Data processing agreement

This agreement describes how the service actually handles data today. It is being reviewed by a lawyer before paid plans open; until then, treat it as a working draft.

1. Who's who

This agreement is between your shop (the controller) and 12658097 Canada Inc., doing business as Layers3D, of Cambridge, Ontario, Canada (the processor). You decide why and how your customers' personal data is used. We process it only to run Layers3D for you. You accept this agreement when you accept the terms at sign-up.

2. What we process

Whose data: your customers and their contacts, and your own staff.
What data: names, email addresses, phone numbers, company names, shipping and billing addresses, the files they upload, quotes, orders, prices, messages, and anything else you choose to enter.
What for: quoting, orders, production, shipping, invoicing, emails to your customers, and the other features you use.
How long: while your account is open, plus the 90 days after cancelling described in section 9.

We don't collect sensitive data like health records or government ID numbers, and you shouldn't put them in Layers3D.

3. What we promise

We only use your data to run the service for you, following your instructions, which are these terms and how you set up and use the software. If we think an instruction breaks the law, we'll tell you.
We never sell it, never show it to other shops, and never use it to train AI.
Only people who need to can see it, and they're bound to keep it confidential. We look at a shop's data only when you give us a support login (it expires after 30 minutes and shows in your audit log), to keep the service secure, or when the law requires it.
We help you answer your customers' requests to see, fix or delete their data. Most of that you can do yourself in the software.
We help you with privacy reviews and regulators' questions about our part, within reason.

4. Security

Every record is tied to your shop, and other shops can't reach it. Automated tests check this on every change.
Data is encrypted in transit. Passwords are hashed. Integration secrets and two-factor secrets are encrypted at rest.
Staff roles and permissions, two-factor sign-in, and an audit log of who changed what.
Backups: the database every night, with the last 30 kept in locked storage, and files every 3 hours, with copies kept for 90 days.

5. If something goes wrong

If we find a breach that affects your data, we'll tell you without undue delay, and within 72 hours of confirming it. We'll say what happened, what data was involved, and what we're doing about it, and help you with any notices you need to send.

6. Subprocessors

These companies help us run Layers3D and may handle your data. Each one is bound to protect it at least as well as this agreement does.

Company	What for	Where
Railway	Runs the app and the database	North America
Cloudflare (R2)	Stores uploaded files and backups	North America
Resend	Sends emails to you and your customers	United States
Stripe	Your Layers3D subscription, and your customers' card payments through your own Stripe account	United States, Canada
Google (Maps Places)	Address lookup as you type an address	United States
OpenStreetMap (Nominatim)	Address lookup, when Google isn't set up	European Union
Apple, Google, Mozilla push services	Delivers app notifications to staff devices that turn them on	United States

We'll announce a new subprocessor inside the software at least 30 days before it starts. If you object for a good reason and we can't work it out, you can cancel and we'll refund any prepaid time you haven't used.

7. Apps you connect

Apps you connect yourself are not our subprocessors. They work under your own account with them, and you choose what they receive. That includes your AI provider (for example Anthropic or OpenAI, on the key your shop adds), Claude or ChatGPT if you connect them, Google (Gmail, Calendar, Ads), Microsoft 365, Shopify, Etsy, WooCommerce, Wave, QuickBooks, Xero, ShipStation, ClickShip, Freightcom, Twilio, Quo, Aircall, Calendly, Mailchimp, Brevo, Pushover and your printers' own services.

8. Moving data across borders

We're in Canada and some subprocessors are in the United States, so your data may be stored or processed there. Where the GDPR or UK GDPR applies, the EU Standard Contractual Clauses (controller to processor) and the UK Addendum are part of this agreement for those transfers, and we hold our subprocessors to the same.

9. When you leave

You can export your orders, customers, quotes and files at any time. After you cancel and your paid time runs out, we keep your data for 90 days, emailing you at 60 and 83 days, then delete your shop's data and files. Nightly database backups roll off within 30 days after that, and file backups within 90 days. You can ask us to delete everything sooner. We keep only what the law makes us keep, like billing records.

10. Checking up on us

We'll answer reasonable written questions about how we protect your data, and share our security details at layers3d.ca/security. If the law requires an audit, we'll work out a reasonable time and scope with you, at your cost.

11. The rest

Liability under this agreement is covered by the limits in the terms of service. If this agreement and the terms disagree about personal data, this agreement wins. Ontario law applies, as in the terms.

Contact

Privacy and data questions: contact@layers3d.ca.