Privacy — layermetry

Effective 14 October 2026.

Privacy Policy

This policy explains how layermetry uses personal data. It covers our website (layermetry.com), our app (app.layermetry.com), our documentation and blog, and our software development kit, the layermetry SDK (the "SDK"). The SDK is the editing software that our customers put inside their own websites and apps.

We try to write this policy in plain words. If something is not clear, email us at hello@layermetry.com.

1. Who we are

"We", "us" and "layermetry" mean Distra Labs Limited, a company registered in England and Wales (company number 14082553), trading as layermetry. Our registered office is 66 Paul Street, London, EC2A 4NA, United Kingdom. Our email address is hello@layermetry.com.

2. Two roles: controller and processor

The law gives a company one of two roles for each piece of personal data.

A controller decides why and how personal data is used.
A processor uses personal data only on the instructions of another company, the controller.

We have both roles.

Where we are the controller. We are the controller for personal data about:

people who visit our website;
people who contact us, join our newsletter or waitlist, or ask for a demo;
people who create an account in our app, and their billing details;
people who use our support service;
technical data from the licence check that the SDK runs against our servers (see section 4).

Where we are the processor. Our customers use the SDK to build editing tools for their own users. If we handle personal data on behalf of a customer, for example in the files or text that the customer's users send to our AI service, the customer is the controller and we are the processor. We then follow the customer's instructions. If you are a business customer and need a data processing agreement for this, contact us at hello@layermetry.com.

If you are a user of a product that uses our SDK, the company that built that product is responsible for telling you how your data is used. Please read its privacy policy and contact it first.

3. Editing happens in your browser

The SDK runs inside the web page of the website or app that uses it. Images and videos that a person opens in the editor are edited on that person's own device. They are not sent to layermetry unless the customer or the user chooses a feature that sends them, such as an AI feature (section 6). The customer's own product may save or send files in its own way; its privacy policy explains that. Section 5 explains the other companies the SDK may contact. On our own website, the demo editor works in the same way. It does not upload the files that visitors open.

4. What personal data we collect and why

For each purpose, we list the data, the legal basis and the reason. A "legal basis" is the reason the law accepts for using personal data. We use the UK GDPR and the Data Protection Act 2018.

Running our website.

Data: the pages you view, the page you came from, your browser and device type, and your IP address. Our hosting provider also keeps ordinary server logs. Our documentation (/docs) and blog (/blog) are published with hosting partners, which keep ordinary server logs of their own.
Legal basis: legitimate interests.
Why: to deliver the website, keep it secure, find faults and count visits. We use Plausible and PostHog for counting. Neither uses cookies unless you accept statistics cookies in our banner (see our Cookie Policy).

Understanding how visitors use the website, with your permission.

Data: if you accept statistics cookies, PostHog sets an identifier in your browser, so it can recognise your browser on later visits. It may also record your visit: the pages, your mouse movements, clicks and scrolling. Text you type into form fields is hidden from the recording. If you sign in, we link this to your account's internal identifier, not to your email address.
Legal basis: consent. You can withdraw it at any time in the cookie banner, and we then stop.
Why: to see where the website is hard to use, and to improve it.

Answering contact messages and requests.

Data: your name, email address, company, plan of interest, and the message you write.
Legal basis: legitimate interests (to answer you), or taking steps at your request before a contract.
Why: to reply, to give you information and to prepare a quote or an agreement.

Newsletter and waitlist.

Data: your email address, your language, and for the waitlist the kind of app you are interested in.
Legal basis: consent.
Why: to send you the news or the launch message you asked for. We save your email address when you submit the form and mark it "pending". We do not use your address for marketing until you have confirmed it, for example by clicking the link in a confirmation email from us. You can withdraw your consent at any time by emailing us, and we will remove you.

Demo handoff.

Data: the name of the demo tool you used, the kind of media (image or video) and the name of the sample file.
Legal basis: legitimate interests.
Why: to take you from the demo on our website to the app and continue what you started.

Accounts and sign-in.

Data: your name, email address, profile picture if your sign-in provider gives one, your organisation, and sign-in details held by our sign-in provider.
Legal basis: contract.
Why: to create your account and let you use the app.

