Privacy policy
Last updated 4 October 2026
This policy explains how Action Layer AI Inc. collects, uses and protects personal data when you visit tryactionlayer.com, use the Action Layer platform, or hear from us. We follow the EU General Data Protection Regulation (GDPR).
In short
- Action Layer is a business-to-business service. We never sell personal data.
- For data our customers bring into Action Layer, the customer decides how it is used. We process it for them.
- This website sets no cookies and runs no analytics.
- You can ask to see, correct or delete your data at privacy@tryactionlayer.com.
1. Who we are
Action Layer is run by Action Layer AI Inc., a Delaware corporation (“Action Layer”, “we”, “us”). We are responsible for the personal data described in section 3.
For anything about privacy or your data, email privacy@tryactionlayer.com.
2. Our two roles
We handle personal data in two different roles, and the rules differ for each.
Where we decide (controller). We decide how data is used for our own website, for the people who sign up and use their accounts, for billing, for support, and for people we contact about Action Layer. This policy covers that data in full.
Where our customer decides (processor). Our customers bring their own data into Action Layer or create it there: contacts and companies from their CRM, research about the accounts they sell to, signals, drafts, sent messages and replies. We call this “Customer Data”. The customer is the controller of it, and we process it only on their instructions, under our data processing agreement with them.
If your details are in a customer’s workspace, for example because a company you work for is their prospect, please contact that company first. If you contact us instead, we will pass your request to them and help them answer it.
3. Data we collect
As controller, we collect the following:
| Data | Examples | Where it comes from |
|---|---|---|
| Account details | Name, work email, role, company, how you sign in (email, Google or Microsoft) | You, or the admin who invites you |
| Billing details | Billing contact, company name and address, VAT number, the last four digits of your card | You and our payment provider, which holds full card numbers. We never see them |
| Usage and device data | What you do in the app, usage counts, errors, IP address, browser type, logs | Collected automatically when you use Action Layer |
| Messages to us | Support emails, chat and Slack messages, error reports, call bookings | You |
| Business contact data | Name, work email, job title, company, LinkedIn profile URL, public work news such as a new role | Public sources and business data providers, when we contact people about Action Layer |
Signing in with Google or Microsoft
If you sign in with Google or Microsoft, we receive your name, email address and profile picture from that account. We use them only to create your account and sign you in. We do not access your emails, files, calendar or contacts, we do not sell this data, and we do not use it for advertising.
Action Layer’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
On this website
This website sets no cookies and runs no analytics or advertising trackers. Our hosting provider logs IP addresses and requests to keep the site secure. The work email you type into the market preview stays in your browser for that visit. We only receive it if you sign up or book a call.
4. How we use it and our legal basis
Under the GDPR we need a legal basis for each use of personal data. These are ours:
| Why we use it | Legal basis |
|---|---|
| Create and run your account, provide Action Layer and bill you | Performing our contract with you or your company |
| Send service messages such as invites, password resets and billing notices | Performing our contract |
| Keep the platform secure, prevent fraud and abuse, enforce our terms | Our legitimate interest in a safe and reliable service |
| Improve the product using usage and error data | Our legitimate interest in making Action Layer better |
| Contact people at businesses about Action Layer | Our legitimate interest in business-to-business marketing. You can object at any time and we stop. Where the law requires consent for an email, we ask for it first |
| Keep accounting and tax records | Legal obligation |
| Respond to legal requests and defend legal claims | Legal obligation, or our legitimate interest in protecting our rights |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details of that assessment.
5. AI and automated processing
Action Layer uses AI models to research companies and people, score accounts and draft messages. A person on the customer’s team reviews and approves every message before it is sent.
We do not make decisions about anyone that have legal or similarly significant effects based only on automated processing. We do not use Customer Data to train our own AI models.
7. Service providers
We use outside service providers to run Action Layer. Each one receives only the data it needs for its task, under a written contract. They fall into these groups:
- Hosting and storage: the database, servers and website hosting.
- AI models: research, drafting and sorting replies.
- Research and data: web search, public company and work information, work email lookup and company logos.
- Email sending: mailboxes for customers who use our managed sending.
- Payments, analytics and error tracking.
- Communication: alerts, our own CRM and call booking.
Customers can ask for the current list of providers at privacy@tryactionlayer.com.
8. Transfers outside Europe
Some of our providers process data outside the European Economic Area. When a country has no EU adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, or on the EU-U.S. Data Privacy Framework where the provider is certified, together with extra safeguards where needed.
You can ask for a copy of the safeguards that apply at privacy@tryactionlayer.com.
9. How long we keep it
| Data | How long |
|---|---|
| Account details | While the account is active, then deleted within 90 days after it closes |
| Customer Data | For the length of the customer's contract. The customer has 30 days after it ends to export their data, and we delete it within 90 days after the end |
| Raw events from sending tools | 30 days |
| Billing and tax records | As long as tax law requires, usually 7 years |
| Business contact data for our own outreach | Until you object, or 2 years after our last contact. If you opt out, we keep only what we need to make sure we do not contact you again |
| Backups | Overwritten in the normal backup cycle after the original is deleted |
10. How we protect it
- Data is encrypted in transit and at rest.
- Keys for the tools a customer connects are encrypted before we store them.
- Each customer workspace is kept separate by access rules in the database.
- Only staff who need access to run and support Action Layer have it.
If a personal data breach affects you, we tell the affected customers without undue delay, and we notify the supervisory authority within 72 hours where the law requires it. To report a security issue, email privacy@tryactionlayer.com.
11. Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data,
- correct data that is wrong,
- delete your data,
- limit how we use it,
- send your data to you or another company in a common format.
You can also object to how we use your data, and you can always object to direct marketing. Where we rely on your consent, you can withdraw it at any time.
Email privacy@tryactionlayer.com. It is free, and we reply within one month. We may ask you to confirm your identity first.
You can also complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You can also go to the authority where you live or work.
12. Children
Action Layer is a business service. It is not meant for anyone under 16, and we do not knowingly collect their data.
13. Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we tell customers by email or in the app before it takes effect.
14. Contact
Action Layer AI Inc.
Email: privacy@tryactionlayer.com