Privacy policy

Who we are

The controller responsible for personal data processed through this website is:

[Legal entity name, e.g. ThetaLayer GmbH]
[Street and number]
[Postal code] Berlin
Germany
Email: [Contact email, e.g. hello@thetalayer.io]

• Privacy questions and requests: [Privacy contact email, e.g. privacy@thetalayer.io]
• Data protection officer: [Data Protection Officer name and contact, or remove if not required]
• UK representative (Art. 27 UK GDPR): [UK representative under Art. 27 UK GDPR, if required]

Full company details are in our imprint.

Summary

We collect what you give us when you ask for a demo or contact us, plus the technical data any website needs to run safely. We use it to respond to you. We don't sell it, we don't use advertising or tracking cookies, and we don't send newsletters.

Region-specific information

Most of this policy applies to everyone. Your rights, and where you can complain, depend on where you are. References to GDPR articles also mean the corresponding provisions of the UK GDPR and, where relevant, the Swiss Federal Act on Data Protection (FADP).

Data we collect

Demo and contact requests

When you book a demo or send us a message through the forms on our site, we collect:

• your first and last name, email address (a work address for demo requests) and company;
• for demo requests: your role, company size and region, optionally your job title, the areas where you use AI agents today (for example, finance or software engineering), and optionally what you'd like to see;
• for general messages: the topic you choose and your message;
• your confirmation, by ticking the checkbox, that we may use these details to respond to your request.

With each submission we also record:

• the date and time;
• the page you submitted the form from and the referring page, if your browser sends one;
• campaign parameters (UTM tags) in the link you followed to our site, if any;
• a salted, one-way hash of your IP address that changes daily. We don't store your IP address itself in our database. We use the hash only to limit the number of requests from one network and to stop abuse, and we delete it after 30 days.

We also run simple anti-spam checks (a hidden form field and a timing check). Submissions that fail these checks are discarded and not stored.

Fields marked with an asterisk are required. Providing them is voluntary and there's no legal or contractual obligation to do so, but we can't respond to your request without them. Please don't include sensitive personal data, such as health information, in your message.

Emails, calls and demos

When you submit a form, we send an email notification with your request to our team and may send you a confirmation email. If you email us, reply to our emails, or join a call or demo with us, we process your name and contact details, the content of our correspondence, and the details needed to schedule and hold the meeting (for example, calendar invitations and participant names). We handle this information the same way as form requests.

Technical data and server logs

Our website is hosted by Vercel. When you visit, your browser automatically sends technical information that Vercel's infrastructure processes to deliver pages and protect the service: your IP address, the date and time of the request, the page requested, the referring page, your browser and operating system (user agent) and the response status. These server logs are used for security, troubleshooting and operations.

Our server-side functions run in the EU (Frankfurt, Germany), but Vercel's edge network is global, so a request may be handled at a location near you, including outside the EU.

Analytics

We use Vercel Web Analytics to see, in aggregate, how our site is used — for example, which pages are visited and where visitors come from. It works like this:

• It doesn't use cookies and doesn't track you across other websites.
• Your IP address and user agent aren't stored. Visitors are counted using an anonymous hash calculated from the request, which is discarded after 24 hours, so you aren't recognized on a later day.
• For each page view it records the page address, the referring page, filtered query parameters (such as campaign tags), approximate location (country, region, city), browser, operating system and device type.
• We see only aggregated statistics, not individual visitors.

If we ever move to analytics that uses cookies or other technologies that require consent, we'll ask for your consent first.

Cookies

We don't use advertising, tracking or other non-essential cookies, which is why you don't see a cookie banner. Details are in our cookie policy.

Staff-only pages

Some pages on our site are password-protected and used only by our staff to review incoming requests. They don't collect any additional data about visitors.

How we use it and legal bases

We use personal data only for the purposes below. Each one relies on a legal basis under Art. 6(1) GDPR.

What we don't do. We don't send newsletters or unrelated marketing emails. We don't sell or rent your personal data. We don't make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR).

If we ever want to use your data for something that requires your consent, we'll ask first (Art. 6(1)(a) GDPR). You can withdraw consent at any time, with effect for the future. You can also ask us to stop contacting you at any time: reply to any of our emails or write to [Privacy contact email, e.g. privacy@thetalayer.io].

Recipients and processors

Only team members who need your data to respond to you can access it. We use the following service providers, which process personal data on our behalf under data processing agreements (Art. 28 GDPR) and may use it only on our instructions:

Where necessary, we may also disclose personal data to:

• professional advisers, such as lawyers, auditors and tax advisers, who are bound by confidentiality;
• courts, authorities or law enforcement, where we're legally required to or need to protect our rights;
• a buyer or successor in a merger, acquisition or similar transaction, who would have to handle it in line with this policy.

International transfers

We're based in Germany and choose EU regions where we can: our database is in Frankfurt, our server-side functions run in Frankfurt, and our emails are sent from Ireland. However, Vercel, Neon and Resend are US companies. They, or their sub-processors, may access or process personal data in the United States or other countries — for example for support and security, or through Vercel's global edge network.

Where personal data is transferred outside the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the following safeguards, as applicable:

• the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, where the recipient is certified under them; and/or
• the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum for transfers from the UK and the adjustments required for transfers from Switzerland.

We combine these with supplementary measures, such as encryption in transit and at rest, data minimization (for example, storing only a hashed IP address) and EU data residency where available. You can request a copy of the relevant safeguards at [Privacy contact email, e.g. privacy@thetalayer.io].

