Privacy Policy

The privacy of your data, and it is your data, not ours, matters a lot to us. This policy explains what we collect and why, how we handle it, and your rights. We never sell your data.

Who we are

Laya is a trading name of With Locus Software Ltd, a company registered in England & Wales with company number 16900164. Our registered office is Units 2 & 3 West Down Farm, Corton Denham, Sherborne, Dorset, DT9 4LG, United Kingdom. When we say "Laya", "we", "our" or "us", we mean With Locus Software Ltd.

This policy covers the Laya desktop app, the web app at app.laya.inc, our API and MCP server at api.laya.inc, and this website at laya.inc (together, the "Services"). For the personal data described here, we are the controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Laya is used by teams. An organization decides what files and other content its members put into its Laya workspace, and we process that content to provide the Services to the organization. If you are a member of someone else's organization and have questions about content they hold about you, please also contact that organization.

You can reach us about anything in this policy at support@laya.inc.

What we collect and why

Our guiding principle is to collect only what we need. In practice:

Account information

When you sign up, we collect your name and email address, and an optional profile picture. If you sign in with Google, Google shares your name, email address and profile picture with us. If you sign in with an email link, we send a one-time link to your email address. We use this to create and secure your account, identify you to your teammates, and send you essential emails about your account.

Organizations and teammates

We store the organizations you create or join, their names and logos, who their members are and what role each member has. When you invite someone, we store their email address and send them an invitation.

Your content

We store the files you upload (such as images, video, audio and documents), the folders you organize them into, and their metadata. To make your files useful we create thumbnails, previews and lower-resolution video proxies, and, where transcription is available, we transcribe speech in audio and video so you can search it. We also keep a history of changes to files and folders (who changed what, and when) so your team can see what happened.

If you use the Laya AI assistant, we store your conversations so you can return to them, and we send your messages, along with the content the assistant needs to answer, to our AI providers to generate a response. We do not use your content to train AI models, and our AI providers do not use it to train theirs.

Connected apps and AI clients

You can connect AI tools and other apps to Laya through our MCP server and API. When you do, we record the app, the permissions you granted and the access tokens we issued, so the app can act on your behalf. What the app does with the data it receives is governed by that app's own privacy policy. You can revoke access at any time.

Billing information

If your organization subscribes to a paid plan, payment details are submitted directly to our payment processor, Stripe, and never reach our servers. We store a reference to your Stripe customer and subscription, your plan, seat count and storage usage, so we can bill you correctly, send invoices and provide billing support.

Usage, device and log data

When you use the Services, we collect information such as your IP address, browser and operating system, the pages and features you use, and errors you run into. We keep the IP address and browser of each signed-in session for security. We use this to keep the Services secure, prevent abuse, fix bugs and understand how Laya is used so we can improve it.

Waitlist and correspondence

If you join our waitlist, we store your email address and when you signed up, so we can invite you to Laya. When you email us, we keep the correspondence so we can help you and refer back to it if you contact us again.

Desktop app permissions

The Laya desktop app may ask for permission to show notifications. This is optional and the app works without it.

Connected social accounts

Laya lets your organization connect social media accounts so you can publish content and see how it performs, all from Laya. Connecting an account is optional and only happens when you sign in to the platform and approve the permissions it shows you.

What we store

For each connected account, we store:

• The platform's ID for the account, and whether it is a personal profile, Page or business account
• The account's username, display name and profile picture link
• The OAuth access token and, where the platform provides one, the refresh token, together with when they expire and the permissions (scopes) you granted
• Whether the connection is working, and which member of your organization connected it

Access and refresh tokens are encrypted at rest with AES-256-GCM before they are written to our database, and are only decrypted on our servers when we need to call the platform for you. A connected account belongs to your organization, so any member of the organization can use it in Laya.

What we access from each platform, and why

We use the permissions below only to show you which account is connected, to publish content when you or a member of your organization asks us to, and to show you insights about your accounts and posts in Laya. We never post without an instruction from you, never sell platform data, and never use it for advertising.

Each platform's own privacy policy explains how it handles your data. Laya is not affiliated with or endorsed by any of these platforms.

How long we keep it

We keep a connected account for as long as it stays connected. We refresh its tokens and profile details once a day so the connection keeps working. If the platform tells us the connection is no longer valid, we mark it as needing to be reconnected. Insights we fetch are used to show you performance in Laya and are deleted when the account is disconnected. The short-lived records we create while you sign in to a platform expire within minutes and are then deleted.

Disconnecting and revoking access

You can disconnect an account at any time in Laya under Settings → Social accounts. This immediately deletes the connection from our database, including its tokens. Deleting your organization also deletes all of its connected accounts.

Disconnecting in Laya stops us using the account, but the platform may still list Laya as an authorized app until you remove it there. You can remove Laya in the connected or authorized apps section of each platform's settings, or for YouTube and Google, at security.google.com/settings/security/permissions. Once you revoke access on the platform, our tokens stop working.

YouTube and Google user data

Laya uses YouTube API Services to let you connect your YouTube channel, upload videos and see analytics. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

We request these Google permissions for YouTube: youtube.upload to upload videos you choose to publish, youtube.readonly to show your channel and its videos, and yt-analytics.readonly to show your channel's analytics. If you sign in with Google, we also receive your name, email address and profile picture.

