Privacy Policy

Overview

PopLayers ("we", "us", or "our") operates the PopLayers service, accessible at app.poplayers.com. This policy explains what information we collect, how we use it, and your rights regarding that information. By using PopLayers you agree to the practices described here.

Information We Collect

Account information. When you create an account we collect your email address and, if you sign in with Google, your name and Google profile information.

Site and campaign data. We store the site names, URLs, and popup/banner campaign configurations you create within PopLayers.

Billing information. Payments are handled by Stripe. We store only a Stripe customer ID — we never see or store your card details.

Usage data. We may collect basic usage information such as the pages you visit and actions you take within the dashboard, to improve the service.

How We Use Your Information

• To provide, operate, and maintain the PopLayers service
• To authenticate your account and keep it secure
• To process payments and manage your subscription
• To send transactional emails (e.g. password reset, billing receipts)
• To improve and develop new features

We do not sell your personal information to third parties.

Third-Party Services

We use the following third-party services to operate PopLayers:

• Supabase — database and authentication
• Stripe — payment processing
• Resend — transactional email delivery
• Google OAuth — optional sign-in via Google account
• Vercel — hosting and infrastructure

Each of these services acts as a data processor on our behalf. We maintain Data Processing Agreements (DPAs) with each processor as required by GDPR Article 28. Each service also has its own privacy policy and data practices, which we encourage you to review.

Embed Script & End-User Data

The PopLayers embed script runs on your website and loads your campaign configurations from our servers. When a campaign is displayed, we record anonymised engagement events — specifically whether a campaign was shown (impression), clicked, or dismissed — linked to the campaign ID and a timestamp. These events are used solely to provide you with campaign performance analytics in your dashboard.

We do not collect your visitors' names, email addresses, IP addresses, or any other personally identifiable information. The embed script also uses localStorageon visitors' devices solely to suppress campaigns from re-appearing within your chosen suppression window.

As a PopLayers customer, you are the data controller for your website visitors. You are responsible for disclosing the use of PopLayers and its analytics in your own website's privacy policy, and for obtaining any visitor consent required by applicable law.

Data Retention

We retain different types of data for different periods:

• Account and campaign data — retained while your account is active and deleted within 30 days of account closure
• Campaign analytics (impressions, clicks, dismissals) — retained for 90 days, then permanently deleted
• Backups — encrypted backups may be retained for up to 60 days before expiring
• Billing records — retained by Stripe for up to 7 years as required by financial regulations and tax law; we retain only a Stripe customer ID

Where retention is required by law, we will retain the minimum necessary data for the minimum required period.

Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your campaign data at any time from the dashboard
• Object to or restrict certain processing of your data

To exercise any of these rights, email us at support@poplayers.com with the subject line Data Request and a description of your request. We will respond within 30 days of receiving a valid request, as required by GDPR. We may ask you to verify your identity before processing the request.

If you are located in the European Economic Area and believe we have not adequately addressed your request, you have the right to lodge a complaint with your local data protection authority.

Cookies

We use session cookies to keep you signed in. We do not use advertising or tracking cookies. The embed script uses localStorage(not cookies) to manage popup suppression on your visitors' devices.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or by posting a notice in the dashboard. Continued use of PopLayers after changes take effect constitutes acceptance of the updated policy.

Contact

If you have questions or requests regarding this policy, please contact us at support@poplayers.com.