Privacy Notice

1. Who is responsible for your information

The controller responsible for your personal information is Steven Chell, trading as Layered, 40 Barnes View, Sunderland, SR4 7QA, United Kingdom.

If you have any questions about how your information is handled, or if you wish to exercise any of your rights, you can contact Layered at hello@layeredskincare.com.

2. Information Layered may collect

Depending on how you interact with Layered, the following categories of personal information may be collected:

• Identity and contact details — your name and email address, provided when you contact Layered, purchase a guide, or sign up to the Layered mailing list.
• Skincare and routine information — details about your current skincare products, routine, skin concerns, sensitivities and goals, provided when you request a personalised review.
• Health-related information — information about skin reactions, sensitivities and relevant safety considerations, provided as part of a personalised review. This is special-category data and requires your explicit consent before it is processed.
• Payment information — Stripe processes payments on behalf of Layered. Layered does not receive or store your card details directly.
• Communication content — the content of messages sent through the contact form.
• Technical information — minimal server-side request logs generated by hosting infrastructure.

3. Where your information comes from

All personal information is provided directly by you through your interactions with the Layered website — when you submit a contact form, purchase a guide, sign up to the mailing list, or complete the personalised review questionnaire. Layered does not purchase, obtain or infer personal information from third-party data sources.

4. Why Layered uses your information

Layered processes personal information only for specific, documented purposes. The legal basis for each purpose is set out below.

5. Children and personalised reviews

Layered personalised reviews are intended for people aged 18 and over. Layered does not knowingly provide personalised reviews to children, and customers are asked to confirm that the intended review recipient is eligible before using the personalised review service. If Layered becomes aware that information has been submitted by an under-18 review recipient, it will be handled in accordance with applicable data-protection and record-keeping obligations.

6. AI-assisted preparation of personalised reviews

Personalised reviews are researched and written by Layered. AI-assisted tools may be used as part of the preparation process — for example, to support drafting, research or organisation of the review content.

Where AI-assisted services are used:

• Only approved services are used.
• The personal and health-related information you provide is handled in accordance with this Privacy Notice and the relevant service provider's data processing terms.
• No automated decisions with legal or similarly significant effects are made solely by AI — all reviews reflect Layered's own judgement and editorial responsibility.

Your explicit consent to process health-related information, given at the point of submitting your review details, covers this use.

7. Service providers and recipients

Layered uses a small number of trusted third-party service providers. Personal information is shared with these providers only to the extent necessary for the relevant service.

• Stripe — payment processing. Stripe handles payment card data directly. Layered receives only payment confirmation and metadata (such as which product was purchased). Stripe is subject to its own privacy and security standards.
• MailerLite — mailing-list management and email delivery for the Layered newsletter. Email addresses of mailing-list subscribers are stored with MailerLite.
• Resend — transactional email delivery, used for contact form responses and operational communications.
• Neon (PostgreSQL infrastructure) — the database that stores personalised review submissions, contact enquiries, guide purchase records and newsletter subscriptions.
• Replit — infrastructure and hosting provider for the Layered website and application.
• Google Fonts — the Inter typeface used on this website is loaded remotely from fonts.googleapis.com and fonts.gstatic.com. Your browser connects directly to Google's servers to download the font. Google may log your IP address and browser information as part of this request.
• Approved AI-assisted services — used as part of personalised review preparation, as described in section 6.

Layered does not sell personal information. Personal information is not shared with advertising networks, data brokers or any third party for marketing purposes.

8. International processing

Some of the service providers listed above process personal information outside the United Kingdom and the European Economic Area. Where this occurs, Layered relies on appropriate safeguards to protect your information — including standard contractual clauses approved by the relevant authority, or adequacy decisions where applicable.

If you would like more information about the safeguards in place for a specific provider, please contact Layered at hello@layeredskincare.com.

9. How long Layered keeps information

Layered retains personal information only for as long as is necessary for the relevant purpose.

• Personalised review submissions — retained for 12 months after the review is delivered, after which the submission data is deleted or permanently anonymised.
• Mailing-list records — retained for as long as you remain subscribed. If you unsubscribe, your email address is removed from the active list promptly.
• Contact enquiries — retained for a reasonable period necessary to handle the enquiry and any reasonable follow-up, after which they are deleted.
• Guide purchase records — retained in accordance with applicable accounting and legal obligations.

10. Cookies, analytics and similar technologies

The Layered website does not use:

• Non-essential analytics cookies or tracking pixels
• Advertising pixels or retargeting technologies
• Layered's own behavioural tracking or profiling
• localStorage, sessionStorage or IndexedDB for tracking purposes

The only external connection made by the website on a standard page load is to Google's font servers (fonts.googleapis.com and fonts.gstatic.com) to load the Inter typeface. This connection is made by your browser and may result in your IP address being logged by Google. No consent banner is shown because no non-essential cookies or tracking technologies are in use.

11. Security

Layered takes reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration and destruction. These include encrypted data transmission (HTTPS), access controls on systems holding personal data, and use of reputable infrastructure providers with their own security practices. No method of transmission over the internet is completely secure, and Layered cannot guarantee absolute security.

12. Your rights

Under UK data protection law, you have the following rights in relation to your personal information:

• Right of access — to request a copy of the personal information Layered holds about you.
• Right to rectification — to request correction of inaccurate or incomplete information.
• Right to erasure — to request deletion of your personal information where there is no overriding reason for Layered to continue holding it.
• Right to restriction — to request that processing of your information is limited in certain circumstances.
• Right to data portability — to receive personal information you have provided in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

These rights are not absolute. In some circumstances, Layered may be entitled to refuse a request, in which case you will be informed of the reason.

13. Exercising your rights

To exercise any of your rights, or to ask a question about how your information is handled, please contact Layered at hello@layeredskincare.com. Layered will respond within one month of receiving a valid request, in line with UK data protection law. If a request is complex or Layered receives multiple requests, this period may be extended by a further two months, with notice provided.

14. Complaints

If you are unhappy with how Layered has handled your personal information, you are encouraged to contact Layered first so the matter can be addressed directly.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), which is the supervisory authority for data protection in the United Kingdom. The ICO can be reached at ico.org.uk or by post at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. Changes to this Privacy Notice

Layered may update this Privacy Notice from time to time — for example, when services change or to reflect new legal requirements. The date at the top of this page shows when the notice was last updated. Where a change is significant, Layered will take reasonable steps to bring it to your attention.