Privacy Policy

1. Scope and accountability

This Privacy Policy applies to the Layer9ine website and the services available through it. “Layer9ine,” “we,” “us,” and “our” refer to Layer9ine, based in Toronto, Ontario, Canada.

Layer9ine is responsible for personal information under its control. Our Privacy Lead handles questions, access requests, corrections, deletion requests, and complaints at [email protected].

2. Information we collect

Information you provide

• Contact and project enquiries: your name, email address, optional company name, and message.
• Free automation analysis: your name, email address, industry, team-size range, quiz answers, generated scores, and report.
• In-depth analysis: your name, email address, company, industry, current tools, budget range, timeline, quiz answers, and related checkout status.
• Chat: the messages you submit and the recent conversation context needed to answer them.
• Direct communications: any information you include when you email or otherwise communicate with us.

Information collected automatically

Our hosting and security providers may process standard technical information such as IP address, request time, browser or device details, requested URL, and security signals. The site also temporarily uses IP addresses in memory to limit abuse of forms and APIs.

Payment information

If paid checkout is available, Stripe collects and processes payment-card and transaction information on its systems. Layer9ine does not receive or store your full payment-card number.

3. Why we use information

We use personal information only for identified, reasonable purposes, including to:

• respond to enquiries and discuss requested projects;
• calculate, deliver, and email requested automation analyses;
• prepare an in-depth report, manage checkout, and arrange human review;
• provide the site chat and maintain context during the current conversation;
• enforce free-use limits, prevent abuse, secure the service, and troubleshoot errors;
• maintain business, tax, transaction, and legal records where required; and
• comply with law and protect Layer9ine, our users, and the public.

4. Consent and communications

We ask for information in context and explain the relevant purpose before you submit it. By sending a form or chat message, you consent to the processing needed to provide the response or service you requested. You may withdraw consent for future processing, subject to legal or contractual restrictions, by contacting us.

A requested report, project reply, receipt, or service notice is transactional. We will not add you to marketing email merely because you submitted an enquiry or requested a report. If we introduce marketing email, we will seek consent where required and include an unsubscribe method.

5. AI-assisted processing

The site chat and draft in-depth analyses use Anthropic’s API. Information submitted to those features may be sent to Anthropic to generate a response or draft. A person reviews paid analysis reports before they are delivered, but AI output can still be incomplete or incorrect.

Do not submit passwords, payment-card numbers, health information, government identifiers, trade secrets, or other sensitive information through chat. Use email first if a project may require a protected transfer method.

6. Service providers and transfers

We use providers that process information for us only as needed to operate the site and deliver requested services:

• Cloudflare for content delivery, traffic management, and security. Read Cloudflare’s Privacy Policy.
• Resend for email delivery. Email metadata, logs, and API records may be processed in the United States. Read Resend’s Privacy Policy.
• Anthropic for AI-assisted chat and report drafting. Read Anthropic’s Privacy Policy.
• Stripe for payment and checkout if that feature is enabled. Read Stripe’s Privacy Policy.
• Hosting and infrastructure providers that store or transmit the site and its operational data.

These providers may process information outside Ontario or Canada, including in the United States, where it can be subject to local law. We may also disclose information when required by law, to investigate misuse, to protect rights or safety, or as part of a business transaction subject to appropriate protections.

7. Retention

We keep personal information only as long as reasonably needed for the purpose described, to maintain required records, resolve disputes, and protect the service. Current feature-specific practices include:

• quiz answers stored in your browser’s session storage are cleared when the browser session ends or when you clear site data;
• pending in-depth-analysis intake records are ordinarily deleted after 48 hours if checkout is not completed;
• completed intake is removed from the pending store when the payment event is processed;
• in-memory IP rate-limit records ordinarily expire within 24 hours, depending on the applicable abuse-prevention window;
• a normalized email address, free-analysis count, and last-submission time may be retained to enforce the three-report limit and prevent abuse;
• contact messages, emailed reports, and related correspondence are retained as needed to answer the request and maintain reasonable business records;
• if transactional email is unavailable, a validated contact or call request may be stored in the restricted production data directory until it can be handled; and
• Anthropic states that standard API inputs and outputs are ordinarily deleted within 30 days, subject to its policy, legal requirements, safety enforcement, and any different agreed retention setting.

You may ask us about a specific record or request deletion using the contact information below. Some information may need to be retained where law, fraud prevention, or an active agreement requires it.

8. Sharing and sale

We do not sell or rent personal information, and we do not use it for cross-context behavioural advertising. We share it only with the providers and in the limited circumstances described in this policy, or with your direction or consent.

9. Safeguards

We use administrative, technical, and organizational measures appropriate to the information and service, including access controls, encrypted transport, validation, rate limiting, and restricted operational access. No internet service or storage system can guarantee absolute security. If you believe information has been exposed or misused, contact us promptly.

10. Your choices and rights

Subject to applicable law and reasonable identity verification, you may ask us to:

• explain whether we hold personal information about you and how it has been used or disclosed;
• provide access to that information;
• correct inaccurate or incomplete information;
• withdraw consent for future optional processing; or
• delete information that we no longer need or are not required to retain.

Contact our Privacy Lead at [email protected]. If we cannot resolve a privacy concern, you may contact the Office of the Privacy Commissioner of Canada.

11. Children

The site is intended for businesses and adults and is not directed to children. We do not knowingly collect personal information from children through the site. Contact us if you believe a child has submitted information.

12. Changes and contact

We may update this policy as the site, providers, or legal requirements change. We will post the revised policy here and change the “Last updated” date. Material changes will receive additional notice when appropriate.