Subscriptions, licence keys and payments.

Data: your name, email address, company, billing details, subscription and invoice records, the domains where a licence key may be used, and records of your licence keys. Card details go directly to our payment provider. We do not receive them.
Legal basis: contract, and legal obligation (tax and accounting records).
Why: to sell and manage subscriptions, issue licence keys, send invoices and receipts, and keep the records the law requires.

Checking SDK licence keys.

Data: the licence key, the host name of the website where the SDK runs, the time of the check, and the IP address and browser details that reach our server with every request.
Legal basis: legitimate interests.
Why: to check that a key is valid and is used within its licence, and to protect the SDK and our customers against misuse.

Using the app and the SDK services.

Data: records of what you do in the app, the operations you run, and the amount of AI or other services that you use. Our AI usage records contain the user, the feature, the model and the time. They do not contain the text of prompts.
Legal basis: contract, and legitimate interests.
Why: to run the service, to measure usage for billing and limits, and to improve and secure the product.

Support.

Data: what you write to us by email or in the support chat, and your contact details.
Legal basis: contract or legitimate interests.
Why: to help you.

Service emails.

Data: your email address and the facts needed to write the email (for example a licence key, an invitation, a receipt or a payment notice).
Legal basis: contract.
Why: to send messages that you need to run your account.

Staying safe and following the law.

Data: any of the data above that we need.
Legal basis: legal obligation and legitimate interests.
Why: to stop abuse and fraud, to protect our rights, and to answer lawful requests from public authorities.

If we want to use your data for a new purpose, we will tell you first and check that the law allows it.

We do not sell personal data. We do not use personal data to make automated decisions that have legal or similarly significant effects on people.

5. The SDK in your customers' products

When the SDK runs in a customer's product, it calls our server to check the licence key (section 4). It also saves small items in the browser of the person who uses the editor, for example preferences, undo history and a licence receipt. We do not receive these items. The SDK does not include advertising or behaviour tracking. If the customer turns on optional features, the SDK can contact other companies, for example to search stock images or to load fonts. Those companies then receive the search words and the user's IP address, and their own terms and privacy policies apply. The SDK also loads a few small files, such as emoji pictures and a helper for animated GIFs, from public content delivery networks (jsDelivr and unpkg) when a user opens those tools. Those networks receive the user's IP address. The customer who turns on a feature decides whether to use it and must tell its own users.

6. AI features

We do not run our own AI models. When you use an AI feature, the text, images, audio or video that you submit for that feature are sent through our servers to an AI provider. Providers that we use or may use include OpenAI, Anthropic and Fal. We may also use others, such as Google, Mistral, ElevenLabs and Stability AI. For the current list, contact us at hello@layermetry.com.

What is sent. Only what you submit to the feature, for example a prompt, an image, a clip or an audio file for transcription. Please do not submit anything that you do not have the right to submit, and do not submit sensitive personal data unless you must.
What we do not do. We do not use your content to train AI models of our own.
What the providers do. We use the providers' business and API services, not their consumer products. The business terms of the main providers we use, OpenAI and Anthropic, say that they do not use content sent through these services to train their models unless the customer agrees to it. The terms of other providers may differ, and every provider can change its terms. Each provider also keeps its own records and may keep content for a short time to prevent abuse. Their privacy policies apply to their use.
Generated files. Images and clips that an AI feature creates for you are stored for a limited time in our storage so you can download them, and are then deleted. The usual period is 30 days.
Bring your own key or model. A customer may connect its own AI provider account, key or model. In that case, content goes to the provider that the customer chose, under the customer's own agreement with that provider. We are not responsible for what that provider does.
Biometric and sensitive content. AI features may process faces, voices and other content about people. The person who submits the content must have the right to do so and any consent that the law needs.

7. Who receives personal data

We share personal data only with companies and bodies that help us run the service, and only as far as needed. These are our main types of supplier. Some may not be in use at all times.

