Privacy Policy
Your data, handled with care.
Last updated January 2026 · Effective January 14, 2026
Sublayr (“we,” “us”) provides infrastructure for deploying and operating AI agents. This policy explains what information we collect, how we use it, and the choices you have. We do not sell personal data, and we do not use customer prompts, agent data, or conversation content to train any models.
Information We Collect
We collect information in three ways — what you give us directly, what’s generated by using the product, and what we receive automatically.
Account Information: name, work email, company, and billing details, provided when you sign up or are added to a workspace.
Agent & Usage Data: configs, run logs, traces, tool-call metadata, and cost data generated as your agents operate on Sublayr.
Technical Data: IP address, browser type, device identifiers, and log data collected automatically for security and diagnostics.
How We Use It
We use collected data to operate the service, keep it secure, and communicate with you — nothing beyond that scope.
We provide, maintain, and improve the platform; monitor for abuse, fraud, and security threats; process billing and send account or service notices; respond to support requests; and send product updates you can opt out of at any time.
Data Processing & Sub-Processors
We use a limited set of infrastructure and service providers to operate Sublayr, each bound by a data processing agreement. These include cloud infrastructure for compute and storage, a payment processor for billing only (no raw card data touches our servers), an email delivery provider for transactional and account notices, and error monitoring tools for technical diagnostics only.
A current sub-processor list is available at our Trust Center.
Security & Retention
We hold data only as long as it's needed to provide the service, and protect it with layered technical safeguards.
Data is encrypted in transit (TLS 1.2+) and at rest. Access is controlled by role-based permissions, audited internally. Account data is retained while your account is active, plus 30 days. Run and trace data is retained per your plan's configured window. Data is deleted or anonymized on account closure, per your request.
International Transfers & Residency
Data may be processed in the region you select at signup. Enterprise plans can pin data residency to a specific region: US, EU, or APAC. Standard Contractual Clauses apply to cross-border transfers where required, and Enterprise customers may request a Data Processing Addendum (DPA).
6. Your Rights
Depending on where you’re located, including under GDPR and CCPA, you have rights over your personal data: to access the personal data we hold about you, to correct inaccurate data, to request deletion (subject to legal retention requirements), to export your data in a portable format, and to object to or restrict certain processing.
To exercise any of these rights, email privacy@sublayr.ai.
Cookies
We use a small number of cookies for authentication, session state, and basic product analytics — no third-party ad tracking. Essential cookies for login and session are always on. Analytics cookies can be disabled in Cookie Settings.
Changes to This Policy
If we make material changes, we'll notify account admins by email and update the "last updated" date above.
Contact
Questions about this policy or our data practices can be sent to privacy@sublayr.ai.
