Privacy Notice

Scope and controller

This Privacy Notice applies when you visit the Layoutweaver website, contact us, request an assisted pilot, register for or use the guided demo sandbox, use a Layoutweaver SaaS account, or use the managed Drupal demo target.

The controller is Web and Build Solutions Kft., Fáy András utca 57, 2217 Gomba, Hungary. Email: laszlo.bvarga@webandbuild.com. Further company details are in the Legal Notice.

For a separately agreed customer migration or assisted engagement, the customer normally determines why its source content and personal data are processed. In that case Web and Build Solutions Kft. may act as a processor under the applicable written scope and data-processing terms. This public notice does not replace a customer-specific data-processing agreement.

Categories of information

• Account and contact details, including name, email address, password hash, account status, roles, and verification timestamps.
• Demo registration and legal evidence, including invitation attribution; the accepted Terms version and time; the acknowledged Privacy Notice version and time; the declared source-policy version and time; and keyed email or network-address hashes used for rate limiting and abuse prevention.
• Workspace, workflow, run, mapping, analysis, import-plan, target identifier, diagnostic, support, and cleanup evidence produced while operating the service.
• Source URLs and content submitted to a run, plus temporary files and Drupal entities created in the managed demo target.
• Assisted-pilot, privacy-contact, and support information, including project context and messages you choose to submit.
• Technical and security information such as timestamps, IP-derived abuse-prevention evidence, session and request records, CAPTCHA results, and bounded authentication or replay-prevention evidence.
• Aggregate website-use measurements such as page URL, referrer, browser, operating system, device type, and approximate location derived by the analytics provider.
• Ordinary browser-request information sent to the privacy-enhanced YouTube player when it loads, including the visitor's IP address, user-agent information, and limited request context.

Purposes and legal bases

• To respond to requests, create and authenticate accounts, provide the guided demo or an agreed service, execute prepared imports, and support account deletion: steps requested before a contract and performance of the applicable Terms or contract.
• To record which legal documents applied and what action the user took: performance of the applicable Terms and our legitimate interests in demonstrating compliant operation and resolving disputes. A Privacy Notice acknowledgement records delivery of information; it is not consent to unrelated processing.
• To enforce quotas and source restrictions, prevent fraud and abuse, protect accounts and infrastructure, diagnose failures, and maintain audit evidence: our legitimate interests in operating a secure and reliable service and protecting users and third parties.
• To answer privacy, pilot, and support messages and evaluate service fit: steps requested by the sender and our legitimate interests in communicating about requested services.
• To understand aggregate website use without cross-site or persistent visitor tracking: our legitimate interests in measuring and improving the public website. This measurement is not used for individual profiling or advertising.
• To present the product demonstration through YouTube's privacy-enhanced embedded player: our legitimate interests in explaining and demonstrating the service. The direct external YouTube link remains available as an alternative.
• To keep records or disclose information where law requires it: compliance with a legal obligation.

Where processing is based on legitimate interests, you may object based on your particular situation. Layoutweaver does not use the listed information for decisions that produce legal or similarly significant effects.

Managed demo target

The demo uses a separately deployed shared Drupal target. Layoutweaver maps the SaaS account to a restricted target account and scopes imported entities and files to the user's workspace and run. Other demo users are not permitted to view those account-scoped listings. Authorized administrators may access them for security, support, cleanup, and service operation.

