Privacy Policy

Effective

1. Who we are and what this policy covers

Manafold Inc. operates Layo at layo.co, an AI influencer studio for creating characters and transforming short videos. This policy describes how we collect, use, disclose, protect, retain, and delete personal information when you use Layo. Manafold Inc. is responsible for the processing described here. Our address is 200 Kent Ave, Suite 401, Brooklyn, NY 11249. Contact support@layo.co with privacy questions or requests.

2. Information we receive

  • Account information: your email address, Layo account identifier, sign-in records, and workspace memberships. Email sign-in uses a one-time sign-in message.
  • Google sign-in information: your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture when Google provides them. The next section explains this information separately.
  • Inputs and Outputs: descriptions, instructions, reference photos, uploaded clips, generated images and videos, character information, file metadata, and related generation records such as status and usage.
  • Support information: messages, feedback, and information you send when requesting help or reporting content.
  • Technical information: IP addresses, browser and device information, timestamps, request and error information, security logs, and limited product interaction events processed by Layo and its providers.

3. Google sign-in: access, use, storage, and sharing

Google sign-in is optional; you may use the available email sign-in method instead. We use Google Sign-In through Supabase to authenticate you. We request basic identity permissions: OpenID, email, and profile. We do not request access to Gmail messages, Drive files, Contacts, Calendar, or other Google Workspace content. Google does not give Layo your Google password.

Supabase receives and stores the Google account and profile information described above as part of your authentication record. Layo uses this information to establish and maintain your account, verify sign-in, manage access to workspaces and available features, protect your account, and respond to account-related requests. Your Google profile information may be retained with your sign-in record even when a particular field is not displayed in the interface.

We share Google sign-in information with Supabase for authentication and account storage and process the account information needed by Layo through our AWS-hosted application. We do not sell Google user data, use it for advertising, transfer it to advertising platforms or data brokers, or use it to determine creditworthiness. We do not send your Google sign-in profile or authentication credentials to AI generation providers, or use Google user data to develop, improve, or train AI or machine-learning models. Content you separately choose to upload or type into Layo is processed as described below; signing in with Google does not give us access to your Google files.

We limit human access to Google user data to situations where you give permission for the specific access, where it is necessary for security or investigating abuse, where the law requires it, or where the data is aggregated and de-identified for internal operations. Any other disclosure is limited to providing the features you authorize, security, legal obligations, or a business transfer with your prior consent where Google's policy requires it. These restrictions take precedence over the general sharing provisions below.

Layo's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. The security, retention, deletion, and choice provisions in this policy also apply to Google user data.

4. How we use other information

We use information to operate accounts and workspaces; process your requested character and video generations; store and deliver files; display your results; manage usage limits; provide support; diagnose failures; maintain security; enforce our Terms of Service; and meet legal obligations. Limited product interaction information helps us understand which features are used and improve the service.

Manafold Inc. does not use your Inputs or Outputs to train its own AI models. We do not sell personal information or share it for cross-context behavioral advertising. We do not use private Inputs or Outputs in our own promotional materials without your permission.

5. AI providers and media processing

When you request an enabled AI feature, Layo sends the instructions and media needed for that request to fal (fal.ai). Depending on the selected model, fal may process the request itself or send it to a model partner. This can include reference photos, source clips, generated character images, prompt text, and technical request information. It does not include your Google sign-in profile or credentials.

Providers process and may retain request content and generated media under the arrangements applicable to the model. fal's API terms restrict training use of client content, but identify exceptions for designated models. Provider retention and model-specific terms matter independently of Layo's own no-training practice; we do not promise that every provider immediately deletes all copies after generation. Contact us before submitting material that requires a particular confidentiality or retention arrangement.

Layo stores its copies of uploaded and generated media in private storage, with access checks and time-limited download links. Providers may also keep separate copies. In particular, fal-generated files can have provider-hosted links accessible to anyone who possesses the link until it expires or is removed. Saving a copy in Layo's private storage does not itself remove that provider copy. See fal's retention documentation.

6. Photos, likeness, and sensitive information

Images and videos can contain faces, voices, and information about you or other people. Generation models analyze the submitted material to create the transformation you request. Layo's features are intended for creative media generation, not for identifying or authenticating people. Only submit another person's likeness when you have the necessary permission, and avoid including unrelated sensitive information.

We require confirmation of permission when you use a reference photo. That confirmation does not establish that every person depicted has consented to every possible use. Our handling of uploaded photos and provider processing is described in this policy; we do not represent that every model's internal processing is free of biometric data or that providers erase derived data immediately. If a feature requires a separate biometric notice or consent, it must be provided before the relevant processing.

