Privacy Policy

Last updated: July 22, 2026

Draft for legal review. This is a standard SaaS privacy-policy template provided as a starting point, not legal advice. Have qualified counsel review it — including whether it needs to be adapted for GDPR, CCPA, or other regimes that apply to your users — before relying on it.

This Privacy Policy explains what information OnboardLayer ("we", "us") collects when you use the Service, how we use it, and who we share it with.

1. Information we collect

Account information: name, email address, and password (handled by our authentication provider — we never see or store your plaintext password).
Billing information: handled by our payment processor; we do not store full card numbers on our own servers.
Usage & product data: onboarding call/session records, prompts and business-context details you provide to the onboarding agent, generated assets (text, images, video, websites), and metering data (feature usage, monthly credit consumption) used to enforce plan limits.
Technical data: log data such as IP address, browser/device information, and timestamps, used for security, rate limiting, and abuse prevention.

2. How we use your information

To provide, maintain, and secure the Service, including enforcing per-account rate limits and usage quotas.
To process the AI-generation requests you initiate (your prompts and business context are sent to our AI sub-processors solely to fulfill your request).
To bill your subscription and communicate about your account (billing, security, trial/renewal notices).
To improve the Service and diagnose problems.

3. Sub-processors & third parties

We share data with the following categories of third-party sub-processors, only as needed to operate the Service:

Supabase — authentication, database, and serverless functions.
AI providers (e.g. Anthropic, OpenAI, kie.ai) — process the prompts and content you submit to AI-powered features, solely to generate the output you requested.
Payment processor — handles billing; we do not store full payment card numbers ourselves.

We do not sell your personal information.

4. Data retention

We retain account and usage data for as long as your account is active, and for a reasonable period afterward for legal, billing, and security purposes. You may request deletion of your account and associated data by contacting us (subject to records we're required to retain by law).

5. Security

We use industry-standard safeguards, including encrypted connections, authenticated and rate-limited access to AI/data services, and role-based access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your rights

Depending on where you're located, you may have rights to access, correct, export, or delete your personal information. Contact us at [support email] to exercise these rights.

7. Children's privacy

The Service is not directed to individuals under 16, and we do not knowingly collect personal information from them.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email.

9. Contact

Questions about this policy or your data? Contact us at [support email].