--- title: "Privacy Policy - 0layers" description: "Understand how 0layers collects, uses, and protects your personal data. Covers data processing, third-party services, your rights, and how to contact us." canonical: "https://0layers.com/legal/privacy" source: "https://0layers.com/legal/privacy" --- # Privacy Policy - 0layers > Understand how 0layers collects, uses, and protects your personal data. Covers data processing, third-party services, your rights, and how to contact us. ## Privacy Policy Last updated: August 27, 2026 ### 1\. Information We Collect We collect information that you provide directly to us when you create an account, use our services, or communicate with us. This includes: - **Account Information:** Email address, name, and authentication credentials - **Usage Data:** Templates created, render requests, and interaction history - **Brand Source Material:** A public business website you submit or, when you choose Instagram setup, the public profile username, profile URL, display name, biography, profile image, public account metadata, and up to 12 recent public posts, including captions, media previews, hashtags, mentions, timestamps, post URLs, and engagement counts - **Payment Information:** Processed securely by Polar (we do not store card details) - **Technical Data:** IP address, browser type, device information, and cookies - **Advertising and Analytics Data:** Information about your interactions with our website, including campaign parameters, referring site, and milestones such as account claim, first useful feed, save, or download. Google click identifiers are converted to a one-way SHA-256 fingerprint before durable storage; we do not store the raw identifier. Instagram import is limited to a public profile that you own, manage, or are authorized to use. Do not submit profiles focused on children or material containing sensitive personal information that is not needed for the brand purpose. We do not use this import to access private posts, direct messages, stories, comments, follower lists, contact details, or related profiles. The extraction provider's temporary raw public profile result may contain broader public account metadata, including contact or related-profile fields. 0layers immediately filters those excluded fields, does not retain or use them, and deletes the provider run and its exact temporary stores after processing. ### 2\. How We Use Your Information We use the information we collect to: - Provide, maintain, and improve our services - Turn an authorized public source into brand context, owned reference collections, private campaign suggestions, and generated content for your workspace - Process your transactions and send you related information - Send you technical notices, updates, and support messages - Respond to your comments, questions, and customer service requests - Monitor and analyze trends, usage, and activities in connection with our services - Measure consent-permitted advertising conversions without storing raw Google click identifiers in our durable application records - Detect, prevent, and address technical issues and fraudulent activity We do not use Instagram import for people search, follower discovery, audience profiling, contact enrichment, or identity resolution. Campaign suggestions remain private. Accepting one only creates a campaign for review; generation and credit spend require another explicit action. ### 3\. Information Sharing and Disclosure We may share your information in the following situations: - **Service Providers:** With third-party vendors who perform services on our behalf, such as authentication, database hosting, payment processing, and file storage - **Source Extraction Providers:** We send a submitted website URL to Firecrawl for website extraction. If you choose Instagram setup, we send one public profile username to Apify so its Instagram Profile Scraper can return a temporary public profile result and recent public posts. That provider result can include broader public account metadata; 0layers immediately filters it to the profile, biography, public links, avatar, post captions, media, and aggregate metrics used by the feature, then deletes the provider run and its exact temporary stores. Apify acts as a service provider for this processing. See [Apify's Data Processing Addendum](https://docs.apify.com/legal/data-processing-addendum). - **AI Processing Providers:** To analyze visual style, synthesize brand context and topics, create private campaign suggestions, and generate content, we send selected source material through Vercel AI Gateway to configured model providers, currently OpenAI and Google. For Instagram setup, this can include the normalized public profile, captions, and copied post previews described above. These providers process the material to provide the service; we do not authorize its use for model training. - **Google Analytics and Google Ads:** When marketing is permitted, we share website and conversion events with Google to measure campaign effectiveness and attribute actions such as signup and starting brand generation. These browser events use pseudonymous browser and campaign identifiers and are not sent by us with your email, name, or account ID. See [Google's Privacy Policy](https://policies.google.com/privacy) - **Legal Requirements:** When required by law or to protect our rights - **Business Transfers:** In connection with a merger, acquisition, or sale of assets - **With Your Consent:** When you explicitly agree to share information ### 4\. Cookies and Tracking Technologies We use cookies and similar tracking technologies to track activity on our service. For visitors in the European Economic Area and United Kingdom, we display a cookie consent banner that allows you to choose which categories of cookies to accept. You can withdraw marketing consent at any time using the persistent privacy control in the lower corner of the page. For visitors in the United States, analytics and marketing cookies are enabled by default. California residents may opt out of data sharing as described in the "Your Rights" section below. For more information, see our [Cookie Policy](https://0layers.com/legal/cookies). ### 5\. Your Rights (GDPR & CCPA) Depending on your location, you may have the following rights: - **Access:** Request access to your personal data - **Correction:** Request correction of inaccurate data - **Deletion:** Request deletion of your data - **Portability:** Request a copy of your data in a machine-readable format - **Objection:** Object to processing of your data - **Withdrawal:** Withdraw consent at any time (does not affect prior processing) To exercise these rights, please contact us at [privacy@0layers.com](mailto:privacy@0layers.com) If you do not have a 0layers account but control a public Instagram profile that may have been imported by a customer, you may still request access, restriction, objection, or deletion. Include the profile URL and your request. We may ask for proportionate proof that you control the public profile, such as a temporary verification value in its public bio, but we will not ask for your Instagram password or private content. We do not disclose the identity of the customer who submitted the profile. **California Residents:**We share certain information with advertising partners for targeted advertising purposes, which may be considered "sharing" or "selling" under California law. You may opt out of this sharing by contacting us at [privacy@0layers.com](mailto:privacy@0layers.com) with the subject line "Do Not Sell or Share My Personal Information." ### 6\. Data Security We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. ### 7\. Data Retention We retain your personal data for as long as necessary to provide our services and comply with legal obligations. When you delete your account, we will delete or anonymize your data within 30 days, except where retention is required by law. Content you like or save is kept in your account-level My Library. Deleting a brand removes its configuration and feed access, but items retained in My Library remain available until you remove them or delete your account. A normalized Instagram profile snapshot, copied post previews, its source collection, and pending campaign suggestions are retained with the brand so the service can generate and explain its context. Deleting the brand removes those input materials through our durable deletion process. If retained My Library content includes personal data covered by a verified third-party request, we assess and remove the affected items separately without deleting unrelated customer content. Apify temporarily processes the submitted username and public results while the import runs. After we normalize a successful result, we call Apify's deletion endpoints for the run's default dataset, key-value store, request queue, and the finished run itself. If a request fails, we retain an opaque cleanup receipt and retry; Apify's platform retention applies until deletion succeeds. The image copies we keep in our own private storage follow the brand and account deletion rules above. AI providers process selected source material during model requests under our provider settings and agreements. We configure AI telemetry not to record model inputs or outputs, and require no-training and retention controls before enabling Instagram setup in a production deployment. Brand context and generated results that we intentionally keep follow the brand and account deletion rules above. First-party acquisition attribution records are retained for up to 90 days. Pending attribution cookies expire after 30 days. Withdrawing marketing consent clears pending attribution and deletes attribution records linked to your authenticated account. Google Analytics and Google Ads apply their own retention and deletion controls to data they receive. A request to us covers our first-party attribution records; where applicable, we also use available processor controls for data associated with the request. ### 8\. Children's Privacy Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us. ### 9\. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Significant changes will require re-consent via our cookie banner. ### 10\. Contact Us If you have questions about this Privacy Policy, please contact us: Email: [privacy@0layers.com](mailto:privacy@0layers.com)