LAYR Privacy Policy

Effective date: September 22, 2026

LAYR Additive Inc. operates the LAYR website and marketplace for physical 3D printed products. This policy explains the personal information we handle when you browse, register, buy, sell, submit designs, fulfill orders, contact us, or join our waitlist or communications lists. It also explains your choices. LAYR is responsible for the processing it determines; independent sellers and service providers may have their own legal obligations for processing they determine.

Questions or privacy requests: team@officiallayr.com (attention: Privacy). You do not need to accept new terms or maintain an account to submit a privacy request.

1. Information we collect and its sources

• Account and contact information: names, usernames, email addresses, phone numbers, country, profile information you choose to provide, authentication identifiers, and verification status. Authentication providers handle credentials. We also record account preferences, legal-document versions and acceptance timestamps, and marketing choices.
• Marketplace activity: listings, photographs, design files, customization instructions, reviews, favorites, cart activity, orders, support requests, and messages or attachments you send through LAYR. Uploaded content can contain personal information; do not include unnecessary sensitive information or another person's private details without lawful authority.
• Transactions and fulfillment: shipping and return details, recipient contact information, product and order specifications, delivery and tracking information, refunds, disputes, and payment or payout references and status. Stripe handles card details and payment credentials; LAYR does not store full card numbers or card security codes. Seller onboarding may involve business, identity, tax, and payout information handled by Stripe and related verification status supplied to LAYR.
• Technical and usage information: IP addresses, browser and device information, logs, approximate location inferred from technical information, page or product visits, referral and campaign information, and security or session identifiers. We use cookies and browser storage as described below. This policy does not describe continuous GPS tracking or a requirement to allow camera access.
• Information from others: enabled sign-in providers may supply your name, email, profile image, identifier, and verification information; payment providers supply transaction and verification status; shipping and customs providers supply rates and delivery information; email providers supply delivery, bounce, unsubscribe, or complaint events. Buyers, sellers, and production partners may supply information needed for a transaction or support case.

We do not request sensitive traits such as racial origin, religious beliefs, health information, or biometric identifiers for ordinary marketplace use. Payment or identity verification information may be considered sensitive under some laws and may be collected by the relevant provider. Avoid sending identity documents or payment credentials through public content or ordinary messages.

2. Why we use information

We use relevant information to create and secure accounts; provide the marketplace; process and fulfill orders; calculate shipping, taxes, and customs charges; handle payments, payouts, refunds, and disputes; enable messaging; moderate content; provide support; prevent fraud and abuse; maintain records; comply with law; and establish or defend legal claims. We also measure marketplace usage and performance and improve the service.

We send service messages about accounts, orders, security, and support. Promotional email or SMS requires the applicable separate permission or other lawful basis; accepting the Terms is not marketing consent. Optional Google Analytics is controlled separately through Cookie settings. We do not use private design files or messages to train general-purpose AI models under the content licence in our Terms.

3. Legal grounds and consent

In Canada, we obtain express or implied consent appropriate to the information and purpose unless an applicable legal exception permits or requires processing. We explain purposes and obtain additional consent where required for a new use. Consent does not waive our duties to limit collection, protect information, or use it for reasonable purposes.

Where European Economic Area, UK, or similar data-protection rules apply, the grounds depend on the activity: performance of a contract for requested account and order services; legal obligations for required records and disclosures; consent for optional analytics and communications where required; and legitimate interests for proportionate security, fraud prevention, service improvement, and legal claims where those interests are not overridden by your rights. We may process information to protect vital interests in an emergency where permitted by law.

You can withdraw consent by contacting us or using the relevant preference control. Withdrawal does not invalidate earlier lawful processing or prevent processing on another valid legal ground. We will explain if information is necessary to provide a requested service and the consequences of declining it.

