the messages in the mailbox.

• Data accessed: the authorisation you grant, and the content of the messages your agent asks to send, such as recipients, subject, body and attachments.
• Use: solely to send the messages your agent requests, within the rules you configure for it.
• Storage and protection: the authorisation is stored encrypted and is used only inside hardware-isolated environments.
• Sharing: message content is transmitted to Google to deliver it. We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalised artificial-intelligence or machine-learning models. We do not allow humans to read it, except with your consent, for security purposes, or to comply with applicable law.
• Revoking access: you can revoke the connector’s access at any time at myaccount.google.com/permissions.

OutLayer’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and local storage

The Services may use cookies, local storage and similar technologies to keep you signed in, remember your settings, and understand how the Services are used. You can control these through your browser settings; some features may not work without them.

Retention

We keep information for as long as needed for the purposes described in this policy, including to provide the Services, meet legal and accounting obligations, resolve disputes and enforce our agreements. Information recorded on a public blockchain cannot be deleted by us or anyone else.

Security

We use technical and organisational measures designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your choices and rights

Depending on where you live, you may have rights to access, correct or delete personal information about you, or to object to or restrict its processing. To make a request, contact us at [email protected]. We may need to verify that you control the relevant account before acting on a request.

International transfers

The Services are operated using infrastructure in more than one country, and information may be processed outside the country where you live.

Children

The Services are not directed to individuals under 18, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date above. Continued use of the Services after an update means you accept the revised policy.

Contact

Questions about this policy: [email protected].