Privacy Policy - Layer7 Consulting

1. Introduction

Welcome to Layer7 Consulting Inc. ("Layer7," "we," "our," or "us"), a corporation based in Milton, Ontario, Canada, which operates this website and provides the services described on it. We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this privacy notice, or our practices with regards to your personal information, please contact us.

2. Information We Collect

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Website, or otherwise when you contact us.

Personal Information Provided by You: We collect names, email addresses, phone numbers and other similar information necessary to respond to enquiries and provide our consulting and technology services.
Guide and Worksheet Requests: If you request a guide by email, we collect the email address needed to deliver it, the requested resource, the source page, submission time, and limited security information used to prevent abuse. Requesting a guide does not add the address to a marketing list. If you separately ask Layer7 to contact you about a readiness review, we also retain that request as an enquiry.
Project and Environment Information: If you submit a project brief or book a call, you may choose to share information about source and destination environments, workloads, systems, dependencies, timing, risks, business requirements, or other information relevant to the requested service. Do not submit passwords, private keys or access credentials through the website.
Information Automatically Collected: We automatically collect certain technical information when you visit, use, or navigate the Website. This may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, approximate location, and information about how and when you use our Website.

3. How We Use Your Information

We use personal information collected via our Website for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations.

To fulfill and manage your orders and projects.
To respond to project enquiries and communicate with you about a requested service.
To respond to user inquiries and offer support.
To send administrative information to you.
To deliver a guide or worksheet that you requested and, only when separately requested, respond once about the specified readiness-review service.
To schedule calls, review project briefs, and prepare appropriate next steps or project recommendations.
With your optional analytics consent, to understand which pages, guides and referral sources contribute to legitimate enquiries and improve the website.

4. Third-Party Processors and Embeds

Our website uses trusted third-party services to operate contact, scheduling, hosting, and display features. These services may process limited technical or submitted information according to their own privacy terms.

Google Calendar: Used to provide appointment scheduling and booking availability.
Google Fonts: Used to load website typography.
Cloudflare and hosting providers: Used for DNS, CDN, security, caching, and website delivery.
Google Analytics 4 (optional): Used to measure page visits, referral sources and limited website interactions only after a visitor chooses “Allow analytics.” The Google tag does not load when analytics is declined or no choice has been made. Advertising storage, advertising personalization and Google Signals are disabled. Layer7 does not send names, email addresses, telephone numbers, project descriptions or other form contents to Google Analytics.

When allowed, Google Analytics may use first-party analytics cookies and may process technical and usage information outside Canada, including in the United States, under Google's terms and privacy practices. You can change or withdraw your choice at any time using the Analytics choices button at the lower-left of the website. Withdrawing consent disables future Layer7 analytics events and removes Layer7's Google Analytics cookies from the browser where practical.

5. AI Voice Receptionist — Calls, Recording and Where the Data Goes

This section applies to our AI voice receptionist service. It matters to two different people: the business that hires us to answer its phone, and the customer who calls that business. Where the two differ, we say so.

Callers are told before anything is recorded

Every call opens with a spoken notice that the caller has reached an AI assistant and that the call is recorded. It is the first thing said, on every call, before any details are taken. A caller who does not want to be recorded can say so — the receptionist stops, takes only a name and a number, and a person from the business calls them back.

What is collected on a call

An audio recording of the call and a written transcript of it.
The caller's name and phone number.
What the caller said they need, in their own words, and any appointment booked.
The time, duration and outcome of the call.

We do not ask for and do not want payment card numbers, health information, or government identifiers. Callers should not read them out.

Why it is collected

To answer the call, book the appointment into the business's calendar, pass a message or an emergency to the business, and give the business a record of what was arranged. Nothing from a call is used to advertise to the caller, and nothing is sold.

Processing happens in the United States

The voice platform we build on runs in the United States, and there is no Canadian region available for it. Call audio, transcripts and the details above are therefore processed and stored on servers in the United States, where they may be accessible to United States authorities under United States law. We disclose this rather than imply the data stays in Canada, because it does not. The processors involved are:

Retell AI: the voice platform. Carries the call, records it, and produces the transcript.
OpenAI: the language model that understands the caller and decides what to say.
ElevenLabs: converts the receptionist's replies into speech.
Twilio and carrier partners: the telephone connection, and text alerts where a business has enabled them.
Google Calendar: where a confirmed appointment is written.

Who the record belongs to, and how long we keep it

Call recordings, transcripts and booking records belong to the business whose phone was answered, not to us. We hold them to run the service and to support billing, which is measured in answered minutes. A business can ask us to delete its call data at any time, and we delete it on request when the service ends. A caller who wants their own details removed should contact the business they called; we act on that business's instruction. Where a recording is needed to resolve a billing or safety question it may be retained until that is settled.

Emergencies

If a caller describes a gas smell, carbon monoxide, fire, flooding or anyone in danger, the receptionist stops taking details and transfers the call to the business's on-call number. The transferred call is a normal phone call between the caller and that person.

6. Will Your Information Be Shared With Anyone?

We only share information with your consent, to comply with laws, to provide services, to protect rights, or to fulfill business obligations. We do not sell your personal information to third parties.

7. Data Security and Retention

We use reasonable administrative and technical safeguards to protect information submitted to us. We keep project and contact information only as long as needed for business, legal, security, and record-keeping purposes.

8. Contact Us

If you have questions or comments about this notice, you may contact us at [email protected] or through the contact form on our website.