Privacy Policy
Last updated: 7 October 2026
We tell you this openly: Test My WAF is Layerd AI's platform. The contact details you give us to unlock a report are used by Layerd AI, including by its sales team, to send you the report and to contact you about your results and Layerd AI's security products and services, as set out below. You can opt out at any time.
1. What we collect
- Contact data you submit to unlock a full report: email, name, company, and your marketing-consent choice.
- Scan data: the domain(s) you verify and scan, scan results and metrics, and a lead-qualification summary derived from them (e.g. WAF/CDN identified, grade, a score/segment).
- Technical data: your IP address and a session identifier (used for rate-limiting, abuse prevention and security) and basic request logs.
2. Why we use it, and our legal basis
| Purpose | Legal basis (UK GDPR Article 6) |
|---|---|
| Run the scan and deliver/retrieve the report you requested | Performance of a contract / steps at your request (6(1)(b)); legitimate interests (6(1)(f)) |
| Email the full report to the address you provide | Your request (6(1)(b)/(f)) |
| Sales and marketing follow-up by Layerd AI about your results and related products/services | Consent (6(1)(a)) where you opt in; otherwise legitimate interests (6(1)(f)) for limited business-to-business follow-up, which you can opt out of at any time |
| Rate-limiting, abuse prevention, security and service integrity | Legitimate interests (6(1)(f)) |
| Anonymised / aggregated benchmarking and product improvement | Legitimate interests (6(1)(f)); data is aggregated and de-identified |
| Legal compliance; establishing or defending legal claims | Legal obligation (6(1)(c)) / legitimate interests (6(1)(f)) |
Where we rely on legitimate interests we have weighed them against your rights and freedoms; you can ask us for that assessment. You can withdraw consent or opt out of marketing at any time (via an unsubscribe link or dpo@layerd.com); this does not affect processing already carried out.
3. Who we share it with
- Service providers (processors) acting on our instructions, including cloud hosting and email delivery (Amazon Web Services, including Amazon SES) and other sub-processors. A current list is available on request.
- Within Layerd AI (including its sales team), as described above.
- Authorities or professional advisers where required by law or to establish or defend legal claims.
Partner referrals. If you reached Test My WAF through a partner's invitation or referral, we will let that partner know that you used the Platform, so they can follow up with you. We do not share your scan results or report with the partner unless you choose to share them yourself.
We do not sell your personal data.
4. International transfers
Where personal data is processed outside the UK (for example by our cloud or email providers), we rely on appropriate safeguards — UK adequacy regulations, or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses. Details are available on request.
5. How long we keep it
- Scan reports and PDFs: 14 days, then purged.
- Contact / lead data — active customers: retained for as long as the commercial relationship continues, reviewed at contract renewal or annually, and deleted or anonymised within 24 months of the relationship ending.
- Contact / lead data — no conversion: 24 months from the scan, then automatically deleted or anonymised, unless you engage with us again in that period. You can ask us to delete it sooner at any time.
- Security and abuse logs: 90 days.
- Aggregated / anonymised statistics: may be kept indefinitely, as they are no longer personal data.
6. Data about scanned domains and organisations
Scans run only against domains whose control has been verified by the person running the scan, at their request (see the Acceptable Use Policy). Reports describe a specific deployment's configured behaviour at a point in time (see the Terms of Service) and are not published by us as statements about any named organisation. We may retain aggregated, de-identified benchmark statistics.
7. Your rights
You have the right to access, rectify, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent. To exercise any of these, contact dpo@layerd.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk), though we'd welcome the chance to resolve your concern first.
8. Changes to this policy
We may update this policy; the current version and its date are posted on this page.