4. Who receives information

• Sellers and assigned production partners: relevant order details, customization information, and the recipient's name, shipping address, and contact details needed for manufacture, delivery, and related support. A seller receives information for their own orders, not unrestricted access to a customer's saved addresses or other sellers' orders. Our agreements restrict unrelated use, marketing, resale, and unnecessary retention.
• Hosting, authentication, and storage: Google/Firebase infrastructure supports accounts, databases, file storage, and application operation.
• Payments and verification: Stripe processes payment, payout, fraud-prevention, and onboarding information. See Stripe's privacy policy.
• Shipping and customs: when used for your transaction, ShipStation, carriers, and customs or duties services such as Zonos receive relevant origin, destination, product, value, and contact information to provide quotes, labels, delivery, and cross-border processing.
• Communications: Brevo and applicable communications providers process contact details, message content or template data, preferences, and delivery or unsubscribe events to send and manage authorized communications.
• Address tools, analytics, and security: when enabled or used, Google Maps/Places supports address entry; Google Analytics receives consented usage events; and Cloudflare Turnstile supports bot and abuse prevention. The information involved depends on the feature and provider.
• Professional advisers, authorities, and business successors: we may disclose information as reasonably necessary for legal advice, lawful requests, protection of rights or safety, or a financing, merger, or business transfer, subject to applicable safeguards and law.

We use service providers for specified purposes and remain responsible for obligations applicable to information under our control. Some recipients, including payment providers, carriers, and independent sellers, also process information for their own legal or operational purposes under their own notices.

Public listings, seller profiles, and reviews can be viewed, copied, or indexed by others. Private messages and non-public design files are not public merely because you submit them; they may be accessed by intended recipients and authorized personnel or providers where necessary for the service, moderation, support, security, or law. Avoid posting addresses or other private information publicly.

5. Cookies, browser storage, and analytics

LAYR uses cookies and browser storage for authentication, session security, legal acceptance, cart and preference functionality, and usage measurement. Operational records include account actions, purchases, cart events, and marketplace performance. First-party measurement may associate product or storefront interactions with an account or session; anonymous measurement depends on the site's configuration.

Where Google Analytics is enabled, our browser analytics sends events after you choose to allow optional analytics. You may reject it or change your choice through Cookie settings in the footer. This control governs optional Google Analytics; it does not erase order records, required security logs, or all first-party marketplace records. We do not use this Google Analytics integration for advertising or remarketing.

With your consent we also use the Meta pixel. It tells Meta Platforms which LAYR pages and products you viewed, added to a basket, or purchased, so that we can measure our advertising and show you products you have already seen. This uses cookies and similar identifiers set by Meta, and involves sharing those events with Meta, which acts as an independent controller for its own purposes. Advertising cookies are separate from analytics cookies: they are off until you turn them on in Cookie settings, and turning them off stops any further sharing. Choosing analytics does not turn on advertising.

You can also delete or restrict cookies and local storage through your browser. Blocking necessary storage may affect sign-in or other requested features. Browser Do Not Track is not automatically applied as a site-wide opt-out. Contact us to exercise any applicable objection or opt-out right; statutory requirements, including any applicable recognized opt-out signal requirements, take precedence over this notice.

6. Processing outside your country

LAYR is based in Canada. Providers and transaction recipients may process information in Canada, the United States, or other countries where they operate. Information may be accessible to courts, law enforcement, or other authorities under the laws of those countries. Cross-border processing does not remove LAYR's responsibility for information under its control.

Where applicable law requires a transfer mechanism or additional safeguards, the transfer must be supported by that mechanism, such as an applicable adequacy decision or approved contractual safeguards. Contact us for information about recipients, processing locations, and safeguards relevant to your information. This notice is not a blanket consent to unrestricted international transfers.

7. Retention and account deletion

We retain information only for the purposes described here and applicable legal obligations. Retention depends on account status, outstanding orders, payment disputes, tax and accounting requirements, fraud prevention, legal limitation periods, and any legal hold. We remove or anonymize information when it is no longer needed; restricted backups may persist until their normal secure deletion cycle.

