Privacy Policy

1. Introduction

Thank you for choosing LayerNext. LayerNext, Inc. (“LayerNext,” “we,” “us,” or “our”) is a Delaware corporation with its principal place of business at 235 Berry Street, Apt 415, San Francisco, CA 94158, and Canadian operations at 200-135 Innovation Drive, Winnipeg, MB R3T 6A8, Canada.

We provide an AI-powered bookkeeping and financial intelligence platform that integrates with QuickBooks Online and other financial services to automate transaction categorization, bank reconciliation, receipt matching, and financial insights for small and medium-sized businesses (“SMBs”) and accounting firms (collectively, the “Service”).

This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit our website at www.layernext.ai and its subdomains (the “Site”), use our web application at app.layernext.ai, our mobile applications, or any related services, sales, marketing, or events (collectively, the “Services”).

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you register for an account, subscribe to a plan, contact us, or otherwise interact with our Services.
This may include:

• Account Information: Name, email address, phone number, business name, and account credentials.
  
• Billing Information: Payment card details, billing address, and transaction history, processed through our third-party payment processors.
• Business Profile Information: Industry type, company size, fiscal year, and bookkeeping preferences you provide during onboarding.
• Communications: Messages, support requests, feedback, and any other content you send to us.

2.2 Financial Data Collected Through Integrations

When you connect your QuickBooks Online account or other financial services to LayerNext, we access and process financial data necessary to provide the Service.
This includes:

• Transaction Data: Bank and credit card transactions, including amounts, dates, payees, and descriptions imported via bank feeds and QuickBooks Online.
  
• Chart of Accounts and Categorization Data: Your QuickBooks account categories, classes, locations, and historical categorization patterns.
• Reconciliation Data: Bank statements, matched and unmatched transactions, and reconciliation status for connected accounts.
• Invoices, Bills, and Receipts: Documents you upload or that are imported from connected services for matching and record-keeping.
• Financial Reports and Insights: Derived financial metrics, cash flow analysis, and AI-generated financial insights produced by the Service.

We access this data solely through authorized API connections (e.g., Intuit’s QuickBooks Online API) using OAuth 2.0 authentication. We do not store your QuickBooks username or password. You may revoke our access at any time through your QuickBooks Online account settings.

2.3 Information Collected Automatically

When you access our Services, we automatically collect certain technical and usage information, including:

• Device and Browser Information: IP address, browser type and version, operating system, device identifiers, and language preferences.
  
• Usage Data: Pages visited, features used, actions taken within the application, timestamps, referring URLs, and session duration.
• Cookies and Similar Technologies: We use cookies, web beacons, and similar technologies to collect information about your browsing activity. See Section 8 (Cookies and Tracking Technologies) for details.

2.4 Information from Third Parties

We may receive information about you from third-party sources, including:

• Authentication providers (e.g., Google, when you use social login).
  
• QuickBooks Online and Intuit, through authorized API integrations.
• Analytics and advertising partners who provide aggregated usage data.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Improving the Service

• Automating transaction categorization, bank reconciliation, and receipt matching within your QuickBooks Online account.
  
• Generating AI-powered financial insights, cash flow analysis, and bookkeeping recommendations.
• Analyzing anonymized and aggregated usage patterns to improve our product features and user experience (see Section 3.5).
• Diagnosing technical issues, debugging, and improving platform performance and reliability.

3.2 Account Management

• Creating and managing your account.
  
• Processing payments and managing subscriptions.
• Communicating with you about your account, subscription status, and service updates.

3.3 Customer Support

• Responding to your inquiries, support tickets, and feedback.
  
• Providing onboarding guidance and feature walkthroughs.

3.4 Marketing and Communications

• Sending you product updates, newsletters, and promotional materials (with your consent where required by law).
  
• You may opt out of marketing communications at any time by clicking the unsubscribe link in any email or contacting us at support@layernext.ai.

3.5 AI Data Usage and Third-Party AI Services

LayerNext does not train AI models. We use third-party AI services to power our automation features, including transaction categorization, reconciliation, and financial insights. Your identifiable financial data is never used to train any AI model—ours or any third party’s.

We ensure that all third-party AI providers we use are configured to not retain or train on customer data. Data transmitted to third-party AI services is used solely to process your specific request and is not stored by those providers beyond the duration needed to generate a response.

We may use anonymized, aggregated, and de-identified usage patterns to improve our product features and user experience. This data cannot be used to identify you or your business.

4. How We Share Your Information

We do not sell your personal information or financial data to third parties. We may share your information only in the following circumstances:

4.1 Service Providers

We share information with trusted third-party vendors who perform services on our behalf, including:

• Cloud hosting and infrastructure (e.g., Amazon Web Services).
  
• Payment processing (e.g., Stripe).
• Analytics and monitoring services.
• Customer support and communication tools.
• Email delivery services.

These providers are contractually obligated to use your information only as necessary to provide services to us and are bound by confidentiality and data protection obligations.

4.2 QuickBooks Online / Intuit

When you authorize LayerNext to connect to your QuickBooks Online account, data flows between LayerNext and Intuit’s systems via authorized APIs. Our use of QuickBooks data is governed by Intuit’s developer terms and this Privacy Policy.