If you're outside Europe, please note that your data is processed in Germany and elsewhere in the EU and, through our providers, in the United States.

Retention

We keep personal data only as long as we need it for the purposes above:

When you ask us to delete your data, we do so unless we're legally required to keep it. In that case, we restrict its use to that purpose and delete it when the obligation ends.

Your rights (EU, UK, Switzerland)

Under the GDPR and the UK GDPR, you have the right to:

• Access (Art. 15): find out whether we process your data and get a copy of it.
• Rectification (Art. 16): have inaccurate or incomplete data corrected.
• Erasure (Art. 17): have your data deleted, unless we're required to keep it.
• Restriction (Art. 18): limit how we use your data, for example while we check a request.
• Data portability (Art. 20): receive the data you gave us in a structured, machine-readable format, or have it sent to another controller, where processing is based on a contract or your consent.
• Objection (Art. 21): object to processing based on our legitimate interests — see below.
• Withdraw consent (Art. 7(3)): where we rely on your consent, withdraw it at any time, with effect for the future.

To exercise any of these rights, email [Privacy contact email, e.g. privacy@thetalayer.io]. We'll respond within one month. If a request is complex or we receive many requests, we may extend this by up to two further months and will tell you why. Exercising your rights is free. We may ask for information to confirm your identity before we act on a request.

Complaints

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our lead supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. You can also contact the authority in the EU country where you live or work, or where you believe an infringement occurred — see the list of EU data protection authorities.

• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk.
• Switzerland: the FADP gives you comparable rights. You can complain to the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch.

We'd appreciate the chance to address your concern first, so please feel free to contact us before you go to an authority.

US state privacy rights

This section applies to residents of California and other US states with comprehensive privacy laws — such as Colorado, Connecticut, Oregon, Texas and Virginia — to the extent those laws apply to us. It supplements the rest of this policy.

Personal information we collect

In the last 12 months, we have collected the following categories of personal information, as defined by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA):

We use these categories for the business purposes described in How we use it: responding to requests and sales communication, security and fraud prevention, debugging and operations, and aggregated analytics. We disclose them for these purposes only to the service providers listed under Recipients and processors, under contracts that restrict how they may use it. We keep each category for the periods listed under Retention.

No sale, no sharing, no sensitive personal information

We don't sell personal information or share it for cross-context behavioral advertising, as those terms are defined under the CCPA, and we haven't done so in the last 12 months. We don't use personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We don't knowingly sell or share the personal information of consumers under 16. We don't collect sensitive personal information, and we don't use any personal information to infer characteristics about you.

Because we don't sell or share personal information, there's nothing to opt out of. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of sale and sharing anyway.

Your rights

Depending on where you live, you may have the right to:

• Know and access the personal information we've collected about you, including the categories, sources, purposes and recipients, and receive a copy in a portable format;
• Correct inaccurate personal information;
• Delete personal information we've collected from you, subject to legal exceptions;
• Opt out of the sale or sharing of personal information, targeted advertising and certain profiling — none of which we do;
• Non-discrimination: we won't deny you service, charge you different prices or provide a different quality of service because you exercised your rights.

How to submit a request

Email [Privacy contact email, e.g. privacy@thetalayer.io] or write to us at the address under Who we are. Please tell us which right you want to exercise and which state you live in. We'll confirm receipt within 10 business days and respond within the time required by law — generally 45 days, which may be extended once by up to 45 more days where permitted. If we need more time, we'll tell you why.

Verification and authorized agents

To protect your information, we verify requests by matching the details you give us, such as your name and the email address you used to contact us, with the information we hold. We may ask for more information if needed and will use it only for verification. You can use an authorized agent to submit a request for you. We'll ask the agent for proof of your signed permission and may ask you to confirm your identity directly with us, unless the agent holds a valid power of attorney.

Appeals

If we decline your request and your state gives you the right to appeal, you can appeal by emailing [Privacy contact email, e.g. privacy@thetalayer.io] with the subject line “Privacy appeal”. We'll respond in writing within the time required by law, generally 45 to 60 days. If you disagree with the outcome, you can contact your state attorney general.

Other notices

• California “Shine the Light”: we don't disclose personal information to third parties for their own direct marketing purposes.
• Do Not Track: our site doesn't track visitors across third-party websites, so it works the same way whether or not your browser sends a Do Not Track signal.

Security

We use technical and organizational measures appropriate to the risk, including:

• encryption in transit (HTTPS/TLS) for the site and our connections to service providers, and encryption at rest provided by our database host;
• access to request data limited to staff who need it, protected by authentication;
• data minimization — for example, a daily-changing hash instead of your IP address, deleted after 30 days;
• EU hosting for our database and server-side functions;
• security headers, rate limiting and anti-spam checks on our forms.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we'll notify the responsible authority and, where required, you.

Children

Our website is for business professionals. It isn't directed at children under 16, and we don't knowingly collect personal data from them. If you believe a child has given us personal data, please contact us and we'll delete it.

Changes to this policy

We update this policy when our website or the way we process data changes. The “Last updated” date at the top shows the current version. If we make material changes, we'll highlight them on this page and, where we have your contact details and the change affects you, let you know directly.

Contact

For any privacy question or request, email [Privacy contact email, e.g. privacy@thetalayer.io]. You can also write to us at:

[Legal entity name, e.g. ThetaLayer GmbH]
[Street and number]
[Postal code] Berlin
Germany

Data protection officer: [Data Protection Officer name and contact, or remove if not required]