Closing an account does not immediately erase every record. Order and financial records, necessary shipping evidence, unresolved support or dispute records, consent and acceptance evidence, and minimal suppression information to respect communication choices may need to remain after closure. Outstanding fulfillment or payment obligations can delay final deletion. We restrict retained information to the remaining lawful purposes rather than treating closure as permission for new marketing. Contact us for the retention criteria applicable to a particular record or to request deletion.

8. Security and incidents

We use access controls, authentication, and other technical and organizational measures intended to protect personal information. No system can guarantee absolute security. This does not waive our responsibility to use appropriate safeguards or your legal remedies. Report suspected unauthorized access or disclosure to team@officiallayr.com. We assess incidents and make notifications and reports required by applicable law.

9. Age requirements

LAYR accounts and marketplace services are intended for people who are at least 18 and have legal capacity to contract. We do not knowingly solicit personal information from children or permit a parent to create an exception to that account requirement. If you believe a child has provided information, contact us so we can investigate and take appropriate deletion or other required action.

10. Your rights and choices

Depending on applicable law, you may request access to information and details about its use or disclosure, correction, deletion, a portable copy, restriction of processing, withdrawal of consent, or an objection to certain processing. You may also have rights concerning targeted advertising, sale or sharing, sensitive information, and solely automated decisions with legal or similarly significant effects. These rights have lawful exceptions; they do not necessarily require deletion of records we must retain.

Email team@officiallayr.com with the request and enough information to identify the account or interaction. We may verify identity or an authorized agent's authority using information proportionate to the request. Do not send passwords, full card details, or identity documents unless a secure method is specifically arranged. We will respond within applicable statutory deadlines, explain any lawful refusal or extension, and consider an appeal sent to the same address. We will not unlawfully discriminate against you for exercising your rights.

Unsubscribe from promotional email using its unsubscribe link or contact us. SMS recipients can use the instructions in the message or contact us to withdraw permission. Service messages necessary for accounts and transactions may continue. Marketing permission is separate from account access and legal acceptance.

You may complain to the Office of the Privacy Commissioner of Canada, the competent provincial authority, your EEA data-protection authority, the UK Information Commissioner's Office, the Swiss authority, or another regulator with jurisdiction. Contacting LAYR first is not a condition for exercising a statutory complaint right.

11. Additional information for United States residents

Where a US state privacy law applies to LAYR and your information, the categories described in section 1 include identifiers and contact details, customer-record information, commercial and transaction information, internet or device activity, approximate location, and content you provide. Sources, purposes, recipient categories, and retention criteria are described above. This is a description of possible service-related categories, not a claim that every category has been collected about every person.

LAYR does not sell personal information for money. If you turn on advertising cookies, we share advertising identifiers and the products you viewed or purchased with Meta Platforms for cross-context behavioural advertising. That sharing does not happen unless you turn it on, and you can stop it at any time through Cookie settings in the footer, which serves as our “Do Not Sell or Share My Personal Information” control. We do not knowingly sell or share children's information. We do not use sensitive information to infer personal characteristics. If our practices change, we will update this notice and provide legally required choices before the changed processing.

Where applicable, you may request information about collection and disclosures, access, correction, deletion, portability, opt out of sale, sharing, targeted advertising or qualifying profiling, limit certain sensitive-information uses, and appeal a refusal. Submit requests or agent authorizations through the contact above. If an appeal is denied, you may contact your state attorney general or other competent authority. California residents may also request information about disclosures for third parties' direct marketing under the Shine the Light law where applicable.

12. Changes and contact

We will identify revisions by their effective date and communicate material changes by email or a prominent notice. Where required, we will obtain new consent before changing a purpose. An updated privacy notice does not itself supply consent for a new optional use.

Privacy inquiries: LAYR Additive Inc., attention: Privacy, 6 Concepta's Place, Torbay, Newfoundland and Labrador A1K 1N3, Canada. Email: team@officiallayr.com.