Recipients, providers, and data locations

• Amazon Web Services (AWS): the production SaaS, database, files, backups, managed demo target, and transactional email infrastructure use the AWS US East (N. Virginia) region in the United States. AWS's Data Processing Addendum applies to customer data and includes the European Commission's Standard Contractual Clauses where applicable.
• Plausible Insights OÜ, Estonia: Plausible provides aggregate public-site analytics. Its current hosted service is EU-based, uses no analytics cookies or persistent identifiers, and does not retain raw IP addresses or full user-agent values.
• Google email services: limited contact, pilot, and demo-registration notification copies may be delivered to an operator-managed Gmail mailbox. These copies are separate from Drupal Webform storage and follow the operational mailbox retention criteria below.
• Guided source and external media: when you start the guided workflow, your browser accesses the approved Oxylabs sandbox source and that site receives ordinary browser-request information. The public landing page loads its embedded demonstration from YouTube's privacy-enhanced youtube-nocookie.com domain. Loading the player establishes a connection to YouTube and sends ordinary browser-request information. YouTube states that a view in privacy-enhanced mode is not used to personalize the viewer's YouTube experience or advertising. Playing or otherwise interacting with the player may result in additional processing under YouTube's own terms and privacy information.

The registration CAPTCHA is calculated locally and does not send the answer to an external CAPTCHA provider. We may also disclose information to professional advisers, authorities, or another recipient where necessary to establish or defend legal claims or where law requires it. We do not sell personal information or use it for third-party advertising.

Retention

• Raw completed demo-registration Webform submissions: scheduled for deletion after 7 days. The durable account, registration state, and versioned legal evidence described below are intentionally separate.
• Managed demo runs and target content: a run normally expires after approximately 7 days and a demo enrollment after approximately 30 days; an administrator may apply a shorter policy. Expired target entities, files, jobs, and associated operational ledger evidence are removed by the managed cleanup process.
• Account, workflow, registration, and legal evidence: retained while the account or applicable service relationship is active. Account deletion removes the managed demo account and its scoped workflow and target data after verified cleanup. Limited evidence may be retained longer where required by law or necessary to establish, exercise, or defend legal claims.
• Contact, pilot, support, and mailbox copies: retained while follow-up, an active service relationship, legal obligations, or a dispute require them, then selected for deletion. An email notification copy is not removed by the 7-day Webform purge.
• Security logs and backups: logs are bounded and rotated for security and troubleshooting; backups expire under the applicable operational rotation. Data in a backup is not returned to ordinary use, and an applicable deletion is reapplied if restoration is necessary.

Where an exact period is not stated, the retention decision is based on whether the account or requested service is active, whether the information remains necessary for security and support, and whether a statutory obligation or legal claim requires continued retention.

Account deletion

A managed demo participant can request deletion from the Account page. The request requires the current password and a single-use email confirmation. Access and API tokens are then revoked. Layoutweaver first verifies deletion of managed target entities, files, ledger rows, handoffs, and the restricted target account, and then deletes the user's SaaS workflows, runs, analysis data, demo registration, personal workspace, and SaaS account.

While cleanup is pending or failed, the account identity may remain available to authorized administrators so the request can be completed. After successful cleanup, the deletion audit retains only a random request identifier, timestamps, outcome, non-identifying deletion counts, and the administrator who processed the request. Separate assisted-pilot or privacy-contact submissions are not automatically removed by the account button because they may have a separate purpose; they can be included in a broader privacy request.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data, and may object to processing based on legitimate interests. Use the privacy contact form or email laszlo.bvarga@webandbuild.com. We normally respond without undue delay and within one month; the law permits an extension for complex or numerous requests. We may need to verify your identity. A request may be limited where continued processing is required or otherwise permitted by law.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11; postal address: 1363 Budapest, Pf. 9; email: ugyfelszolgalat@naih.hu; website: www.naih.hu. You may also seek a judicial remedy or contact another competent supervisory authority.

Cookies and local extension data

The website uses session and security cookies needed for sign-in and account operation. Plausible analytics does not set analytics cookies. The embedded YouTube player uses the privacy-enhanced youtube-nocookie.com domain, but loading and interacting with third-party media remains subject to YouTube's own data-handling practices. The Chrome extension may keep workflow or runtime state in browser storage under its defined product contract. Deleting a SaaS account revokes server access but does not erase unrelated browser data; the extension can be removed or its storage cleared separately.

Changes

This notice may be updated as Layoutweaver's demo, assisted services, providers, or retention practices evolve. Material changes may require a new acknowledgement before further account use. Current version: 2026-07-27.3.