Privacy Notice
1. Who is responsible
Rabie-Abdollah Macbahi, doing business as Services AttestLayer ('AttestLayer'), is responsible for the personal information described in this notice when it acts as controller or business. Services AttestLayer is the registered business name of Rabie-Abdollah Macbahi, a sole proprietor registered in Québec (NEQ 2282022963), 360 Saint-Jacques Street, Suite G101, Montréal, QC H2Y 1P5. Rabie-Abdollah Macbahi is the Privacy Officer and person in charge of the protection of personal information. Privacy questions and requests may be sent to privacy@attestlayer.com.
AI points; it never writes. An AI model (Claude, by Anthropic) only selects sentences that already exist in your records. Every answer is a word-for-word quote, checked by fixed rules and by a second AI check, and nothing reaches your client until you approve it.
During launch, the founder reviews each of the first 10 packages before release; this access is logged like any other.
2. Scope and roles
This notice covers AttestLayer websites, Fit Check, checkout, Client Console, order support, public verification, Registry interactions, and business correspondence. When AttestLayer processes records uploaded by a business customer solely to provide an eligible Buyer Review Pack, the customer controls those records and AttestLayer acts as its processor or service provider under the Data Processing Addendum.
3. Personal information we collect
- Business contact and account information: name, organization, role, business email, telephone number, and authentication records.
- Order and billing information: selected offer, order and invoice references, payment status, billing contact, tax information, and limited payment-provider metadata. AttestLayer does not store full payment-card numbers.
- Service records: Fit Check answers, client-request metadata, authorized uploads, customer-completed responses, review and finalization actions, support messages, and package-access history.
- Technical and security information: IP address, device and browser attributes, request timestamps, session and authentication events, consent choices, fraud signals, and security or audit logs.
- Communications: information you include when contacting sales, billing, privacy, security, accessibility, or support.
If you ask us to email you a Fit Check result or document checklist, we keep your email address, the time of your consent and the request reference so that we can send that one email and answer a later request about it. We do not use the address for any other purpose without a separate consent. After a review is finalized, you may consent to anonymised figures or to being named as a customer, and you can withdraw either consent at any time by writing to privacy@attestlayer.com.
A free preview, when that option is on, keeps the records you upload for 24 hours so we can show the preview, then deletes them, unless you place an order, in which case those records become part of the order.
To check each question, we send only the relevant excerpts of your records and the question text, never whole files, to Anthropic's Claude API, which processes them in the United States. Under Anthropic's commercial terms, this data is not used to train models without permission (we have not given it) and is deleted from Anthropic's systems within 30 days, unless a usage-policy review requires longer retention. Anthropic is listed among our subprocessors.
4. Why we use personal information
- provide websites, Fit Check, checkout, Console access, package delivery, verification, support, and requested communications;
- authenticate users, protect accounts and packages, prevent abuse and fraud, investigate incidents, and maintain service integrity;
- process orders, invoices, taxes, refunds, disputes, reconciliation, and business records;
- operate, troubleshoot, measure, and improve the service using necessary telemetry and consented analytics where required;
- comply with legal, tax, accounting, security, and regulatory obligations; and
- establish, exercise, or defend legal rights.
Depending on the jurisdiction and activity, these uses rely on performing a contract, taking requested pre-contract steps, consent, compliance with law, or legitimate business interests that do not override applicable privacy rights. Consent may be withdrawn for future processing where consent is the applicable basis.
5. Sources
We obtain information from you, authorized users in your organization, your interactions with the service, payment and email providers, security and hosting providers, and business partners when you ask them to coordinate an authorized transaction. Customers must not provide personal information they are not authorized to disclose.
6. Disclosures and subprocessors
We disclose personal information only as needed to service providers that support hosting, storage, payment, transactional email, abuse prevention, analytics with applicable consent, professional advice, or legal compliance; to a successor in a lawful business transaction; or when required by law. Provider roles are listed on the Subprocessors page. We do not sell personal information or share it for cross-context behavioural advertising.
Processing is automated. The founder may open delivered packages for quality control, under the same confidentiality obligations as the Service. No one else at AttestLayer has access to your records or packages.
7. Processing locations and transfers
Providers may process information in Canada, the United States, or another disclosed location. Information processed outside your province or country may be subject to the laws of that place. We use contractual, access, encryption, minimization, and provider-review safeguards appropriate to the processing and complete any legally required transfer review.
8. Retention and deletion
We retain each category only for the period needed for its stated purpose, contractual and support obligations, security, reconciliation, and legal requirements. Detailed standard periods and deletion handling appear in the Data Retention and Deletion Policy. Protected backups are removed through their normal lifecycle unless a legal hold requires longer preservation.
9. Cookies and choices
Necessary cookies support security, authentication, preferences, and service delivery. Optional analytics is used only with the choice required by applicable law. See the Cookie Notice for categories, purposes, and controls.
10. Security
We use administrative, technical, and physical safeguards appropriate to the information, including access control, encryption in transit, managed encryption at rest, private package storage, authentication, logging, validation, and incident procedures. No security measure eliminates all risk. Do not send credentials, secrets, payment-card data, health information, source code, or unnecessary sensitive information through public contact channels.
11. Your privacy rights
Depending on applicable law, you may request access, correction, deletion, portability, restriction, or information about processing and disclosures; object to certain processing; withdraw consent; or complain to the competent privacy regulator. We may verify identity and authority before acting. Legal exceptions may apply. Email privacy@attestlayer.com and do not include unnecessary sensitive material in the first message. You may also contact the Commission d'accès à l'information du Québec or another regulator with jurisdiction.
12. Business service and minors
The service is for business entities and is not directed to children. Do not submit personal information about a minor unless it is strictly necessary, lawful, and expressly accepted for the applicable service; the standard Buyer Review Pack does not require it.
13. Changes and related documents
We may update this notice and will identify the current version on this page. Material changes affecting an active order will be communicated through the Console or business email where required.