Privacy Notice

Account data: your email address, password (hashed), and agent/API key metadata.

Usage logs: every action your agents take through ActLayer is recorded as a usage log, including the capability called, the input you sent, the cost, the outcome, and timing — this is what powers your receipts and dashboard history.

Governance (SRG) events: our risk engine records the actions it evaluates, including a snapshot of the action input, so that block and approval decisions can be audited. This means action inputs — which can include the content you send to a capability, such as an email body or search query — are retained for security and audit purposes, not just for successful calls.

Wallet and billing data: your wallet balance, ledger entries, and top-up records. We do not store your card details — those are handled directly by Stripe.

We do not sell your data. We share data only as needed to operate the service:

• Stripe processes wallet top-up payments.
• Resend delivers transactional email, such as verification and notification messages.
• Upstream capability providers (for example, the service behind a web search or email-sending capability) receive only the action input needed to execute that specific capability call — not your account, wallet, or billing data.

We retain usage logs and SRG governance events for 12 months, after which they are eligible for deletion.

You may request deletion of your account and associated data at any time by contacting support@actlayer.dev. We will confirm what can be deleted immediately and what must be retained briefly for legal, billing, or security reasons before removal.

When email verification is enabled, we send a verification email (via Resend) before allowing API key creation or wallet funding, to confirm you control the account's email address.

Questions about this notice can be sent to support@actlayer.dev.