Privacy Policy

1. Who we are

The controller of the personal data described in this policy is:

For any question about your data, including to exercise the rights described in section 14, write to us at contact@layro.ro or through our Contact page. We have not designated a Data Protection Officer; requests are handled by the Layro team, within the time limits set out in section 14.

2. Who this policy is for

Layro is used by different kinds of people, and the data we process about each is different. This policy therefore addresses three categories of data subject:

• Site visitors — people browsing our public website at layro.ro (section 3);
• Account holders — the professionals who create an account at app.layro.ro and manage their projects there, such as architects, architecture practices and interior designers (section 4);
• Invited clients — the people an account holder invites into a project to review and approve drawings. Clients do not create an account and have no contract with us, but their data is processed by Layro (section 5).

This policy is publicly available without signing in, so that it can also be read by invited clients, who have no account through which to reach it.

People appearing in uploaded content. Project files may incidentally contain data about other people — someone caught in a site photograph, say, or a name in a drawing's title block. We have no direct relationship with these people and cannot contact them individually: it is the account holder who decides what to upload and who confirms, through our Terms & Conditions, that they are entitled to do so. If this describes you, write to us at contact@layro.ro and we will explain what data we hold and how you can exercise the rights in section 14.

3. Visitors to layro.ro

When you visit our public website, we process:

• Usage and technical data — pages visited, browser and device type, operating system, and an approximate location inferred from your IP address. This data is collected through PostHog, in one of two modes. By default — if you have not chosen yet, or if you declined the banner — measurement runs without storing or reading anything in your browser, and the identifier used is generated on PostHog’s server and changes daily, so we cannot recognise you from one visit to the next. This rests on legitimate interests and you may object at any time. If you accept the banner, we additionally store a random identifier in your browser and in a cookie on layro.ro, which shows us returning visitors, and we capture clicks on page elements together with click and scroll maps. We do not record your session or screen in either mode, and we measure nothing at all if your browser sends a Do Not Track signal.
• Newsletter subscription data — if you subscribe to Layro news, we process the email address you enter and, if you choose to fill it in, your name. Subscription is confirmed by a validation email: the address joins the list only after you click the link in that message. We also keep the record of your consent — when you subscribed and the wording you agreed to. Details are in section 7.

Full details about cookies and similar technologies are in our Cookie Policy.

4. Account holders

To create and run your account in the application, we process:

• The steps of creating an account — in the application we measure how many people open the register form, how many submit it, how many are rejected with an error and how many go on to activate the account. That is five events, collected through PostHog as well, with nothing stored on your device and without your name, your email address or the contents of the form. This rests on legitimate interests and you may object at any time.
• Identification and contact data — first name, last name and email address;
• Authentication data — your password stored only as a cryptographic hash (bcrypt); we have no access to your password in clear text. Alongside it, the temporary account activation and password reset codes, and your session tokens;
• The link to your Google account, if you sign in with Google — we keep an identifier for your Google account and the fact that this sign-in method is active. We never receive or store your Google password. If you create the account through Google, it has no password with us at all until you choose to set one; if you first registered with an email address and password and later use that same address at the Google button, the two sign-in methods are linked to the same account and both keep working. No second account is created;
• Language preference — so we can show the interface and send emails in the language you chose;
• Your marketing choice — whether or not you agreed to receive Layro news, together with when you chose and the wording you agreed to. We keep this in order to be able to demonstrate consent, as Art. 7(1) GDPR requires;
• Subscription data — the plan you chose, the state of the subscription, the date of the next renewal or plan change, and the corresponding Stripe identifiers. We never receive or store your card details — those are entered directly into a secure page hosted by Stripe;
• The content you upload — projects, phases, folders, files and drawings, together with the marks, comments and approvals attached to them;
• Activity history — a record of what happened in a project (who uploaded a file, who added a mark, who approved a phase), together with the name of the person who acted and when;
• Technical logs — server and load balancer logs, containing IP addresses, request times and requested addresses. These are needed for security and for diagnosing faults.
• Error reports from the application — when the application hits an error, your browser sends us a report containing the error message, the place in the code where it occurred, your browser type, the application version, the address of the page you were on, and the last few actions that preceded it (the pages you moved through and the requests made to the server). The report carries your account identifier, so that we can connect one person’s errors while investigating a problem. It does not contain your name or email address, nor your password, session tokens or invitation links, nor the contents of your projects: identifiers in page addresses are replaced with generic placeholders before the report is sent, and your IP address is not stored. These reports are collected through Sentry (section 9), and we do not record your session or screen.
• Feedback, if you open the Feedback page in the application — at that moment we send Canny (section 9) your name, email address and account identifier, so that your suggestions and votes are recorded under your name without a separate account. After that Canny receives what you write there: feature suggestions, bug reports, comments and votes. Everything you post there — suggestions and bug reports alike — is visible, under your name, to everyone else who uses the boards, so do not include project details or anyone’s personal data in it. Your email address is not shown to them. If you never open the page, we send nothing;

Providing your name and email address is necessary to enter into and perform the contract: without them we cannot create your account. Alongside them we need some way of checking it is you at each sign-in — either a password you choose, or the confirmation we receive from Google if you prefer to sign in with your Google account. The remaining data arises from your actual use of the application.

5. Clients invited to a project

If you have been invited to view a project in Layro, we process:

• Your name, email address and language preference — supplied by the professional who invited you;
• Your invitation token, the time you were invited and the time you last opened the project — these are what let you in without an account or password;
• The content you create — the marks, comments and approvals you add to the project, together with your name and the time of each action, recorded in the project history.

Where your data came from. We did not obtain your name and email address from you directly, but from the professional running the project, at the moment they invited you. We tell you this under Art. 14 GDPR. It is they who decide whom to invite to a project; if you would rather not be invited, the most direct route is to tell them, but you can always come to us and use the rights in section 14 — including the right to object.

Who decides about your data. For the project data — the files, your markups, comments and approvals — the controller is the professional who invited you, and Layro acts as their processor: it handles that data solely on their instructions, under the Data Processing Agreement. If you want it deleted or corrected, the fastest route is to ask them directly. If you come to us, we pass the request on to them without delay.

We do not create an account for you and we never ask you for a password. Your access to the project works solely through the invitation link you received by email.

Error reports. If the application hits an error while you are using the portal, your browser sends us a technical report, just as it does for account holders (section 4). For you that report carries no identifier at all: it contains neither your name, nor your email address, nor the token from your invitation link, which is stripped out of the page address before the report is sent. The basis is our legitimate interest in keeping the application working, and you may object under section 14.

Feedback. The portal has a Feedback tab through which you can send us suggestions about Layro or report a problem. If you open it, we send Canny (section 9) your name and email address, together with an identifier derived from the email address, so that one person invited to several projects is recognised once. After that Canny receives what you write and vote on there; what you post is visible, under your name, to everyone else who uses the boards — other clients and Layro account holders included — but your email address is not. It receives nothing from the project. For this processing we are the controller, not the professional who invited you: it concerns your relationship with Layro, not the project. The basis is our legitimate interest in receiving and answering your suggestions and reports, and you may object under section 14. If you never open the tab, we send nothing.

6. Legal bases for processing

Each of the activities described above rests on its own legal basis under Art. 6 GDPR:

7. The email we send you

Layro sends three kinds of message, on different terms: the daily digest, which gathers the activity in your projects; marketing email, which you receive only if you subscribed; and transactional email, which the service needs in order to work. The three are handled separately: stopping one does not stop the others.

The daily digest

The daily digest gathers into a single message what happened in your projects the previous day: new files, marks, comments and approvals. Account holders receive it early in the morning and invited clients later in the morning. If nothing happened, no email is sent.

How to stop it. Every digest carries a way to unsubscribe at the bottom: simply reply to that email and we will stop the digest for that address. The messages also include the standard List-Unsubscribe header, which some email applications use to show an unsubscribe button.

Marketing email

If you expressly subscribed, we send you occasional news about Layro — new features, platform improvements and, from time to time, offers.

How you agree to it. By voluntarily ticking a dedicated box, when you create your account or in the subscription form on our website. The box is not pre-ticked, and it is not a condition of creating an account or of using the service: if you leave it unticked, Layro works exactly the same. When you subscribe through the form on our website, we first send you a confirmation email, and the address joins the list only after you click the link in it.

How to unsubscribe. Every message carries an unsubscribe link that works in a single click, without signing in and without having to write to us. If you have not received a message yet and want to withdraw your consent, write to us at contact@layro.ro. Withdrawal takes effect without delay and does not affect the lawfulness of messages sent beforehand.

Who never receives these messages. Clients invited to a project never receive marketing email from us. Their addresses are entrusted to us by the professional who invited them, solely for running the project, and our Data Processing Agreement forbids us from using them for our own marketing.

These messages are delivered through Brevo (section 9). We do not measure whether you open them and we do not track the links you click inside them.

Transactional email

Account activation, password resets, project invitations and essential service notices are necessary for Layro to work. They continue to be sent whether or not you stopped the daily digest or unsubscribed from marketing email.

8. How long we keep data

The periods below are the ones actually configured in our systems:

9. Who we share data with

To operate, Layro relies on the providers below. They process data on our behalf under processing agreements concluded in accordance with Art. 28 GDPR, and cannot use it for their own purposes. We do not sell or rent data to anyone and we do not disclose it for advertising purposes.

Signing in with Google is an exception to the table above. If you choose to sign in with your Google account, Google Ireland Limited does not process data on our behalf and is not a processor within the meaning of Art. 28 GDPR: it verifies your identity against its own service and acts, for that operation, as an independent controller. We receive from Google your email address, your name and an identifier for your Google account; Google in turn learns that you signed in to Layro. We send it none of your project content, none of your activity history and no data about invited clients — and if you never use that button, we send it nothing at all. What Google does with its own data is governed by the Google privacy policy, and you can review the applications connected to your Google account at any time in your Google account settings. What is loaded into your browser in the process is described in our Cookie Policy, section 4.2.

Beyond these providers, we may disclose data to public authorities where we are under a legal obligation to do so, and to our professional advisers (lawyers, accountants), strictly as necessary and under a duty of confidentiality.

10. Transfers outside the European Economic Area

Your data is stored in the European Union. There are nonetheless five situations in which data may travel outside the EEA, which we flag explicitly:

• Stripe. We contract with Stripe Payments Europe, Ltd., an Irish company, which transfers data to its parent company Stripe, Inc. in the United States. The transfer relies on the Standard Contractual Clauses adopted by the European Commission, supplemented by Stripe, Inc.’s participation in the EU-US Data Privacy Framework, for which the Commission has issued an adequacy decision.
• Sentry. The error reports described in sections 4 and 9 are stored in Sentry’s European Union data region, but the provider is a US company — Functional Software, Inc. — whose engineering staff may access them from the United States in order to operate and support the service. This transfer relies on the Standard Contractual Clauses adopted by the European Commission and included in our processing agreement with Sentry. The reports are stripped of identifying data before they leave your browser and the IP address is not stored, so what arrives there is limited to the technical information needed to fix the fault.
• Signing in with Google, where you choose that method. The service is provided to you by Google Ireland Limited, an Irish company, but Google also processes sign-in data outside the EEA within its group. Here Google acts as an independent controller rather than as our processor (section 9), so the safeguards for this transfer are the ones Google states in its own policy — for transfers to the United States, Google LLC appears on the list of companies certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision. If you would rather your data never reached Google at all, sign in with your email address and password: the Google button stays unpressed and we send it nothing.
• Canny. If you open the feedback page, your name, email address, identifier and what you write there are stored by Canny Inc. in the United States. The transfer rests on the Standard Contractual Clauses adopted by the European Commission, included in the data processing agreement concluded with Canny. We do not send project content, and if you never open the page we send nothing.
• The content delivery network (CDN). The application is served through a delivery network operated by AWS, with servers in locations worldwide. To deliver pages quickly, a request arriving from outside Europe may be served by a server located outside the EEA, and the IP address and the requested page pass through that server. The database and the files themselves remain stored exclusively in Germany. This transfer relies on the Standard Contractual Clauses included in our processing agreement with AWS.

You can obtain a copy of the safeguards we rely on by writing to us at contact@layro.ro.

11. Backups

We take backups so the service can be restored after an incident:

• The database — automated backups kept for 5 days, after which they are overwritten;
• Replaced images — when an image is overwritten in storage, such as a project cover, the previous version is kept for a further 30 days and then removed automatically. Previous versions of project files do not go through this mechanism: they are held as files in their own right, for as long as the file exists (section 8).

There is something important to understand about deletion: erasing data from the live system does not rewrite backups that have already been taken. These are sealed archives that cannot be selectively edited without destroying their integrity. Deleted data therefore remains in backups until the periods above elapse, after which it ages out on its own. During that window the backups are not used for any purpose other than restoring the service after an incident, and if a restore were to bring back data you had deleted, we delete it again.

12. Security

• Traffic between your device and our servers is encrypted (HTTPS/TLS);
• The database is stored encrypted, and access to it is restricted to the application’s internal network;
• Passwords are stored only as bcrypt hashes, generated individually for each password; we cannot read them and cannot recover them;
• Uploaded files are reachable only through signed links with a limited lifetime;
• Sessions use short-lived, revocable access tokens;
• The activity history is cryptographically chained, so that any retroactive change to a record can be detected.

If a personal data breach occurs that is likely to affect your rights, we notify the ANSPDCP within 72 hours under Art. 33 GDPR, and inform you directly where the risk is high, under Art. 34.