You can revoke Laya's access to your Google account at any time at security.google.com/settings/security/permissions, and you can disconnect your channel in Laya under Settings → Social accounts, which deletes the tokens we hold.

Laya's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• Only use Google user data to provide and improve the features you can see in Laya
• Only transfer it to others when needed to provide those features, to comply with the law, or as part of a merger or acquisition, with notice to you
• Never use it to serve ads, and never sell it
• Never use it to develop, improve or train generalized AI or machine learning models
• Do not let humans read it unless you ask us to, it is needed for security or to comply with the law, or it has been aggregated and anonymized

Deleting your data

You can ask us to delete your data at any time. There are two ways:

1. Disconnect in Laya. Go to Settings → Social accounts and disconnect the account. We delete the connection straight away.
2. Email us. Send a request to support@laya.inc from the email address on your Laya account. Tell us whether you want to delete a connected social account, your whole Laya account, or both. We may need to confirm it's you before acting.

When you delete a connected social account, we delete:

• The OAuth access and refresh tokens for that account
• The account's platform ID, username, display name, profile picture link and granted permissions
• Any insights we have fetched for that account

When you ask us to delete your Laya account, we also delete your profile, sessions and sign-in methods, your AI assistant conversations, and your membership of each organization. Organizations you are the only admin of, with their files and connected accounts, are deleted too, unless you hand them to another member first. We complete deletion within 30 days and confirm by email.

Content you published to a platform through Laya stays on that platform until you delete it there. We may keep a limited record, such as invoices, where the law requires it.

Our lawful bases

Under UK GDPR we must have a lawful basis for each use of your data. We rely on:

• Contract: to create your account, store and process your content, connect your social accounts and publish to them at your request, run the AI assistant, and bill your organization.
• Legitimate interests: to keep the Services secure, prevent fraud and abuse, fix bugs, understand how Laya is used so we can improve it, and run our waitlist. We balance these interests against your rights, and you can object at any time.
• Legal obligation: to keep financial records and respond to lawful requests.
• Consent: for optional cookies and anything else where we ask. You can withdraw consent at any time.

Who we share data with

We use the following service providers (subprocessors) to run Laya. Each only processes data on our instructions and under a contract that protects it.

Beyond these providers, we only share your data:

• At your direction, for example when you publish to a connected social account or connect an AI client through our MCP server
• With other members of your organization, who can see the content and connected accounts in it
• When required by law, for example in response to a valid court order. We will tell you first unless we are legally prevented from doing so
• If our business is sold or merged. We'll tell you before your data is transferred or becomes subject to a different privacy policy

No one at Laya looks at your content unless you ask us to (for example in a support request), or we need to in order to fix an error, investigate abuse, or comply with the law.

International transfers

We are based in the UK, but most of our providers store and process data in the United States. When we transfer personal data outside the UK, we make sure it stays protected, by relying on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more details about these safeguards.

How long we keep data

We keep personal data only as long as we need it:

• Account and organization data while your account is active, then deleted within 30 days of a deletion request
• Deleted files and folders can be restored for 30 days, then they are permanently deleted
• Connected social accounts until they are disconnected or the organization is deleted
• Usage, analytics and log data for up to 12 months
• Billing records for 6 years, as required by UK tax law
• Support correspondence for up to 3 years after your last message
• Waitlist sign-ups until you join Laya or ask us to remove you

Copies of deleted data can remain in encrypted backups for a short time after deletion before they are overwritten.

How we secure your data

All data is encrypted in transit with TLS and encrypted at rest by our hosting providers. Social account tokens get an extra layer of application-level encryption. Private files are only served through short-lived signed links. Access to production systems is limited to the people who need it. If you think you've found a security problem, please email support@laya.inc.

Cookies

A cookie is a small piece of text stored by your browser. We use as few as we can:

• Essential cookies keep you signed in to Laya. The Services can't work without them.
• Analytics cookies from PostHog (served from p.laya.inc) help us understand how people use this website and Laya. They do not track you across other websites.

We don't use advertising cookies. This website also loads fonts from Google Fonts, which means Google receives your IP address. You can block or delete cookies in your browser settings, and you can object to analytics by emailing us, though blocking essential cookies will stop you from signing in.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you and get a copy of it
• Correct personal data that is wrong or incomplete
• Erase your personal data (see Deleting your data)
• Restrict how we use your personal data
• Object to processing based on our legitimate interests
• Data portability, which means receiving your data in a common, machine-readable format
• Withdraw consent at any time where we rely on it
• Not be subject to decisions based solely on automated processing that significantly affect you. We don't make decisions like this

To use any of these rights, email support@laya.inc. We'll respond within one month. We may need to confirm your identity first, and some data may be exempt, for example where we must keep it by law.

If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can also complain to your local data protection authority.

Children

Laya is built for businesses and is not intended for anyone under 18. We don't knowingly collect data from children. If you think a child has given us their data, please contact us and we'll delete it.

Changes and questions

We may update this policy to reflect changes to Laya or the law. When we make a significant change, we'll update the date at the top of this page and let account holders know by email or in the app.

If you have any questions about this policy, your data or your rights, email support@laya.inc or write to With Locus Software Ltd, Units 2 & 3 West Down Farm, Corton Denham, Sherborne, Dorset, DT9 4LG, United Kingdom.