1. Who we are
Layer is a micro survey service offered from the Netherlands.
Layer
Zandkampke 7
5221 GE 's-Hertogenbosch
The Netherlands
KvK: 89763300
VAT: NL003601819B35
Email: hilayernu
2. What this policy covers
This privacy policy explains how Layer collects, uses, stores, and protects personal data when you use our website (layer.nu) and our micro survey service. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch UAVG.
3. Data we collect
3.1 Account data
When you create a Layer account, we collect:
- Your email address (used for login and communication)
- First and last name (optional, for invoicing)
- Company name, address, and VAT number (optional, for invoicing)
- Your chosen language preference
- Authentication provider (email or Google)
3.2 Survey data
When visitors respond to a micro survey created through Layer, we collect:
- Survey responses (answers to questions)
- Email address of the respondent (only if the survey creator has enabled email collection)
- A timestamp of when the response was submitted
Layer acts as a data processor for survey response data. The survey creator (our customer) is the data controller and is responsible for informing their visitors about data collection.
3.3 Technical and security data
- IP address: stored only at account creation to prevent fraud and abuse. Not stored for survey respondents.
- Session cookie: a single cookie (
layer_session) used to keep you logged in. This is a strictly necessary, functional cookie and does not require consent. - Local storage: used to save your language preference, theme preference (dark/light mode), and style presets. This data stays in your browser and is never sent to our servers.
3.4 Payment data
When you purchase credits, we store the transaction amount, credit count, invoice number, and the date of purchase. Actual payment processing is handled by our payment provider Mollie. We do not store credit card numbers or bank account details.
3.5 Data we do not collect
We do not use tracking cookies or advertising pixels, and we do not build user profiles for advertising. Website statistics are measured with Umami, a privacy-first tool that uses no cookies, no fingerprinting, and stores no personal data: visitors remain completely anonymous. We do not sell or share your data with third parties for marketing purposes.
4. Why we process your data (legal basis)
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing our service (account, surveys, results) | Performance of contract (Art. 6(1)(b)) |
| Sending login verification codes | Performance of contract (Art. 6(1)(b)) |
| Invoicing and financial administration | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention (abuse, rate limiting) | Legitimate interest (Art. 6(1)(f)) |
| Sending team invitation emails | Performance of contract (Art. 6(1)(b)) |
5. Third parties
We use the following third-party services:
| Service | Purpose | Data shared |
|---|---|---|
| Google Fonts | Loading web fonts for the survey widget and dashboard | IP address (by Google's CDN) |
| Google (OAuth) | Optional social login | Email, name (only if you choose to log in this way) |
| Mollie | Payment processing | Payment amount, email (for the transaction) |
| SMTP provider | Sending login codes and team invitations | Recipient email, message content |
| EU VIES service | VAT number verification | VAT number (only if you enter one) |
We do not share any personal data with parties other than those listed above.
6. Where your data is stored
All data is stored on servers located in the Netherlands. We do not transfer personal data outside the European Economic Area (EEA), except when you choose to log in via a US-based OAuth provider (Google), in which case their own privacy policies apply to the authentication process.
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Account data | Until you delete your account |
| Survey responses | Until the survey creator deletes the survey, or deletes their account |
| Login codes | Automatically deleted after 1 day |
| Invoices and payment records | 7 years (Dutch fiscal retention obligation) |
| IP address (anti-fraud) | Until you delete your account |
8. Your rights
Under the GDPR, you have the following rights:
- Access: request a copy of all data we hold about you.
- Rectification: ask us to correct inaccurate data.
- Deletion: delete your account and all associated data via Settings in the dashboard, or by emailing us.
- Data portability: receive your data in a machine-readable format (CSV export is available for survey responses).
- Objection: object to processing based on our legitimate interests.
- Complaint: file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
To exercise any of these rights, contact us at hilayernu. We will respond within 30 days.
9. Cookies
Layer uses a single, strictly necessary cookie:
| Name | Purpose | Duration | Type |
|---|---|---|---|
layer_session | Keeps you logged in | 30 days | Functional (strictly necessary) |
Because this cookie is strictly necessary for the service to function, no consent is required under the ePrivacy Directive. We do not use any tracking, analytics, or advertising cookies. Website statistics are collected without cookies and fully anonymously (see section 3.5).
10. Security
We take appropriate technical and organizational measures to protect your data, including:
- Encrypted connections (HTTPS/TLS) for all data in transit, enforced with HSTS
- Login codes are stored as one-way hashes, not in plain text
- Rate limiting on login attempts, code requests and code verification
- Security headers, such as a Content-Security-Policy, and secure development practices to reduce the risk of common web vulnerabilities
- Configuration secrets (such as keys and credentials) are stored outside the web-accessible directory, and the database is only reachable with credentials that are not public
- Session cookies are set with HttpOnly and Secure flags
11. Survey creators: your responsibilities
If you use Layer to create surveys for your website visitors, you act as the data controller for the responses you collect. You are responsible for:
- Informing your visitors that you collect data via a micro survey
- Having a lawful basis (e.g. legitimate interest or consent) for collecting responses
- Including Layer's data collection in your own privacy policy, if applicable
12. Children
Layer is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this policy
We may update this privacy policy from time to time. If we make significant changes, we will notify you by email or through a notice in the dashboard. The date at the top of this page indicates when the policy was last updated.
14. Contact
For questions about this privacy policy or your personal data, contact us at: