How Layer handles your data
Last updated: October 12, 2026
What Layer does with what you upload and generate, what we never do with it, how long it is kept and how to ask about your personal data. It sums up our Terms of Service and Privacy Policy; where this page and those documents differ, they win.
If your studio signed an order form, a master services agreement or a data processing addendum with Layer, it may set different terms. Check it, or ask whoever manages your Layer contract.
How Layer uses your content
No training on your content
Customer data is never used to train foundation models. The Terms say that Layer shall not train any models, and shall not permit any model provider to train, on your Customer Content or Input (section 7.4). Customer Content is what you and your team share with Layer (images, designs, audio and video files, personal data and your inputs); Input is the prompts and files you give a model.
Running your generations
Layer runs your generations on third-party models, and those model providers are third-party services with their own terms and privacy policies (Terms, section 9.1). You give Layer, and the third-party providers directly involved in providing the service, a licence to process your Customer Content only to provide the service, maintain it, support you and comply with the law (section 6.2). You choose the model for every run, and an admin can restrict which models your team can use.
Workspace memory
When workspace memory is on, Layer may learn your workspace's preferences and the way you work in Layer, and use them to personalise the service for your workspace. That data stays scoped to your workspace and is not used to improve the service for any other customer. The Terms commit Layer to giving you a way to turn it off and to request deletion of what was retained (section 7.9).
Usage data
Layer collects usage data: aggregated, statistical information about how the product is used that does not identify you, your users or any individual. We use it to run and improve Layer. Workspace memory is not usage data (section 7.6).
Workspace isolation
Each workspace's data is kept to that workspace, with no mixing of data between customers. In a parent and child workspace setup, each child workspace has its own assets, models and members.
Your personal information
What we collect
The Privacy Policy lists it: contact information (name, email address, phone number), device information (such as IP address and device identifiers) and, if you buy from us, billing information. We do not rent or sell your information, and we share it with third parties only as the Privacy Policy describes.
Your rights
Depending on where you live, you may have the right to access your personal information, receive a copy of it, correct it, have it erased, object to or restrict its processing, and complain to a data protection authority. To exercise them, email support@layer.ai. To delete your account yourself, see Delete your account or a workspace.
Your studio's users
When Layer processes personal data on your studio's behalf, Layer is the processor and your studio is the controller, and a data processing addendum between Layer and your studio governs that processing (Terms, section 8).
Retention and deletion
How long data is kept
Layer keeps personal information for as long as it needs to for the purposes in the Privacy Policy, unless the law requires or allows longer. Data Layer processes for a customer is kept as long as that customer's contract sets out, or as the customer instructs (Privacy Policy, section 4).
When an account or workspace is deleted
When an account is closed, Layer deletes the account and the content stored in it, including any workspace memory, and may still recover deleted content for a limited period afterwards (Terms, section 13.3). A workspace that an admin deletes is closed at once and deleted after a grace period, during which an admin can restore it. Layer may also close and delete a workspace that has gone without payment, after notifying its admin by email and in the app; section 13.5 of the Terms sets out when and how. See Delete your account or a workspace.
Keep your own copies
Layer is not a storage, backup or archiving service. Keep the files you need in your own storage (Terms, section 3.5).
Security and compliance
SOC 2 Type II
Layer is independently audited and SOC 2 Type II certified. Enterprise customers can get the full audit report under NDA as part of procurement; contact our sales team.
Access and audit
Admins control who can sign in and what they can do with single sign-on, SCIM provisioning, roles and groups, and can review and export what everyone in the workspace did from the audit log. See Enterprise questions for where each is set up.
What not to upload
Do not share data that special laws protect or that needs special handling, such as protected health information or payment card data, unless Layer has agreed to it in writing with the right agreement in place (Terms, section 6.3).