Privacy Policy
LAYUP FUNDING PRIVACY POLICY · Version 1.0 · Effective November 5, 2026
1. Who we are.
1427454 Alberta Ltd., operating as LayUp Funding (“LayUp”), 30 Alexandria Green SW, Calgary AB T3E 8E8. This policy meets our obligations under Alberta’s Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
2. Accountability.
Our Privacy Officer, Jeff Hayter, Founder, is accountable for our compliance.
The Privacy Officer can answer questions about how we, and our service providers outside Canada, collect, use, disclose and store personal information.
Contact: privacy@layup.fund, or by mail marked “Privacy Officer”.
3. What we collect.
- User account details.
- Information about your organization, which may include personal information about your staff, founders and contractors.
- Files and application content.
- Meeting audio recordings and transcripts.
- Chat messages with our staff.
- Billing details. Stripe holds the card data; we see only the brand, last four digits and expiry.
- Technical data and logs, including the file access log.
- Marketing preferences.
- Names and email addresses of people you refer.
4. Why we use it.
- To provide the service, bill you, keep it secure and send service messages.
- To send marketing, only with your consent or where the law allows.
- To comply with the law, including keeping tax records.
We do not sell personal information, and we do not use your content to train AI.
5. Consent.
We rely on your consent, and on the consent your organization obtains from its people.
Meeting participants agree to recording before their audio is captured.
You may withdraw consent, subject to legal and contractual limits.
6. Information about other people.
You are responsible for having authority to upload it and for giving any notice the law requires. We use it only to provide LayUp to you.
7. Service providers and processing outside Canada.
Our database and uploaded files are stored on Amazon Web Services in Canada (Montréal). The assistant's voice (text-to-speech) runs on Microsoft Azure in Canada (Canada Central). The providers below process personal information outside Canada, mainly in the United States:
| Provider | Purpose | Location | AI training |
|---|---|---|---|
| Anthropic | AI drafting and analysis | United States | Prohibited by contract |
| Deepgram | Meeting speech-to-text | Outside Canada (global service; no country named) | Opted out on every request since Nov 5, 2026 |
| Daily | Video meetings and recordings | AWS, worldwide; we delete each recording from Daily once it is transcribed | Not addressed in its documents; written confirmation requested |
| Vercel | Website | United States (AWS) and global edge network | n/a |
| Resend | Email delivery | United States | n/a |
| Stripe | Payments | Not named in its documents | n/a |
| Microsoft 365 | Email to our staff | Canada and United States | n/a |
Each provider may use the information only to provide its service to us, under written terms that require comparable protection.
Information processed abroad is subject to that country’s laws. Its courts, law enforcement and national security authorities may access it.
Anthropic may keep content that its automated systems flag under its usage policy for up to 2 years, and the classification scores for up to 7 years. This is Anthropic’s own policy, which we do not control.
Written information about our practices for service providers outside Canada is available from the Privacy Officer.
8. Retention:
| Information | Retention |
|---|---|
| Company data (files, applications, profile, transcripts, chat) | Until the company is closed, plus a 30-day cancel window; then deleted (up to 7 more days in backups) |
| Data on legal hold | Until the hold is released |
| Invoices and billing records | 6 years |
| File access log | 6 years after closure |
| Safety deposit box | Locked for 6 years while the company is open; deleted with the company |
| Database backups | Daily, kept 7 days |
| Marketing consent records | While consent is active, plus 3 years |
9. Your rights.
You may ask to access, correct or delete your personal information, and you may withdraw marketing consent.
We reply within 30 days, or tell you about any extension the law allows.
Requests about a customer organization’s data may be referred to that organization.
You can complain to the Information and Privacy Commissioner of Alberta (in Alberta) or the Privacy Commissioner of Canada (elsewhere).
10. Security.
Our safeguards include encryption, access controls, staff confidentiality agreements, and staff access that you switch on and that we log. LayUp has not yet had an independent audit.
11. Breaches.
If we confirm a breach of security affecting your organization’s information, we will notify the affected customers within 72 hours of confirming it.
Where the law requires, we also notify the Privacy Commissioner of Canada and affected individuals as soon as feasible, and the Information and Privacy Commissioner of Alberta without unreasonable delay.
We keep a record of every breach of security safeguards.
12. Email.
We send marketing only with consent. Every marketing email identifies LayUp and includes an unsubscribe link, which we act on within 10 business days.
13. Changes.
We tell you about material changes by email.