Privacy Policy

1. Scope

This Privacy Policy applies to the websites, product interfaces, APIs, hosted platform, support interactions, and marketing activities operated by Copper Asset Management, LLC, doing business as AControlLayer. In many cases, AControlLayer processes information on behalf of a customer organization. When we do that, the customer controls the purposes for which the data is used, and we act as a service provider or processor under our contract with that customer.

2. Information We Collect

We collect the following categories of information, depending on how you use ACL:

• Account and profile data, such as name, email address, phone number, job title, department, company name, workspace membership, and onboarding details.
• Workspace and customer data, such as uploaded files, prompts, workflow configurations, logs, approvals, notes, notifications, API and webhook settings, documents, and other data that you or your organization choose to process through ACL.
• Integration data, such as connected account identifiers, OAuth scopes, account metadata, encrypted access tokens, encrypted refresh tokens, encrypted API credentials, and data retrieved or sent through customer- authorized integrations.
• Usage, device, and security data, such as IP address, browser and device information, user agent, session identifiers, tenant identifiers, timestamps, audit trails, error reports, request metadata, and rate-limit and abuse-prevention signals.
• Marketing and communications data, such as contact form submissions, newsletter subscription details, referral source, and support or sales correspondence.

3. How We Use Information

• Provide, operate, secure, maintain, and improve the ACL platform and related services.
• Authenticate users, manage tenants and permissions, and enforce security controls.
• Store, process, transmit, and log customer-authorized workflows, integrations, and agent actions.
• Send transactional messages, service notices, security alerts, and support communications.
• Respond to inquiries, provide customer support, and manage design partner or sales conversations.
• Detect fraud, abuse, misuse, security incidents, and violations of our terms or policies.
• Comply with applicable law, lawful requests, and contractual obligations.
• Send marketing communications where permitted by law and subject to your preferences.

4. Legal Bases Where Applicable

Where data protection law requires a legal basis, we rely on one or more of the following: performance of a contract, legitimate interests in operating and securing the service, your consent, and compliance with legal obligations.

5. How We Share Information

We may share information in the following circumstances:

• With infrastructure, hosting, security, email, database, storage, monitoring, and support vendors that help us operate ACL.
• With third-party services that you or your organization choose to connect to ACL, including integrations and model providers used to process your requests.
• Within your organization, including workspace administrators, authorized users, and customer-designated reviewers.
• When required to comply with law, regulation, court order, or valid governmental request.
• In connection with a merger, financing, acquisition, reorganization, sale of assets, or similar corporate transaction, subject to appropriate confidentiality measures.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

6. Cookies, Local Storage, and Similar Technologies

ACL uses cookies, browser storage, and similar technologies for core product functionality, such as authentication, tenant selection, draft preservation, security, and abuse prevention. We may also use service diagnostics and error-monitoring tools to keep the platform reliable and secure.

Because there is no universally accepted standard for browser Do Not Track signals, our sites do not currently respond to them.

7. Data Retention

We retain information for as long as needed to provide the service, comply with our contractual and legal obligations, resolve disputes, enforce agreements, and maintain security and audit integrity. Retention periods vary based on the nature of the data, your account status, customer instructions, and legal requirements.

8. Security

We use technical and organizational measures designed to protect information, including encryption in transit, encryption at rest for certain sensitive fields and integration credentials, access controls, audit logging, rate limiting, and security monitoring. No system is perfectly secure, and we cannot guarantee absolute security.

9. International Data Transfers

ACL and our service providers may process information in the United States and other countries where we or they operate. Those jurisdictions may have data protection laws that differ from the laws of your location.

10. Your Choices and Rights

Depending on where you live and subject to applicable law, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. You may also opt out of marketing emails by using the unsubscribe link in the message.

If ACL processes your information on behalf of a customer organization, you should direct your request to that organization first. We will assist our customers with appropriate requests where required by law or contract.

11. Children's Privacy

ACL is intended for business and professional use. We do not knowingly collect personal information from children under 13.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will update the effective date on this page and may provide additional notice where appropriate.

13. Contact Us

For privacy questions or requests, contact support@acontrollayer.com. For security issues, please use security@acontrollayer.com and see our security contact details. You may also write to us at Copper Asset Management, LLC, 1718 Capitol Ave, Cheyenne, WY 82001, United States.