7. Service providers and other disclosures

  • Supabase provides authentication, database services, and Layo's private file storage. AWS hosts the application. These providers process the account, content, and technical information necessary for those services.
  • fal and the applicable model partners process generation requests as explained above. Resend delivers email sign-in messages. Sanity stores and serves our public editorial content; it is not the storage service for private workspaces or uploaded generation media.
  • When enabled, Sentry supports error diagnostics, Langfuse supports AI-operation diagnostics, and PostHog supports limited product analytics. Our application diagnostics are configured to exclude prompt text and media URLs, and our product analytics does not include Google profile fields or record sessions.
  • Workspace members can access shared material according to their permissions. If you share or publish content yourself, recipients may retain or redistribute it independently of Layo.
  • We may disclose information where required by law or reasonably necessary to address abuse, protect people or rights, or secure the service. Professional advisers may receive information needed for their work. In a merger, acquisition, or similar transaction, information may transfer subject to applicable safeguards and the Google-specific restrictions above.

8. Retention and deletion

We retain account information, including the Google sign-in record, while needed to maintain your account and access. We retain Inputs, Outputs, and workspace records to provide stored content and collaboration features. Technical, support, and security records are retained for the purposes they serve, including investigating incidents, resolving disputes, and complying with legal requirements. Retention depends on the record, its purpose, and applicable obligations; we do not promise indefinite storage.

To request deletion of your account, Google sign-in information, uploaded files, generated media, or other personal information, email support@layo.co from your account email and describe the request. We may verify your identity and clarify the scope. We will handle the request within applicable legal time limits and delete information that no longer needs to be retained, subject to lawful exceptions. If we retain information for an exception, we will explain the reason where permitted.

Deletion from active Layo systems does not necessarily remove backup copies immediately, copies held under a provider's retention arrangements, material independently downloaded by others, or shared workspace content another member remains entitled to use. Backup copies expire under the applicable backup cycle. Provider-held copies may require a separate deletion step; contact us for assistance. Google account information is subject to the same deletion process and is not retained to train models or serve advertising.

You can also remove Layo's Google connection through your Google account connections. Revoking Google access prevents future access through that connection but does not itself delete Layo's existing records or necessarily end an existing Layo session. Sign out and send a deletion request if you want to close your Layo account.

9. Security

We use HTTPS for data in transit, authenticated account access, workspace authorization checks, private application media storage, and time-limited links to help protect information, including Google account data. Production access is restricted to authorized personnel. Provider copies are subject to the handling described above. No transmission, storage system, or access control can guarantee absolute security.

10. Cookies and analytics

Layo uses cookies and similar browser storage to support authentication and secure sessions. Blocking them can prevent account features from working. When enabled, our current PostHog integration records limited explicit feature events, uses memory-based persistence, and has automatic page capture, interaction capture, and session recording disabled. Google and other services you visit may use their own cookies under their policies.

11. Your rights and choices

You can choose what to submit, use available workspace controls, revoke Google access, and contact us to request access, correction, deletion, or a copy of your information. Depending on your location and the circumstances, you may also have rights to object to or restrict processing, withdraw consent, use an authorized representative, appeal a decision, or complain to a data protection authority. We will verify and respond to requests as required by applicable law and will not discriminate against you for exercising your rights.

Where European data protection law applies, we process information as needed to provide the service you request, pursue legitimate interests such as securing and maintaining Layo, meet legal obligations, or act on consent where required. You may withdraw consent for future processing without affecting processing that was lawful before withdrawal.

12. International processing and minors

Manafold Inc. is based in the United States. Layo and its providers may process information in the United States and other countries where they operate. Applicable privacy protections can differ by location; we use the safeguards required by applicable law for international transfers.

Layo is intended for adults aged 18 or older. If you believe a minor has provided personal information through an account, contact support@layo.co so we can investigate and take appropriate action. Our Terms of Service prohibit content that sexualizes, exploits, or endangers minors.

13. Changes to this policy

We will identify the effective date of this policy and notify users of material changes through the service or another reasonable channel. Before accessing additional Google user data or using Google user data for a new purpose, we will update the relevant disclosures, notify you, and obtain your consent before the new access or use begins. We will also seek consent for other changes where required by law.

Contact support@layo.co or Manafold Inc., 200 Kent Ave, Suite 401, Brooklyn, NY 11249, with questions about this policy.