Privacy Policy — Intellayer

Version 2.3 · in force from 2 October 2026

1. Who is responsible

We process personal data under the GDPR and the Cyprus Law 125(I)/2018.

Data Protection Officer. We assessed Article 37 and concluded that appointing a DPO is not mandatory at our current scale: our core activities do not involve regular and systematic monitoring of data subjects on a large scale, nor large-scale special-category processing. We review that assessment as the platform grows and will publish a DPO’s contact details here if it changes.

Supervisory authority. Office of the Commissioner for Personal Data Protection, 1 Iasonos, 1082 Nicosia, Cyprus — https://www.dataprotection.gov.cy. You may complain to them directly.

2. The two roles

2.1 We are the controller of data about you. That is: your name, email, telephone number, language and role; your password hash and two-factor settings; your sign-in history, including failed attempts, IP addresses and device information; the audit record of what you do in the platform (changes, requests, exports and downloads); support requests you send us; mobile diagnostics; your acceptance of our policies; and, for administrators, the organisation’s billing relationship with us. Sections 3 to 11 are about that data.

2.2 We are the processor of data about your customers. Everything your organisation records about its own customers, members, leads and contacts is your organisation’s data. Your organisation decides what to collect, why, and how long to keep it. We store and process it on your organisation’s documented instructions under the DPA.

That means:

• if one of your customers wants a copy of their data, or wants it deleted, they go to your organisation, not to us. If they come to us we will tell them so and pass the request to your admins;
• we do not use your customers’ data for our own purposes, do not sell it, do not use it for advertising, and do not use it to train generalised AI models;
• what we do with it, our security measures, our sub-processors, and your organisation’s responsibilities are all in the DPA.

2.3 We are not joint controllers with your organisation. We each control what we control. Clause 3 of the DPA sets this out, and clause 3.4 provides for what happens if a regulator or court disagrees.

2.4 Your employer can see what you do. Your organisation’s administrators can see, search and export the audit record of your activity in the platform, because it is their platform and their data: what you changed (with the values before and after, personal details redacted), the requests you made and whether they succeeded, what you exported or downloaded, your sign-in history (including failed attempts, with the network address and device each came from) and the tool calls AI features made for you. How your employer uses that is a matter between you and them, under employment and data protection law — your employer is the controller for that use, not us. We suggest you read your employer’s own staff privacy notice. Clause 7.4 of the Terms tells them the same thing from the other side.

3. What we collect about you

We do not collect your contacts, microphone or photo library beyond a photograph you deliberately attach, and we do not read your calendar unless you turn on calendar sync (section 5); we do not track continuous or background location; we do not collect advertising identifiers; and we do not load advertising or behavioural tracking scripts.

4. Why, and on what lawful basis

4.1 Legitimate interests. Where we rely on them we have weighed our interest against your rights and concluded the processing is proportionate and expected. You can object under Article 21 at any time.

4.2 Mobile diagnostics. The mobile apps include Google Firebase Crashlytics and Firebase Analytics, disabled in development and test builds. Today you opt out through your operating system’s privacy settings. We are adding an in-app switch, defaulted off, because a choice about storing analytics identifiers on your device belongs in our app rather than buried in your phone’s settings. Until it ships, email us and we will exclude your account.

4.3 Location. When you attach a photograph to a service record from the mobile app and you have granted foreground location permission, the app records the device’s last known coordinates with that photograph, the way a phone camera does. We do not track you continuously, do not track movement between sites, and do not use location for check-in, time-keeping or any other monitoring. Refuse the permission and everything still works; photographs are simply not geotagged.

5. Connected mailboxes and calendars, and Google user data

Intellayer includes a shared team inbox. A member of your team may connect a Gmail or Microsoft 365 mailbox so that incoming email is filed against your records — and, where your organisation allows it, send email from that mailbox and keep its calendar in step with appointments in Intellayer. All of this is optional and off until someone connects a mailbox; sending and calendar sync are each a further choice, made per mailbox. When you connect Gmail, Google’s consent screen names Intellayer as the app asking for access.