Hosting and storage: Google Cloud (our servers are in Belgium) and MongoDB Atlas (our database).
Some email and storage services for the app: Amazon Web Services.
Fonts: Google Fonts, in the app and in the SDK when a user picks a Google font.
Website visit statistics: Plausible Analytics and PostHog (EU servers).
Product analytics in the app: PostHog (EU servers), Google Analytics through Firebase.
Sign-in: Auth0.
Payments and invoices: Chargebee.
Email delivery: Resend.
Customer records and sales contacts: Attio.
Support chat: Intercom.
Consent tool: Cookiebot.
AI providers: see section 6.
Professional advisers, insurers, auditors and lawyers, where they need the data.
Public authorities, where the law requires it.
A buyer or investor in a sale or reorganisation of the business. We would tell you and the buyer would have to follow this policy.

These companies act as our processors, or as controllers in their own right for their own purposes. We have contracts with them that require them to protect your data. For the current list of the suppliers who process customer data, contact us at hello@layermetry.com.

8. Transfers outside the United Kingdom

We are in the UK. Our website and the server side of our app run on Google Cloud servers in Belgium. Some suppliers, including several of our AI providers, are in the United States or other countries outside the UK and outside the European Economic Area. When personal data goes to such a country, we make sure that a lawful safeguard applies. This is one of the following:

the country or supplier is covered by a UK "adequacy" decision, which means the UK government has confirmed that its data protection is adequate (for example, the UK extension to the EU–US Data Privacy Framework for certified US companies);
the UK International Data Transfer Agreement or the UK Addendum to the European Union's standard contractual clauses;
another safeguard that UK law allows.

You can ask us for a copy of the safeguard that applies to your data.

9. How long we keep personal data

We keep personal data only for as long as we need it for the reason we collected it, and for as long as the law requires. We do not give one fixed time for everything. These are the rules we follow:

Contact messages and sales records: while the conversation or business relationship continues, and for a reasonable time after, in case you ask a follow-up question or there is a dispute.
Newsletter and waitlist: until you withdraw consent, or until the list has served its purpose. Addresses that are never confirmed are not used for marketing, and we delete them when we no longer need them.
Demo handoff records: only as long as needed to continue your demo session and for a short period of review.
Accounts, subscriptions and licence records: while your account is open, and then for the time we need to deal with claims. Tax and accounting records are kept for the period the law requires, which is currently six years in the UK.
AI-generated files: a limited time, usually 30 days.
Server logs and security records: a short period, long enough to find and fix faults and abuse.
Backups: until the backup is replaced by newer ones.

When the time ends, we delete the data or make it anonymous so that it cannot identify anyone. If you want us to delete something sooner, see section 10.

10. Your rights

Under UK data protection law you have the right to:

ask for a copy of your personal data (access);
ask us to correct data that is wrong;
ask us to delete your data, in some cases;
ask us to limit how we use your data, in some cases;
ask us to give you your data in a usable file, or to send it to another company, in some cases (portability);
object to uses based on our legitimate interests, and to direct marketing at any time;
withdraw consent, where we use consent. Withdrawing does not affect what we did before.

To use a right, email hello@layermetry.com. We may need to check who you are. We usually reply within one month. This can be longer for complex requests, and we will tell you why. There is normally no charge.

If we hold your data as a processor for a customer, we may send your request to that customer.

11. Complaints

If you are unhappy about how we have used your personal data, please tell us first. Email hello@layermetry.com and write "Privacy complaint" in the subject line. We will confirm that we have received your complaint within 30 days. We will look into it and tell you the result without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the European Union, you can also complain to your local data protection authority.

12. Security

We use measures that suit the risk, such as encrypted connections, access controls, and keeping secret keys in a secrets manager. No online service is completely secure. If a breach affects your data in a way that the law says we must report, we will report it.

13. Children

Our services are for businesses and professionals. They are not for children under 16, and we do not knowingly collect their personal data. You must be 18 or older to open an account (see our Terms of Use). If you think a child has given us data, email us and we will delete it.

14. Changes to this policy

We may update this policy. We will put the new version on this page and change the date at the top. If a change is important, we will tell you in a clear way, for example by email or a notice in the app.

15. Contact

Distra Labs Limited, trading as layermetry 66 Paul Street, London, EC2A 4NA, United Kingdom Email: hello@layermetry.com