4.3 Accounting Firms (For Firm-Managed Accounts)

If your LayerNext account is managed by or connected through an accounting firm, bookkeeper, or fractional CFO, that firm may have access to your financial data within the Service as part of the services they provide to you. The firm’s use of your data is governed by your agreement with that firm.

4.4 Legal Obligations and Protection of Rights

We may disclose your information if required to do so by law, or if we believe in good faith that such disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request.
  
• Enforce our Terms of Service or other agreements.
• Protect the rights, property, or safety of LayerNext, our users, or the public.
• Detect, prevent, or address fraud, security issues, or technical problems.

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our Site of any change in ownership or use of your personal information.

5. Data Security

We take the security of your data seriously and implement industry-standard technical and organizational measures to protect your information, including:

• Encryption in Transit: All data transmitted between your browser/device and our servers is encrypted using TLS 1.2 or higher.
  
• Encryption at Rest: Financial data and personal information stored in our databases and cloud infrastructure is encrypted at rest using AES-256 encryption.
• Access Controls: We enforce role-based access controls, multi-factor authentication for internal systems, and the principle of least privilege for all personnel and service accounts.
• Infrastructure Security: Our Service is hosted on Amazon Web Services (AWS) with single-tenant architecture, ensuring that each customer’s data is logically isolated from other customers.
• Monitoring and Incident Response: We maintain continuous monitoring, logging, and alerting for security events, and we have an incident response plan for potential breaches.
• Regular Security Reviews: We conduct periodic security assessments and reviews of our systems, codebase, and operational practices.

While we strive to protect your information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Service at your own risk.

6. Data Retention

We retain your personal information and financial data for as long as your account is active or as needed to provide you with the Services. Specific retention periods include:

• Account and Profile Data: Retained for the duration of your active subscription and for up to 12 months after account termination, unless you request earlier deletion.
• Financial and Transaction Data: Retained for the duration of your subscription. Upon account termination, financial data is deleted or anonymized within 90 days, unless a longer retention period is required by applicable tax, accounting, or legal obligations.
• Backup Archives: Data in backup systems may persist for up to an additional 30 days after deletion from primary systems.
• Aggregated and De-identified Data: May be retained indefinitely, as it cannot be used to identify you.

When your information is no longer needed, we securely delete or anonymize it in accordance with our data retention policies and applicable law.

7. International Data Transfers

LayerNext operates infrastructure in Canada and the United States. Your information may be transferred to, stored, and processed in either country. If you are accessing our Services from outside of Canada or the United States, please be aware that your information may be transferred to jurisdictions that may have different data protection laws than your country of residence.

We take appropriate safeguards to ensure that your information is treated securely and in accordance with this Privacy Policy regardless of where it is processed, including relying on contractual protections for cross-border transfers.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your interactions with our Services. The types of cookies we use include:

• Strictly Necessary Cookies: Required for the operation of our Services (e.g., session management, authentication).
  
• Analytics Cookies: Help us understand how users interact with the Service so we can improve functionality and user experience.
• Preference Cookies: Remember your settings and preferences for a more personalized experience.

We do not use third-party advertising cookies or allow third-party advertisers to serve targeted ads on our platform based on your browsing behavior.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

9. Social Logins

We may offer the ability to register or log in using third-party account credentials (e.g., Google). If you choose this option, we will receive certain profile information from the provider, typically your name and email address. We use this information solely for account creation and authentication. We recommend reviewing the privacy policy of any third-party provider you use to log in.

10. Your Privacy Rights

Depending on your jurisdiction, you may have certain rights regarding the personal information we hold about you:

• Right of Access: Request a copy of the personal information we hold about you.
  
• Right of Correction: Request correction of inaccurate or incomplete personal information.
• Right of Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Right to Object: Object to certain processing of your personal information.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time.
• Right to Opt Out of Marketing: Unsubscribe from marketing communications at any time.

To exercise any of these rights, please contact us at support@layernext.ai. We will respond to your request within 30 days (or as required by applicable law). We may ask you to verify your identity before processing your request.

10.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share your information.
  
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising purposes.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To submit a request, email us at support@layernext.ai or call us at +1 (844) 685 5260. We will verify your identity and respond within 45 days.

10.2 European Economic Area (EEA) Residents

If you are a resident of the EEA, our legal bases for processing your personal information include: performance of our contract with you, our legitimate business interests, compliance with legal obligations, and your consent where applicable. You have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

10.3 Canadian Residents (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including the right to access, correct, and challenge the accuracy of your personal information. To make a request, contact us at support@layernext.ai.

11. Do-Not-Track Signals

Some browsers include a Do-Not-Track (“DNT”) feature that signals to websites that you do not wish to be tracked. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT signals. If a standard is adopted in the future, we will update this policy accordingly.

12. Children’s Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@layernext.ai. If we become aware that we have collected personal information from a child under 18, we will take steps to promptly delete such information.

13. Third-Party Websites and Services

Our Services may contain links to third-party websites, applications, or services that are not operated by us. We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of any third-party services before providing your information to them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The updated version will be indicated by a revised “Effective Date” at the top of this page. If we make material changes, we will notify you by email or by posting a prominent notice on our Site prior to the changes taking effect. Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us at: