Privacy Policy

1. Scope

This policy covers the ScopedLayer platform, our website, APIs, SDKs, and any connected integrations (together, the Services). It explains what we handle when you sign up, connect a data source, or let an agent query your knowledge layer.

If your organisation uses ScopedLayer under a separate agreement, that agreement governs where the two conflict.

2. What we collect

Account information

• Name, work email, company, and role you provide at sign-up
• Authentication identifiers from your SSO or identity provider
• Billing contact details where a paid plan applies

Integration metadata

• Schema structures, table and column names, and data types
• Query patterns, lineage graphs, and model definitions (for example dbt manifests)
• Dashboard titles, metric formulas, and usage frequency signals
• Message and document titles or references — not full private message bodies unless you explicitly enable that source

Usage data

• Which agents queried which scopes, and when
• Latency, token counts, and error rates
• Standard log data: IP address, browser type, timestamps

3. Metadata-first design

Where a source is unstructured (a wiki page, a pinned thread), we extract and store the definition or rule that emerges from it — not a wholesale copy of the source content.

4. How we use data

• Operate the Services — build and maintain your knowledge layer, resolve conflicts, serve scoped context to agents
• Security and abuse prevention — detect anomalous access, enforce permission boundaries, investigate incidents
• Support — respond to your requests and troubleshoot issues you report
• Improve the product — aggregate, de-identified usage patterns inform roadmap decisions
• Legal compliance — meet obligations that apply to us

We do not sell personal information, and we do not use your organisation's metadata to train foundation models for other customers.

5. Sharing and subprocessors

We share data only where necessary to run the Services:

• Cloud infrastructure — hosting, storage, and compute providers under contract
• Model providers — where your configuration routes a request to an external model, only the composed context for that request is transmitted
• Operational tooling — error monitoring, analytics, and support systems bound by confidentiality terms
• Legal process — when required by valid legal request, with notice to you where lawfully permitted

A current subprocessor list is available on request and updated before material changes take effect.

6. Retention

• Knowledge graph data is retained for the life of your account and deleted within 30 days of termination
• Operational logs are retained for 90 days
• Billing records are retained as long as tax and accounting rules require
• You can export or delete specific definitions, scopes, and configurations at any time from the dashboard or API

7. Security

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Role-based access control mapped to your identity provider — we never elevate beyond the permissions you grant
• Least-privilege internal access with audit logging on every administrative action
• Independent testing and annual penetration assessments
• SOC 2 Type II, ISO 27001, GDPR, HIPAA, and CCPA alignment

No system is perfectly secure. If we become aware of a breach affecting your data, we notify you without undue delay and within the timeframes applicable law requires.

8. Your rights

Depending on where you are, you may have the right to access, correct, delete, port, or restrict processing of your personal information, and to object to certain uses. You can also withdraw consent where processing relies on it.

To exercise any of these, contact us at the address below. We respond within 30 days and will not discriminate against you for making a request.

9. International transfers

We operate globally. Where data moves outside your region, we rely on Standard Contractual Clauses or another approved transfer mechanism, along with technical safeguards appropriate to the data involved.

10. Children

The Services are built for businesses and are not directed to anyone under 16. We do not knowingly collect information from children. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We update this policy as the product and the law evolve. Material changes are announced by email or in-product notice at least 30 days before they take effect. The date at the top always reflects the current version.

12. Contact