Last updated: 10 October 2026
We store the minimum needed to run a paid service. We never sell your data. We never train models on your prompts, and we never resell your model usage.
Your AI provider API keys are encrypted before storage. You can run LayerFlow in a mode where your keys are never written to our servers at all.
LayerFlow is operated by Rohit Jadhav and Suresh Patel, a team registered in India. For any question about this policy or your data, email rjdhav67@gmail.com.
Account data — name, email address, and a hashed password if you use a password login. If you sign in with Google, we store your Google user ID and email only.
Workspace data — the projects, chat sessions, prompts, agents and files you create inside your workspace.
Billing data — your plan, subscription status, and transaction history. Card details are handled entirely by our payment processor (Dodo Payments) and never touch our servers.
Usage data — which models you called, token counts, cost per request, and the project each request was attributed to. This is what makes budget enforcement and cost reporting possible.
Technical data — IP address, request logs, and error traces, retained for security and debugging.
This is the most sensitive data we hold, so it gets the most specific treatment.
Keys are encrypted at rest with AES-256-GCM. The encryption key used for your keys is held separately from the database that stores them, so a full database compromise does not decrypt any key.
You can rotate your encryption key at any time. Rotation re-encrypts every stored key and records the event in an append-only audit log.
Direct mode — if you enable it, your key is used in-flight to call the provider and is never written to our database or our logs. Use this mode if you would rather we never persisted your key at all.
We never resell your model usage and never take a margin on it. You pay your provider directly; we bill you for LayerFlow only.
Your keys are never used to train any model, ours or anyone else's.
We do not sell your data to anyone.
We do not use your prompts or completions to train models.
We do not share your API keys with third parties.
We do not show advertising on LayerFlow.
We share only what is necessary to operate the service, with:
Infrastructure providers — Neon (database), Upstash (Redis and job queue), Vercel (frontend hosting), Fly.io (API hosting), and Cloudflare (DNS and traffic). They process data only as our sub-processors.
Payment processing — Dodo Payments handles all card data.
Email delivery — Resend sends transactional alerts, including budget threshold notifications.
Model providers — only if you choose to route a request through us, and only to the provider you selected. Those providers have their own data policies, which we do not control.
Account and workspace data — retained until you delete it or close your account.
Audit logs — retained for the life of the workspace, because they are the evidence record. You can export them at any time.
Request and usage logs — retained for 90 days by default, then aggregated or deleted.
Technical and security logs — retained for 90 days.
Deleted accounts are removed from active systems within 30 days and from backups within 90 days.
You have the right to access, correct, export, and delete your personal data, and to withdraw consent for processing.
Access and export — email us and we will provide everything we hold about you, in a machine-readable format, within 30 days.
Correction — you can edit most of your data directly in the app, or ask us.
Deletion — email us. We will delete your account and associated data and confirm when it is done.
Grievance redressal — you may complain to us first at rjdhav67@gmail.com. If unresolved, you may approach the Data Protection Board of India.
We do not require you to contact us before approaching a regulator.
Encryption — TLS in transit. AES-256-GCM at rest for stored API keys, with key separation and rotation support.
Access control — workspace-scoped authorisation on every request. API keys and provider keys are shown only as a hint, never returned in full.
Audit trail — append-only log of every security-relevant action, including key creation, use, and revocation.
Budget enforcement — when our enforcement systems cannot be reached, we reject requests rather than letting them through unmeasured. This is deliberate: a failure to measure must not become unlimited spend.
No system is perfect. If you discover a vulnerability, report it to rjdhav67@gmail.com and we will treat it as urgent.
LayerFlow is a developer tool and is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has provided us data, email us and we will delete it.
Our infrastructure providers process data outside India, primarily in the United States and Europe. Where data leaves India, transfers are made under appropriate contractual safeguards.
If we make a material change, we will notify you by email and update the date at the top of this page. Continued use after a change means you accept the revised policy.
Rohit Jadhav — LayerFlow
Email: rjdhav67@gmail.com
Product: https://layerflow.dev