Privacy Policy

This Privacy Policy explains how VisitorLayer ("VisitorLayer", "we", "us" or "our") processes personal data in connection with the website at visitorlayer.com and the VisitorLayer service (the "Service"). We are the controller of the personal data described in this Privacy Policy, except for the personal data described in Section 10, for which we act as a processor. You can contact us about this Privacy Policy or your personal data at support@visitorlayer.com.

2.1 Account data. When you create an account or accept an invitation, we collect your name, email address, profile picture and sign-in credentials.

2.2 Workspace data. When you use the Service, we collect workspace and project names, website addresses, settings, webhook addresses and the email addresses of members you invite.

2.3 Billing data. When you subscribe to a paid plan, we collect your plan, billing interval and subscription status. Your billing name, billing address and payment card details are collected and held by our payment provider.

2.4 Communications data. We collect your email address, your email preferences and the content of messages you send us.

2.5 Product usage data. When you use the Service, we collect your account identifier, email address, workspace, plan and the features you use.

2.6 Website usage data. When you visit our website, we collect the pages you view, your clicks, how far you scroll, the referring website, campaign parameters, your browser and device type, and your country, which is derived from your IP address. Your IP address is discarded once your country has been derived.

2.7 Technical data. We collect your IP address and device details for sign-in sessions, and technical information about errors that occur in the Service.

2.8 Advertising data. When you arrive on our website from one of our ads on Facebook or Instagram, we collect the identifier of that ad click. If you then start a trial or open checkout, we share that identifier, your IP address and your browser's user agent with Meta, so Meta can tell us which ad led to it. We do not share your name, email address or anything from your workspace.

3.1 We process account data, workspace data and billing data to provide the Service to you and to manage your subscription. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR).

3.2 We process billing data to keep tax and accounting records. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).

3.3 We process communications data to send you emails about your account and the Service and to respond to your messages. The legal basis is the performance of our contract with you. We also send setup tips and reports based on our legitimate interest in helping customers use the Service (Article 6(1)(f) GDPR). You may unsubscribe from these emails at any time.

3.4 We process product usage data and website usage data based on our legitimate interest in understanding and improving the Service and our website.

3.5 We process technical data based on our legitimate interest in securing the Service, preventing abuse and correcting errors.

3.6 We process advertising data based on our legitimate interest in measuring which of our ads lead to trials and payments.

We disclose personal data only to service providers that process it on our behalf. These service providers fall into the following categories: hosting, database and background processing providers; sign-in providers; payment providers; email delivery providers; product and website analytics providers; error monitoring providers; and, for advertising data, Meta. We do not sell personal data.

Some of our service providers process personal data outside the United Kingdom and the European Economic Area, including in the United States. Where personal data is transferred to a country that is not covered by an adequacy decision, we rely on the standard contractual clauses approved for the European Union and the United Kingdom. You may obtain a copy of these safeguards by contacting us at the email address in Section 13.

6.1 We retain account data and workspace data for as long as your account exists, and delete it when you ask us to delete your account.

6.2 We delete projects and the data associated with them 30 days after the trial or subscription for the workspace ends.

6.3 We retain billing records for as long as tax and accounting law requires.

6.4 We retain product usage data, website usage data and error information for as long as necessary for the purposes described in Sections 3.4 and 3.5, after which it is deleted.

6.5 We retain messages you send us for as long as your account exists or, if you do not have an account, until your enquiry has been resolved.

Subject to applicable law, you have the right to request access to, rectification of and erasure of your personal data, to request restriction of its processing, to receive your personal data in a structured, commonly used and machine-readable format, and to object to processing based on our legitimate interests. To exercise these rights, contact us at the email address in Section 13. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement took place.

You must provide your name, email address and a password to create an account, and billing details to subscribe to a paid plan. If you do not provide this information, we cannot provide the Service to you. You are not required to provide any other personal data.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

When a customer installs the VisitorLayer tracking script on its website, we process the personal data of that website's visitors, including data submitted through forms, on the customer's behalf. The customer is the controller of that personal data and we act as its processor. If you have visited a customer's website and wish to exercise your rights, please contact the owner of that website. Customers may request a list of our subprocessors by email, and we will inform customers before we add or replace a subprocessor.

We use only the cookies and browser storage that are necessary to keep you signed in and to remember choices you make, such as your selected plan and display theme. When you arrive from one of our ads on Facebook or Instagram, we also set a cookie that records the ad click for 90 days, and our homepage loads Meta's pixel, which records your visit to that page. Visitors who do not arrive from one of our ads get neither. We do not use any other advertising or analytics cookies.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above.

You may contact us about this Privacy Policy by email at support@visitorlayer.com.