13. What happens when you delete an account or a project

Deletion in Layro is real, not merely hiding the data:

• Deleting your account immediately cancels the subscription, then deletes the account, your projects, the files in storage, notifications, and the activity history entries for the projects you acted in. We do not keep a pseudonymised copy of them. If you used the feedback page, within 30 days we also delete your Canny profile, together with your suggestions, comments and votes there;
• Deleting a project deletes its files, marks, comments, approvals, activity history and notifications, along with the data of the clients invited to that project;
• The exception is accounting documents, which the law requires us to keep for 5 years, and backups already taken, which age out on their own as described in section 11.

If you are an invited client. Two different things need distinguishing.

The account holder withdrawing your access. The account holder can withdraw your access to the project at any time. If you never opened the project and added nothing, your record is deleted outright. If you took part, your access is revoked but your record and contributions stay in the project, so the approval history remains intelligible to both sides. Withdrawing access is therefore not an erasure of your data.

You asking us to erase your data. If you ask us to erase your data, your name and email address are replaced, everywhere they appear, with a neutral marker, and your access is permanently revoked. From that point we can no longer contact you, and what remains cannot identify you.

What remains is only the contributions themselves and the fact that someone acted, together with the time they acted — nothing that identifies you. We keep that under Art. 17(3)(e) GDPR: an approval history with records missing could no longer serve to establish, exercise or defend a legal claim, for you or for the account holder. If you nonetheless consider that these records should not be kept either, write to us at contact@layro.ro and we will look at your situation.

14. Your rights

As a data subject you have the following rights. They apply equally to account holders and to invited clients:

• Right of access (Art. 15) — to find out what data we hold about you and receive a copy of it;
• Right to rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed;
• Right to erasure (Art. 17) — to have your data deleted, within the limits described in sections 11 and 13;
• Right to restriction of processing (Art. 18) — to limit processing while a dispute is being resolved;
• Right to data portability (Art. 20) — to receive the data you provided to us in a structured, commonly used, machine-readable format;
• Right to object (Art. 21) — to object to processing based on our legitimate interests. This right matters particularly for invited clients, whose project access and daily digest both rest on legitimate interests. If you object to receiving the daily digest, we stop it;
• Right to withdraw consent (Art. 7) — for processing based on consent. Withdrawing is as easy as giving consent was, and does not affect the lawfulness of processing carried out beforehand. For marketing email, click the unsubscribe link in any message you received. For the visitor identifier stored in your browser, use Cookie settings, in the footer of every page.

You can exercise any of these rights by writing to us at contact@layro.ro. We respond within one month of receiving your request, a period we may extend by two further months for complex requests, in which case we will tell you within the first month. Exercising your rights is free of charge. We may ask you for further information to satisfy ourselves that the request really comes from you.

15. Cookies and similar technologies

Our public website measures traffic anonymously, storing nothing on your device, and stores a visitor identifier only with your consent. The app.layro.ro application uses no analytics cookies; it stores in your browser only what is strictly necessary to keep you signed in and to remember your chosen language. The error monitoring described in section 4 stores and reads nothing in your browser. The feedback page loads only if you open it, and Canny then stores only what it strictly needs to work. Full details, including the exact list of what is stored and how to change your choice, are in our Cookie Policy.

16. Automated decision-making and profiling

Layro does not take automated decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR, and does not subject you to profiling. If we introduce features involving such processing, we will update this policy and inform you before they go live.

17. Children

Layro is a service intended for professional use by professionals and their clients. It is not directed at minors and we do not knowingly collect data from them. If you become aware that a child has provided us with personal data, write to us at contact@layro.ro and we will delete it.

18. Changes to this policy

We may update this policy when the service changes or when new legal requirements arise. The date of the last update is shown at the top of the page. Where a change is significant — a new purpose of processing, or a new recipient — we will tell you in advance by email or through a message in the application, before the change takes effect.

19. Correspondence, complaints and contact

When you write to us. If you contact us at contact@layro.ro — whether with a question about the service, a request concerning your rights, or a partnership proposal — we process your name, your email address and the content of your message, together with any attachments. The basis is our legitimate interest in replying to people who contact us (Art. 6(1)(f)), and where the message concerns entering into a contract, Art. 6(1)(b). We keep correspondence for as long as it takes to deal with it; for requests concerning the rights in section 14, we keep it for a further 3 years after resolution, so we can show that we responded, as required by the accountability obligation in Art. 5(2) GDPR. Our email service is provided by Hostinger (section 9).

If you are unhappy with how we handle your data, please contact us first at contact@layro.ro — in most cases we can resolve the matter directly. You do, however, have the right to lodge a complaint with the supervisory authority at any time:

If you live or work in another European Union member state, you may equally approach the supervisory authority there — Art. 77 GDPR lets you lodge your complaint with the authority in the state of your habitual residence, the state where you work, or the state where the alleged infringement took place.

You also have the right to bring proceedings before the competent courts.