What we request

• Always: read access to the mailbox. For Gmail that is the Google scope gmail.readonly (https://www.googleapis.com/auth/gmail.readonly); for Microsoft 365, Mail.Read, with User.Read to identify the account and offline_access to stay connected between visits.
• Only if you allow sending on your mailbox: gmail.send (https://www.googleapis.com/auth/gmail.send) or Mail.Send. We use it only to send an email you have written and sent from Intellayer, from your own address — never on our own initiative.
• Only if you turn on calendar sync: calendar.events (https://www.googleapis.com/auth/calendar.events) or Calendars.ReadWrite, to keep your appointments and your calendar in step as described below.
• None of these lets us delete, move or alter the messages in your mailbox, and we do not.
• We read message bodies, not just headers, because the shared inbox shows each email itself so your team can act on it. Mailbox and calendar access is used for what this section describes and nothing else.

What we read

• We check the connected mailbox about every five minutes and fetch only mail that arrived since the last check. The first check after you connect reaches back 24 hours, up to 50 messages.
• For each new message we read the sender, recipients, subject, date and text body. We do not download attachments.
• Messages sent from the connected address itself are skipped; an email you send from Intellayer is recorded when you send it (below).

What we keep

What happens to a message depends on who sent it and on two settings you control: whether the mailbox is your organisation inbox, and, for a personal mailbox, what it logs.

• It replies to a conversation already in Intellayer — one started by an email sent from the platform, or one filed earlier: it joins that conversation, whatever else the mailbox is set to.
• The sender is a member in your records (in workspaces that manage members): the message is filed in that member’s conversation, unless the mailbox logs selected email only.
• The mailbox is your organisation inbox: every other message becomes a conversation in your shared inbox, whether or not the sender is already in your records. If the sender matches a lead or customer, the conversation is linked to that record, the record’s timeline shows the subject and the first 200 characters, and any automation rules you have set up for incoming email run.
• A personal mailbox set to log known contacts (the default): a message from a lead or customer your organisation already has is filed as a conversation linked to that record, in the same way. Anything else is not filed and stays private.
• A personal mailbox set to log selected email only: nothing is filed automatically. Its owner forwards or blind-copies what should be logged (below).

In every case we log each processed message’s sender, recipients and subject, so you can see what the sync did. The log is kept for 12 months and deleted when the mailbox is disconnected.

Forwarding and BCC addresses. Each user, and the organisation, has a logging address. Email forwarded or blind-copied to it is received by Mailgun, our email sub-processor, in the EU, and filed against the record whose contact matches; when nothing matches, it waits unlinked in the shared inbox for someone to file. That is email you choose to send us: it involves no access to your mailbox.

Access and refresh tokens are encrypted at rest (AES-256-GCM) and decrypted only at the moment a request is made to Google or Microsoft. Mailbox data is confined to your organisation: tenant isolation means no other customer can query it, and inside your organisation a conversation is visible to its participants and to the users your administrators allow to manage the shared inbox.

Sending from your mailbox

Where your organisation has allowed it and you have ticked Allow sending on your mailbox, you can email a lead or customer from their record, or reply in the shared inbox, and the email goes out from your own address through Google or Microsoft. It appears in your mailbox’s Sent folder like any other email you send. We keep it in the conversation, add its subject and first 200 characters to the record’s timeline, and file replies to it in the same conversation. Untick Allow sending at any time to stop.

Calendar sync

Where your organisation has allowed it and you turn on calendar sync for your mailbox, about every five minutes:

• Out: appointments in Intellayer assigned to you — single appointments from 30 days back; recurring series are not copied — are created, updated and deleted in your Google or Microsoft calendar.
• In: changes you make there to those events — title, description, time, or deleting one — come back. An event created in your own calendar is copied into Intellayer only when one of its attendees is a lead or customer your organisation already has, and never from a mailbox that logs selected email only, so private appointments stay out. Recurring events from your calendar are not imported.
• Out of office: while your calendar shows you out of office, Intellayer shows you as away to your colleagues, so work is not assigned to you then without a warning. Only the dates and times are copied, never the event’s title or description. This is on with calendar sync; untick Mark me as away when my calendar shows me out of office to stop it, and the time off it copied is deleted.
• When the same event changed on both sides since the last sync, your calendar’s version wins.
• Turning sync off stops it at once. Events already copied stay in both calendars; the links between them, and any time off copied from out-of-office events, are deleted.

