This notice explains how Layer7 Systems Inc. ("Layer7", "we", "us") collects and uses personal information when you use the Layer7 console, APIs and cloud services (the "Services") and our website. It forms part of the information we provide under our Customer Terms.
1. Who we are
Layer7 Systems Inc. is a Delaware corporation with its registered office at 16192 Coastal Highway, Lewes, Delaware 19958, USA. For privacy questions or requests, contact legal@layer7.systems or write to that address.
For personal information about your account, billing and use of the Services, Layer7 is the controller (the business that decides how the information is used). For personal information contained in the data, models and workloads you run on the Services ("Customer Content"), you are the controller and Layer7 processes it only on your instructions to provide the Services. A data processing agreement is available on request for business customers.
2. Information we collect
- Account and identity: your name, email address, organization, role, sign-in and authentication records.
- Billing profile and verification (KYC): account type, contact name, billing email, phone number, billing address, and, for companies, legal name, registration number, country of incorporation, tax or VAT identifier and website; your acceptance of our Terms, with the version and time.
- Payment information: payments are processed by our payment provider. We receive payment status, the last digits and expiry of a saved card, and transaction references. We do not store full card numbers.
- Usage and billing records: the resources you create, their configuration, region, status and metered usage, wallet balances, top-ups, credits, invoices and commissions.
- Service and security data: IP addresses, device and browser information, API key metadata, audit logs of account and resource actions, console and API request logs, and records needed to detect abuse or fraud.
- Optional machine readings: if you turn on GPU readings for a machine, we receive GPU use, memory, temperature and power figures from that machine, and nothing else.
- Support and communications: messages you send us and our replies.
- Website: information you submit through website forms and basic analytics about visits.
We do not intentionally access Customer Content. We may access it only to provide support you request, to investigate a credible security or abuse report as described in our Terms, or where required by law.
3. How we use information
We use personal information to:
- create and secure your account, and verify the billing profile required before services can be provisioned;
- provide, operate, meter and bill the Services, manage your wallet and payments, and send invoices and service notices;
- provide support and respond to requests;
- detect, prevent and respond to fraud, abuse, security incidents and violations of our Terms;
- maintain audit and compliance records;
- improve the reliability and performance of the Services;
- send product updates where you have agreed or where permitted by law (you can opt out at any time); and
- comply with legal obligations and enforce our agreements.
Where the law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating a secure and reliable service, compliance with legal obligations, and your consent where we ask for it.
We do not sell personal information and we do not use it for cross-context behavioural advertising.
4. Who we share it with
We share personal information only as needed to provide the Services:
- Service providers (subprocessors) that act on our instructions, including our payment provider (card processing and payment methods), our network and security provider (DNS, secure tunnels, access control and DDoS protection), our application hosting provider, our customer relationship and website provider, and email delivery providers.
- Partner infrastructure providers that operate partner-operated regions you choose to use. They process the resources you run there.
- Your reseller or distributor, if your account is managed through one. They receive billing information about your account (such as your organization name, usage totals and invoices). They do not receive access to the contents of your environment.
- Authorities or other parties where required by law, to protect rights and safety, or in connection with a merger, acquisition or sale of assets, subject to appropriate confidentiality.
A current list of subprocessors and their locations is available on request from legal@layer7.systems.
5. Where information is processed
Layer7 is based in the United States. Account, billing and operational information is processed in the United States. Resources you create are hosted in the region you choose, which may be outside the United States for partner-operated regions. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep it
We keep personal information for as long as your account is active and as needed to provide the Services, then for the periods required or permitted by applicable law, including the laws of the State of Delaware, and our legitimate needs for billing, tax, accounting, security, dispute resolution and audit records. Billing and tax records are generally kept for at least seven years. When information is no longer needed, we delete or anonymize it. Retention of Customer Content after a service ends is described in our Customer Terms.
7. Security
We protect personal information with technical and organizational measures appropriate to the risk, including encryption in transit, access controls, least-privilege administration, tamper-evident audit logging and isolation between customer environments. No system is completely secure; please protect your credentials and tell us promptly about any suspected compromise.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to appeal our decision on your request. California residents have the rights provided by the California Consumer Privacy Act, and we will not discriminate against you for exercising them. Residents of the EEA and UK may also complain to their data protection authority.
To make a request, email legal@layer7.systems. We will verify your identity before acting and respond within the time required by law. If your account is managed by a reseller or distributor, we may coordinate with them. If you are an end user of one of our customers, please contact that customer, who controls the Customer Content.
9. Cookies
The console uses cookies and similar storage that are necessary for sign-in, security and remembering your preferences. Our website may use analytics cookies; where required, we ask for your consent and you can change your choice at any time.
10. Children
The Services are intended for businesses and adults. We do not knowingly collect personal information from children under 16.
11. Changes to this notice
We will post updates to this notice with a new version date and, for material changes, notify account contacts in advance where required.
12. Contact
Layer7 Systems Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA · legal@layer7.systems · support@layer7.systems