Privacy Policy

MGR Products BV ("Layer Insights", "we", "us") operates the Layer Insights SaaS platform, layerinsights.io, and related integrations.

For personal data relating to Layer Insights account users, website visitors and business contacts, MGR Products BV generally acts as controller.

For merchant end-customer, order and event data that a merchant sends to Layer Insights or makes available through connected services, Layer Insights generally acts as processor on behalf of that merchant. In that processor role, the merchant is responsible for determining the applicable lawful basis and Layer Insights processes the data only on documented instructions, subject to applicable law and the parties' data processing terms.

Privacy contact: privacy@layerinsights.io

Depending on how you use Layer Insights, we may process:

• Account and business data: name, business email address, company name, store information, role, authentication records and subscription or billing administration data.

• Usage and security data: dashboard activity, feature usage, API activity, session and authentication logs, IP address, browser or device information, and operational error data.

• Connected merchant data: store URL, product and catalog metadata, orders, inventory, advertising, email and other commerce data that a merchant chooses to connect.

• End-customer event data: online identifiers, click identifiers, browser or device signals and customer identifiers such as email address where required for a configured merchant workflow. Where appropriate, identifiers are hashed or otherwise pseudonymised before transmission.

• Support and communications data: information provided when you contact us, request support, respond to a survey or communicate with our team.

We apply data minimisation and only seek data that is reasonably necessary for the relevant service, security, legal or operational purpose.

Where the GDPR applies and Layer Insights acts as controller, our principal legal bases under Article 6(1) are:

• Account creation, authentication and delivery of the SaaS service — Article 6(1)(b), performance of a contract or steps requested before entering into a contract.

• Subscription administration and payment processing — Article 6(1)(b), performance of a contract. Where accounting or tax records must be retained, Article 6(1)(c), compliance with a legal obligation, also applies.

• Service reliability, essential usage logging, fraud prevention, abuse prevention and information security — Article 6(1)(f), our legitimate interests in operating a secure, reliable service and protecting users, systems and data.

• Product improvement and service analytics that do not require consent — Article 6(1)(f), our legitimate interests in understanding and improving the service, balanced against the rights and interests of affected individuals.

• Analytics, cookies or similar technologies where consent is legally required — Article 6(1)(a), consent. Consent can be withdrawn where applicable.

• Transactional service communications — Article 6(1)(b) where necessary to provide the service. Optional marketing communications use consent or another lawful basis where permitted by applicable law.

• Compliance with legal, regulatory, tax, accounting and valid governmental requirements — Article 6(1)(c), compliance with a legal obligation.

• Business contact and partnership communications — Article 6(1)(f), our legitimate interests in managing business relationships, unless another basis is more appropriate.

Merchant and end-customer data. When Layer Insights processes Shopify merchant order data, customer data, pixel or event data, Klaviyo data or comparable connected-platform data solely on a merchant's behalf, Layer Insights acts as processor under GDPR Article 28. The merchant, as controller, determines the Article 6 legal basis for that processing. Layer Insights does not substitute its own independent Article 6 basis for the merchant's controller decision and processes such data only for documented merchant instructions and configured service purposes.

We use data only for defined purposes, including:

• Operating, maintaining and improving Layer Insights.

• Authenticating users and administering accounts, roles and subscriptions.

• Synchronising data from merchant-selected integrations and presenting reporting, attribution and intelligence.

• Executing merchant-initiated integration actions, including configured event, audience, template or privacy workflows.

• Detecting security incidents, fraud, misuse, outages and operational failures.

• Providing support and service communications.

• Complying with applicable legal and regulatory requirements.

We do not sell personal data to third parties.

When Layer Insights processes personal data on behalf of a merchant, we process it only for the services the merchant has configured and in accordance with documented instructions.

We apply tenant separation and role-based access controls, limit access to personnel and systems with a business need, support deletion and privacy workflows where applicable, and require relevant subprocessors to protect data in accordance with contractual and legal requirements.

A merchant remains responsible for its own notices, consent choices, lawful bases and instructions for its customers, except where Layer Insights independently determines a purpose and therefore acts as controller for that specific processing activity.

Layer Insights connects to third-party commerce, advertising, analytics, email, payment and support platforms when a merchant chooses to enable them. Data is transmitted to those services only as required for the merchant-selected integration or another disclosed purpose.

We also use service providers for functions such as infrastructure, communications, payment processing, monitoring and security. Providers that process Customer Data, Personal Data, production credentials or other sensitive information are subject to our vendor risk management process before use and at least every six months thereafter, with additional review after material changes or incidents.

Where required, we use appropriate contractual and data-protection safeguards for processors, subprocessors and international transfers.

This section describes how Layer Insights handles data received from Google APIs in accordance with the Google API Services User Data Policy.

What we access. Only after a merchant explicitly connects its own Google account:

• Google Ads (auth/adwords): campaign, ad group, cost and related advertising data from the accounts the merchant connects.

• Search Console (auth/webmasters.readonly): search performance for the merchant's own property, including queries, clicks, impressions, click-through rate and average position.

• Google Analytics 4 (auth/analytics.readonly): reporting data for the merchant's own property, including sessions, traffic sources and conversions.

We do not access Gmail, Drive, Calendar, Contacts, Photos or other Google Workspace services through these Layer Insights integrations.

