Summary: Preface is operated by DevLayer Ltd, a UK company. We collect only what we need to run the service. We do not sell your data. We do not share it with third parties except the sub-processors listed in this policy. We store all platform data within the UK or EEA. A Data Processing Agreement is available to all customers at no extra charge.
1. Who we are
Preface is a product of DevLayer Ltd, a company registered in England and Wales. DevLayer Ltd is the data controller for personal data collected through the Preface website (usepreface.ai) and the Preface application (app.usepreface.ai).
Our data protection contact is reachable at [email protected].
2. What data we collect and why
2.1 Account and billing data
When you create a Preface account we collect:
- Name and email address
- Password (stored as a one-way hash — we never store the plaintext)
- Billing information (processed by our payment provider — we do not store card details)
- Company name and workspace name, if provided
2.2 Usage and product data
While you use the Preface builder and Chrome extension we collect:
- Screenshots and step content you capture (stored in your workspace)
- Annotations, voiceover files, and demo settings you create
- Actions taken within the builder (for product analytics and support purposes)
- Browser type and version, for the Chrome extension
2.3 Demo viewer data
When a third party views a demo you have published through Preface, we may collect:
- Email address, if the viewer submits a gate form
- IP address, browser type, country of origin (for analytics only — not linked to identity unless a gate is submitted)
- Interaction events: step views, time on step, CTA clicks, completion events
Demo viewer data is stored on your behalf and is accessible to you in the Preface analytics dashboard and leads export. You are the data controller for data your demo viewers submit. See Section 5.
2.4 Communication data
If you contact us by email or through a support channel, we retain the content of that correspondence in order to respond and to maintain a record of your support history.
2.5 Website visit data
Our website (usepreface.ai) collects standard server logs including IP address, referrer, user agent, and pages visited. This is used for security monitoring and aggregate traffic analysis only.
3. Legal basis for processing
| Processing activity | Legal basis (UK GDPR) |
|---|---|
| Providing the Preface platform under your subscription contract | Contract (Art. 6(1)(b)) |
| Billing and payment processing | Contract (Art. 6(1)(b)) |
| Sending transactional emails (receipts, password reset, gate notifications) | Contract (Art. 6(1)(b)) |
| Fraud prevention and security monitoring | Legitimate interests (Art. 6(1)(f)) |
| Product analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (where opted in) | Consent (Art. 6(1)(a)) |
| Processing demo viewer data on behalf of customers | Processor acting under customer instruction (Art. 28) |
4. How we use your data
We use the data we collect to:
- Create and maintain your Preface account and workspace
- Deliver the features you subscribe to, including demo hosting, lead capture, analytics, and voiceover generation
- Send transactional communications — account confirmations, gate lead notifications, subscription receipts
- Provide customer support and respond to your requests
- Detect and prevent fraud, abuse, or security incidents
- Improve and develop the Preface platform, using aggregated and anonymised product analytics
- Comply with legal obligations, including tax record-keeping
We do not sell your personal data to any third party. We do not use your data to train AI or machine learning models without your explicit consent.
5. Data we process on your behalf
Preface acts as a data processor for personal data that your demo viewers submit through gate forms on demos you publish. This includes email addresses and any other information your viewers provide.
You are the data controller for this data. You are responsible for ensuring you have a lawful basis to collect it, that your privacy notices to viewers are accurate, and that you respond to any data subject requests relating to it.
Our obligations as your processor are set out in the Data Processing Agreement, which is available to all plan tiers at no additional cost.
6. Sharing and sub-processors
We share data with the following categories of third party, strictly to operate the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | CDN and DDoS protection | EEA / UK |
| Payment processor (Stripe, Inc.) | Subscription billing and card processing | EEA / UK |
| Amazon Web Services (SES) | Delivery of transactional emails (gate notifications, receipts, password reset) | EEA / UK |
| ElevenLabs, Inc. | AI voiceover generation (only when you use this feature) | USA — Standard Contractual Clauses apply |
We will update this list when we add or change sub-processors and notify customers with reasonable notice before doing so.
7. International data transfers
Preface is operated from the United Kingdom. Our primary data storage and processing occurs within the UK or EEA.
Where we transfer personal data to a sub-processor located outside the UK or EEA — specifically ElevenLabs, which is US-based — we do so under Standard Contractual Clauses (SCCs) as approved under UK GDPR, ensuring an equivalent level of protection applies.
We do not transfer personal data to countries that lack adequate data protection frameworks without appropriate safeguards in place.
8. Data retention
| Data type | Retention period |
|---|---|
| Account and billing data | For the duration of your subscription, plus 7 years for tax/financial records |
| Demo content (screenshots, annotations, voiceover) | For the duration of your subscription. Deleted within 30 days of account closure |
| Demo viewer analytics and lead data | For the duration of your subscription. Deleted within 30 days of account closure |
| Support correspondence | 3 years from the date of last contact |
| Server logs (website) | 90 days |
| Gate submission logs | 90 days |
You may request earlier deletion of your data at any time — see Section 9.
9. Your rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your data (subject to legal retention obligations)
- Right to restriction — request that we limit processing of your data in certain circumstances
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, email [email protected]. We will respond within 30 days. We may ask you to verify your identity before acting on a request.
If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
10. Cookies
We use a small number of cookies to operate the Preface platform:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Maintains your authenticated session in the Preface application | Session / 2 hours |
| CSRF token | Security — prevents cross-site request forgery | Session |
| Demo viewer session | Identifies an anonymous demo viewing session for analytics (no personal data) | 24 hours |
We do not use advertising cookies, third-party tracking pixels, or behavioural analytics cookies on the marketing website or the Preface application.
11. Children
Preface is a business tool intended for use by adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with their personal data, please contact [email protected] and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify registered customers by email with at least 14 days' notice before the changes take effect. The effective date at the top of this page will always reflect the current version.
Your continued use of Preface after a policy update constitutes acceptance of the revised terms.
13. Contact us
For any privacy-related questions, data subject requests, or concerns:
- Email: [email protected]
- General enquiries: [email protected]
- Company: DevLayer Ltd, England and Wales