Privacy Policy

Layercode, Inc. ("Toyo", "we" or "us") provides Toyo for companies, personal Toyo, and related websites, applications and integrations (the "Services"). This policy explains how we handle personal information, including information about people who do not have a Toyo account. Contact our privacy team at privacy@toyo.ai.

Our role

We act as a controller for personal information we use to manage our business, accounts, websites and customer relationships. When we process customer content on behalf of a business customer, we act as a processor: that customer controls the processing and we follow its instructions and our agreement. Its own privacy notices may also apply. Contact the relevant organization about company-controlled information; we can help direct your request.

Information we collect

Depending on how you use Toyo, we collect:

• account, contact, company, billing and transaction information
• messages, files, records and other content you or your organization provide or authorize us to access, including through connected services
• audio, recordings and transcripts when you use voice features
• generated work, saved preferences and business context, including information inferred from your interactions
• connection credentials and permissions, device and browser information, IP address and approximate location, usage activity, and diagnostic records that may include interaction content

We receive information from you, your organization and other users, connected services, service providers and public sources used for requested research or business context. Content may include information about colleagues, customers or others, including sensitive information you choose to provide. If required information is unavailable, some features may not work.

How we use information

We use information to provide and personalize Toyo, retain relevant context, carry out tasks and workflows, and share results as instructed. We also use it to manage accounts and billing, communicate with you, provide support, diagnose problems, evaluate reliability, improve features, protect the Services and meet legal obligations. We send marketing communications where permitted, with an option to unsubscribe.

Where EU or UK data protection law applies and we act as a controller, we rely on contractual necessity to provide services you request; legitimate interests in operating, securing and improving our business where your rights do not override them; legal obligations; or consent where required. You may withdraw consent at any time without affecting earlier lawful processing. Company content is processed on the customer's documented instructions. Connected-service restrictions below take precedence over general improvement purposes.

AI and connected services

Toyo sends relevant content to AI and other service providers to perform work. It may save context, generate inferences, and take actions through connected services, including scheduled or automated actions. Permissions, instructions and applicable controls determine access and sharing. AI outputs can be inaccurate; review them before relying on them.

Except as restricted below, we or our AI providers may use information for model improvement only where allowed by applicable law, our customer agreements and any required notice and consent. Processing company content for this purpose also requires the customer's documented authorization. Saving context for your service does not itself train an AI model.

To provide our Slack integration, we process authorized workspace, member, channel, message and file information. We do not use Slack data to train large language models or for advertising, and require providers handling it to respect these restrictions. Private Slack content remains subject to its source access restrictions. Real-time search data is handled only temporarily for the immediate permitted operation, then promptly deleted; it is not retained as an archive or index or used for product improvement.

We use and transfer information received from Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements. These restrictions also limit human access, transfers and model improvement.

You can revoke a connection through the relevant service or available Toyo controls. Revocation stops future authorized access but does not itself erase information already processed; see retention and your rights below.

Who receives information

We share information with providers supporting hosting, storage, AI processing, integrations, communications, payments, analytics, security and support. Authorized personnel may access information as needed for those purposes, subject to applicable confidentiality, access and connected-service restrictions. For current subprocessor information, email privacy@toyo.ai.

Information and results may be shared with your organization, authorized collaborators, connected services and other recipients according to permissions and instructions. Company information may remain under your organization's control after you leave. Independent services you choose also have their own privacy policies.

We may disclose information when legally required, to protect rights and security, or in a business transaction, subject to applicable law, confidentiality protections and connected-service restrictions. We do not sell personal information for money. Website advertising technologies, where used, may be treated as sharing or sale under some privacy laws; applicable choices are described below. We do not sell or rent Slack data or share it for advertising.

Cookies and marketing choices

We use cookies and similar technologies for essential functions and analytics. Our websites may also use advertising technologies. Where required, we obtain consent before nonessential tracking. You can manage choices through available cookie preferences and browser controls, or email privacy@toyo.ai for help. Blocking essential storage may affect functionality.

You can unsubscribe from marketing using the message's instructions or by emailing privacy@toyo.ai. Service messages may continue. We obtain consent before contacting you using an email address obtained from Slack.

Retention and deletion

We keep information only as long as needed for its purpose, considering the service relationship, customer instructions, sensitivity, operational need, legal obligations and connected-service limits. When no longer needed, we delete it or anonymize it where permitted. Limited billing, consent, security and legal records may remain to meet obligations, demonstrate compliance or resolve disputes. We retain consent records for six years after account deletion, then automatically delete them. For previously deleted accounts whose deletion date was not recorded, consent records expire on 7 October 2032. Backups remain restricted until deleted under the applicable retention schedule.

Account deletion does not automatically remove information controlled by your organization or copies held independently by recipients. We assist with requests relating to information we control or process on a customer's behalf.

We delete associated Slack data within 14 business days after the app is removed or discontinued. Shorter limits, including those for real-time search, apply where required. General retention and backup provisions do not extend those limits.

Security and international processing

We use technical and organizational safeguards, including access controls and encryption, to protect personal information. No service is completely secure. We assess security incidents and notify affected parties, regulators and connected platforms as required by applicable law and our obligations.

We and our providers may process information in the United States and other countries, whose laws may differ from yours. Information processed abroad may be accessible to courts and authorities under local law. Where required, we use an approved transfer mechanism, such as an adequacy decision or standard contractual clauses and applicable UK safeguards. For details or a copy of relevant safeguards, email privacy@toyo.ai.

Your rights

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction of processing, or withdrawal of consent. You may also opt out of targeted advertising or legally defined sale or sharing, limit certain uses of sensitive information, and appeal a denied request where those rights apply.

You may object to processing based on legitimate interests, including direct marketing, where applicable law provides this right.

Email privacy@toyo.ai to exercise these rights, including if you use Toyo through Slack without a separate account. We may verify your identity and an authorized agent's authority, and coordinate with your organization. We respond within applicable legal deadlines and explain any lawful limitations. We do not discriminate against you for exercising your rights. You may complain to your local privacy regulator, including your EEA supervisory authority, the UK Information Commissioner or the relevant Canadian privacy commissioner.

Children

The Services are intended for adults and are not offered to people under 18. If we learn that a child has provided personal information contrary to these requirements, we take appropriate steps to remove it. Email privacy@toyo.ai if you believe this has occurred.

Changes to this policy

We may update this policy as the Services or our practices change. We will publish the revised version at toyo.ai/privacy and update its date. We provide additional notice and obtain consent where required for material changes.