How we use it. Solely to provide the merchant-facing functions the merchant selects, including measurement, attribution, reporting and approved Google Ads actions.

Who we share it with. We do not sell Google user data and do not use it for advertising, credit assessment or unrelated purposes. Google user data is not used to train third-party AI or machine-learning models. Service providers that necessarily store or secure the data act on our behalf under applicable contractual restrictions.

How we protect it. OAuth credentials are encrypted, access is tenant-scoped and role-controlled, and data in transit is protected using HTTPS/TLS.

Retention and deletion. Reporting data received from Google is retained only for the period needed for the configured service and the retention rules described below. A merchant can disconnect the integration, which removes the stored OAuth grant from Layer Insights, and can also revoke Google access through its Google account. Account-closure and deletion requests are handled under the retention and deletion rules below.

Limited Use. Layer Insights' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention depends on the data type and processing purpose. Our standard operational periods are:

• Raw event and operational logs: normally up to 90 days unless a shorter period is configured or longer retention is required for a documented security or legal reason.

• Aggregated commerce and analytics data: normally up to 24 months while the service is active, subject to merchant configuration and contractual requirements.

• Account data: retained while the account is active and deleted or anonymised after closure when no longer needed, subject to legal obligations.

• Accounting and tax records: retained for the legally required period.

• OAuth credentials: removed when the relevant integration is disconnected, revoked or no longer required.

Deletion requests are propagated to relevant systems and processors as required. Certain information may be retained where necessary for legal obligations, dispute resolution, fraud prevention, security evidence or enforcement of agreements.

Where the GDPR applies and we act as controller, you may have rights including:

• Access to your personal data.

• Rectification of inaccurate personal data.

• Erasure where the legal conditions are met.

• Restriction of processing in applicable circumstances.

• Portability for eligible data.

• Objection to processing based on legitimate interests.

• Withdrawal of consent where processing is based on consent.

To exercise a right, email privacy@layerinsights.io. We may need to verify your identity. You may also lodge a complaint with the competent supervisory authority, including the Dutch Data Protection Authority where applicable.

For personal data that Layer Insights processes only on behalf of a merchant, requests may need to be handled through that merchant as controller. We assist merchants with applicable data-subject requests as required by our processor obligations.

This section applies if and to the extent the California Consumer Privacy Act, as amended ("CCPA"), applies to the relevant processing.

Notice at Collection. The categories of personal information we may collect for our own business purposes include identifiers and account information, commercial or subscription information, internet or electronic activity information, device and network information, professional or business contact information, support communications, and analytics or inferences generated from use of the service. We use these categories to provide and secure the service, administer accounts and subscriptions, support users, improve the product, comply with law and manage business relationships. Retention is governed by Section 8 and is limited to what is reasonably necessary and proportionate for the disclosed purpose.

California rights. Subject to the CCPA and applicable exceptions, California residents may have the right to:

• Know the categories and specific pieces of personal information collected, sources, purposes and categories of recipients.

• Delete personal information.

• Correct inaccurate personal information.

• Opt out of the sale or sharing of personal information.

• Limit certain uses or disclosures of sensitive personal information where that right applies.

• Receive equal service and not be discriminated against for exercising CCPA rights.

Sale and sharing. For personal information Layer Insights processes for its own business purposes, we do not sell personal information and do not share personal information for cross-context behavioural advertising as those terms are defined by the CCPA. When we process merchant end-customer data as a service provider or contractor, we process it only for the specified merchant services and documented instructions and do not use it for unrelated independent purposes.

Submitting a request. California privacy requests can be submitted to privacy@layerinsights.io. We will verify requests as required by law. An authorised agent may submit a request where permitted, subject to appropriate verification of the agent's authority and the consumer's identity.

If our practices change in a way that creates a sale or sharing opt-out obligation, we will provide the legally required opt-out mechanism and honour applicable opt-out preference signals.

Layer Insights uses cookies and similar technologies for authentication, security, session continuity and, where enabled, analytics.

Non-essential analytics or tracking technologies are used only where an appropriate legal basis exists. On merchant storefronts, Layer Insights is designed to respect the merchant's configured consent signals and supported privacy controls.

You can manage applicable consent choices through the relevant website or merchant privacy interface.

We maintain administrative, technical and organisational safeguards appropriate to the nature of the service and data. These include role-based access controls, tenant isolation, encrypted transport using HTTPS/TLS, encryption of sensitive credentials at rest, controlled production access, logging and monitoring, secure development practices, incident response procedures, and documented backup and recovery controls.

Our detailed Information Security Policy defines data classification, vendor risk management, backup and disaster-recovery controls and review requirements.

Where personal data is transferred across jurisdictions, we apply safeguards required by applicable law. Depending on the transfer and parties involved, safeguards may include adequacy decisions, contractual protections such as standard contractual clauses, processor terms, data minimisation and technical controls.

Merchants are responsible for the legality of third-party destinations they independently configure, while Layer Insights remains responsible for safeguards applicable to transfers for which it determines or controls the recipient.

We review this policy periodically and update it when our processing, legal obligations or services materially change. The current version and effective date are published on this page. Where required, we will provide additional notice of material changes.

MGR Products BV

Netherlands

Privacy: privacy@layerinsights.io

General: info@layerinsights.io

For a privacy-rights request, include enough information for us to identify the relevant account or relationship without sending unnecessary sensitive information.