What we never do with it

• We do not sell Google user data, and we do not transfer it to data brokers or to anyone for advertising.
• We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine learning models.
• We do not pass mailbox or calendar data to an AI app you connect yourself (section 6.4): lead timelines, which carry email subjects and previews, calendar events and time off are not available to such apps.
• Our staff do not read your mail. When our support staff sign in as one of your users to help you, the platform withholds mailbox content from them: inbox conversations, the sync log and data exports are blocked, and record timelines show that an email arrived but not its subject or preview. Beyond that, people access Google user data only where you have given explicit consent for a specific support request, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

Third parties and AI features

Mailbox and calendar data, including Google user data, is stored on our own infrastructure in Germany. The only third party that receives any of it is Anthropic, our AI sub-processor (section 6.3), and only through the AI features below. Each one is off until your organisation enables it; if you enable none of them, no mailbox or calendar data leaves the platform.

Before each request leaves the platform, personal names are replaced with placeholders and email addresses, phone numbers and street addresses are left out (section 6.3). Anthropic processes the request only to return the result and does not train models on it.

Retention, disconnection and deletion

• A connected mailbox can be paused or disconnected at any time from Settings. Disconnecting revokes our access with Google immediately, deletes the stored tokens and that mailbox’s sync log, and stops all further access.
• You can also revoke access yourself at myaccount.google.com/permissions. Syncing then stops, and the connection shows an error until you disconnect it in Settings, which deletes the stored tokens.
• Mail already filed stays after disconnection: the conversations and timeline entries are your organisation’s business records. Users can remove individual messages from a conversation, and we will erase everything filed from a mailbox on request to [email protected].
• Ingested messages, and the subjects and previews they leave on record timelines and in the activity record, are deleted automatically after 24 months. The sync log is deleted after 12 months.

Two things to decide before you connect one

• A mailbox contains other people’s personal data. Everyone who has ever written to that address is a data subject, and none of them agreed anything with your organisation. Filing their correspondence into your records is your organisation’s processing, and Article 14 requires you to inform them — a line in your email signature or website privacy notice usually does it.
• Connect a role mailbox, not a personal one. A personal inbox drags in private correspondence that has no business being in a shared system, and you cannot un-ingest it selectively.

6. Who receives your data

6.1 Inside your organisation. Your administrators see your account details and your activity record. Colleagues see your name against records you create or change.

6.2 Our service providers. The complete, authoritative list — purposes, entities, locations and transfer safeguards — is on the sub-processor page, which is Annex III of the DPA and is maintained with 30 days’ notice before any change.

6.3 AI providers. Every AI-assisted feature is off until your organisation enables it, and each is enabled separately. When one runs, the relevant data goes to the AI sub-processor named in Annex III, under a DPA and Standard Contractual Clauses, solely to return the result. It is not used to train models. The Data Assistant works the same way. Where your organisation enables assistant actions, the assistant can also prepare a task or a note; nothing is created until you confirm it, and it can do only what you could do yourself.

Before any such request leaves the platform, personal names are replaced with placeholder tokens (restored in the response inside the platform) and direct contact identifiers — email, telephone, street address — are omitted. This is minimisation, not anonymisation: we hold the mapping, so the transmitted data is still personal data, and residual identifiers can still appear in free text and in files processed verbatim, such as an uploaded bill or an import file.

