Privacy Policy
EvalLayer is operated by Hivetivity Inc. This describes what we collect, why, how long we keep it, and how to make us delete it. The technical detail behind these commitments is on the Security and Trust page.
Last updated 2026-07-29 · Hivetivity Inc.
What we collect
- Content you submit to the API: the action content, context, and policy you send to /authorize or the deliverable you send to /evaluate.
- Account data: your agent identifier, a SHA-256 hash of your API key (never the key itself), tier, and usage counts.
- Form submissions: name, company, work email, and the description you write on the design partner form.
- Request metadata: timestamps, endpoint, response status, and coarse request telemetry including page path, referrer host, country, and client class. We do not set advertising cookies and we do not run third-party analytics scripts.
How we use it
Submitted content is used to produce the decision or verdict you requested, and to create the audit record attached to it. Account and usage data enforce rate limits and tiers. Form submissions are used to evaluate fit for the design partner program and to reply to you.
We never train models on your content. Semantic checks run on Cloudflare Workers AI within the same infrastructure that serves the API, and per Cloudflare's Workers AI terms your inputs and outputs are not used to train their models either. Your content is not sold, licensed, or shared for advertising, ever.
How long we keep it
- Raw action content: 90 days. Deleted automatically by a storage lifecycle rule, not a manual process.
- Decision records (decision, violation rule names, content hash, policy version, signature): retained for the life of the account, because deleting them would destroy the audit trail they exist to provide.
- Policy versions: retained while the policy is in use.
- Form submissions: retained until you ask us to delete them.
Design partners and enterprise accounts can request a shorter raw-content window or zero-retention processing, configured at onboarding.
Who else touches your data
Our subprocessors are Cloudflare (compute, storage, and AI inference), Resend (our operational email), and Stripe (payments; card details never reach our systems). Design partner form submissions also flow into our CRM so a human can reply. We do not sell data to anyone.
Your choices
Email support@evallayer.ai to access, correct, export, or delete your data, or to request a Data Processing Agreement. We complete deletion requests within 30 days. If you are in a jurisdiction with statutory data rights (for example the GDPR or the CCPA), we honor those requests regardless of where you are located, and we do not discriminate against you for making one.
Children and changes
EvalLayer is a developer tool not directed to anyone under 16. If this policy changes materially we will update this page and the date above, and notify active accounts by email.