Data we store

The short version: enough to place your orders and answer questions about them, and nothing whose only purpose would be to know more about you.

What we keep

• Who you are. Name, phone number, email.
• Addresses you save. Used to work out which location you mean and to fill in a checkout that asks.
• A card token. Not a card number. See card data.
• Your orders. What you ordered, from where, what it cost, and what happened to it, including a screenshot of the restaurant's confirmation page when there is one. This is what your receipts and your history are.
• Your preferences. Dietary rules, favorites, usual orders, and any notes you saved.
• Your chats with Layout. Conversations in Layout's own chat on the web, in the iPhone app and by text are saved by default, so you can come back to them. You can clear them in settings.
• Order traces. A record of what happened during each order, so we can diagnose a failure without asking you to reproduce it. Payment details are excluded by construction. Traces are deleted after 120 days. A short summary with no personal details in it, such as which path an order took and how it ended, is kept for as long as the account exists.
• Product analytics. Which features are used and where things break, including masked recordings of sessions on our web pages. It is keyed to a one way pseudonym rather than your account id, never carries payment details, and stops for an account that turns it off in its preferences.

What we do not keep

• Card numbers, security codes or expiry dates. They are in Stripe's vault, not our database.
• An outside assistant's conversation. When you use Layout from Claude, ChatGPT or another assistant, we receive the tool calls it makes, including the words it passes to them, not the chat around them.
• Your location history. A location you share is held as one grant, replaced by the next, that expires within the hour and is read as absent after that. A saved address is one you chose to save.
• Anything sold to anybody. We do not sell personal data.

Who it is shared with

• The restaurant, for an order you placed: your name, the order itself, and whatever their checkout requires. For the email field, Layout usually gives the restaurant an address of its own, so their receipt comes to us and confirms the order; your own address is used only when one cannot be made.
• The assistant or app you ordered through, but only what a call it made on your behalf returned.
• Our subprocessors, each for one job, listed at layout.link/subprocessors and summarised in subprocessors.

How isolation is enforced

A user reads only their own rows, and that is enforced by the database rather than by every query remembering to filter. Access is scoped per request to the authenticated user, and a request that fails to establish who it is for reads nothing rather than everything.

That is the control that makes a missing filter a bug that returns no data instead of a bug that returns somebody else's.

Deletion

You can delete a card, an address or a preference at any time in your account. You can delete the whole account yourself at account.layout.link or in the iPhone app. A deleted account is held for 30 days, so an accidental deletion can be undone, and is then permanently deleted. Cleared chats follow the same 30 day period.

The formal version

This page is the plain reading. The binding version is the privacy policy, with the DPA for business customers. Where this page and the policy differ, the policy is the one that counts, and the difference is a bug in this page worth telling us about.