6.4 AI apps you connect yourself. Where your organisation enables it, you can connect your own AI app — Claude, ChatGPT, Copilot or another app that supports the Model Context Protocol — to Intellayer. You approve the connection on our sign-in page; you can disconnect it at any time, and an administrator can disconnect it or switch the feature off for the whole organisation. The app can then read, at your request and as you, the records you can see, and nothing more; it cannot change anything. What it reads goes to that app’s provider under your organisation’s agreement with them, not ours: they are not our sub-processor, and their terms decide what they do with it. Names are not replaced with placeholders, because the app is answering you. Lead timelines (which carry email subjects and previews), calendar events and time off are never available to it. We keep a record of each request the app makes — which tool, what it asked for, when, and how many rows came back — for 24 months, and your organisation’s administrators can see those records. Connecting an app sends your organisation’s customer data to another company, so it is your organisation’s decision as controller; that is why an administrator can switch it off.

6.5 Services your organisation connects. Your organisation can connect Intellayer to services it uses itself: accounting software (Xero, QuickBooks); its own phone system (3CX); automation tools and its own systems, through API keys and webhooks (for example Zapier, Make or n8n); and its own Stripe account, to take payment when a customer accepts a proposal. Each receives what your organisation sets up: accounting software, invoices, payments and the customer details on them; a phone system, which record has a calling number, while it sends us a record of each call (number, direction, time, duration, staff member); automation tools, the records and events subscribed to. These are your organisation’s own suppliers, under its own terms with them, not our sub-processors. The sub-processor page lists them anyway, with what each receives.

Lead enrichment, in the general CRM, reads the public website at a lead’s company domain and checks VAT numbers against the European Commission’s VIES register. The website receives an ordinary page request from us, and VIES receives the VAT number; neither receives anything about the lead.

6.6 Authorities. Where the law requires. We read demands narrowly, disclose the minimum, and tell you unless forbidden.

6.7 If the business changes hands. Your data may transfer to an acquirer. We will tell you in advance and your rights follow the data.

6.8 Never. We do not sell or rent personal data, share it with advertising networks or data brokers, or use it to train generalised AI models.

7. How long we keep it

Data your organisation controls follows your organisation’s settings and clause 11 of the DPA, not this table.

8. International transfers

The platform and its database are in Germany. Where a provider processes outside the EEA we rely on an adequacy decision where one applies, and otherwise on the Standard Contractual Clauses (Decision (EU) 2021/914) with a documented transfer impact assessment and supplementary measures where the EDPB’s Recommendations 01/2020 require them. Per-provider detail is on the sub-processor page; copies of the safeguards are available from [email protected].

9. Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — the same set as in the customer policy, section 8, exercised the same way and answered within one month.

Two things specific to a work account:

• Your account belongs to your organisation’s subscription. We cannot delete your account against your employer’s instruction where they need it for the service, but we will always act on rights that do not depend on that — access, rectification, objection, restriction — and we will tell you and them what we have done.
• For data your organisation controls, we are the processor. Send the request to your organisation; if it reaches us, we will forward it to your admins and tell you we have.

You may complain to the Office of the Commissioner for Personal Data Protection at any time.

10. Security

TLS 1.2 or above in transit; encryption at rest for the database and for backups; salted, deliberately slow password hashing; application-layer encryption of third-party credentials; API keys and the tokens of AI apps and phone systems stored only as one-way hashes; role-based access enforced at the API; logical tenant isolation enforced at every API boundary; logged, need-to-know staff access; when our support staff act as a user, everything they do is recorded as theirs and your administrators can see it; audit records the database itself refuses to alter, and deletes only when their retention ends or the law requires erasure. Annex II of the DPA is the detailed and contractually binding version.

We do not hold ISO 27001, SOC 2 or an equivalent certification, and we do not currently commission an annual external penetration test. Clause 10.1 of the DPA says the same.

Breaches affecting data we control are notified to the Commissioner within 72 hours where Article 33 requires, and to you without undue delay where the risk to you is high. Breaches affecting data your organisation controls are notified to your organisation without undue delay under clause 9 of the DPA, in time for its own Article 33 report.

11. Changes

The version and date at the top change whenever this policy does. For a material change we give at least 30 days’ notice to your organisation’s administrators. Superseded versions on request to [email protected].

12. Contact

Data protection and rights requests: [email protected]. Security: [email protected]. Everything else: [email protected].

Intellayer, Alamanas 50, Dali, Nicosia 2547, Cyprus.