Legal

Terms of Service

Effective November 16, 2026. WhoLayer, Inc.

1. The service

WhoLayer provides identity data products, which may include:

• Visitor ID: a JavaScript tag that identifies companies and, in the United States, individual people visiting your website.
• Shopper ID: identification of anonymous visitors to ecommerce sites and delivery of verified email addresses to your marketing tools.
• Data API and MCP: lookup, search, enrichment, and verification of business and contact data through our API, MCP server, integrations, and browser extension.
• Identity Cloud: licensed identity data delivered by API, file, or warehouse share under a signed order form.

Together these are the “Service,” and the data we return to you is “Output Data.” We may change, add, or remove features. If we remove a feature you pay for in a way that materially reduces the Service, you may cancel and receive a prorated refund of prepaid fees for the remaining term.

2. Your account

You are responsible for everything done under your account, including by your users, contractors, and any AI agent or automation you connect with your API key. Keep credentials secret. Tell us promptly at security@wholayer.com if you believe your account has been compromised.

3. Your obligations when using the Service

You are responsible for using the Service lawfully. In particular, you agree that you will:

1. Give notice on your website. Keep a privacy policy on every site where the WhoLayer tag is installed that discloses, in clear terms, that you use third-party technology to identify visitors and that visitor information is disclosed to third parties such as WhoLayer. We provide sample language in our documentation.
2. Honor privacy choices. Provide a “Do Not Sell or Share My Personal Information” link where required, honor Global Privacy Control signals, and configure the tag so it does not fire for visitors who have opted out.
3. Collect consent outside the United States. Person-level identification is only available for US traffic. For any visitors outside the United States, you must obtain consent through a consent banner or consent management platform before enabling company-level identification, where the law of the visitor's location requires it.
4. Have a lawful basis for every outreach. Comply with the CAN-SPAM Act and all other email laws, including accurate sender information, a working unsubscribe link, and your postal address in every commercial email, and honor unsubscribes within 10 business days.
5. Comply with telemarketing laws. You are solely responsible for compliance with the Telephone Consumer Protection Act, the Telemarketing Sales Rule, state telemarketing and “mini-TCPA” laws, and the National Do Not Call Registry. WhoLayer does not provide consent to call or text anyone. Do not use mobile numbers from WhoLayer for autodialed, prerecorded, or artificial-voice calls or for marketing text messages unless you have obtained the consent the law requires directly from the person.
6. Not use Output Data for eligibility decisions. WhoLayer is not a consumer reporting agency, and Output Data is not a “consumer report” under the Fair Credit Reporting Act. You will not use Output Data, in whole or in part, to determine anyone's eligibility for credit, insurance, employment, housing, education, government benefits, or any other purpose covered by the FCRA or similar laws.
7. Not install the tag on sensitive sites. Do not install the tag on pages that relate to health conditions, reproductive or sexual health, sexual orientation, religion, immigration status, criminal history, financial hardship, or content directed to children under 16, as described in our Acceptable Use Policy.
8. Follow the Acceptable Use Policy and Fair Use Policy, which are part of these Terms.

4. Our obligations

• We check every person we return against our global suppression list, which includes every consumer who has opted out of or requested deletion from WhoLayer and every deletion request we receive through the California Delete Request and Opt-out Platform.
• We do not return person-level identities for visitors outside the United States.
• We maintain the security measures described in our Data Processing Addendum.
• We maintain the data broker registrations required by law in the states where we operate.

5. Data you send us

“Customer Data” means data you or your website visitors send to the Service, including tag events and records you upload or submit through the API. You own Customer Data. You grant us a limited license to use Customer Data to provide, secure, and support the Service for you, and to compute aggregated, de-identified statistics (for example, match-rate benchmarks) that do not identify you or any individual.

We do not add your Customer Data to a shared database that is sold or provided to other customers. Our processing of personal information in Customer Data is governed by the Data Processing Addendum.

6. Output Data license

Subject to these Terms and payment of fees, we grant you a non-exclusive, non-transferable license to use Output Data for your internal business purposes, including sales, marketing, and analytics. You may not sell, license, publish, or distribute Output Data to third parties, or use it to build a competing database, unless you have a signed Platform agreement with us. When a person asks you to stop contacting them, or we notify you that a person has opted out or requested deletion, you will stop using and delete that person's Output Data within 15 days.

Identity data is probabilistic. We work to make Output Data accurate and publish our measured accuracy on our Trust page, but we do not guarantee that any particular record is complete, current, or correct.

7. Plans, credits, and billing

• Subscriptions. Paid plans are billed in advance, monthly or annually, and renew automatically for the same period until cancelled. We will remind you by email at least 7 days before an annual plan renews.
• Credits. Each plan includes a monthly allotment of credits. Credits are consumed as described on our pricing page. We only charge credits when we return a result; we do not charge for lookups that find nothing.
• Rollover. Unused credits on paid plans roll over for one month and expire at the end of the month after the one in which they were issued.
• Overage. If you use more credits than your plan includes, paid plans continue and we bill the overage at your plan's per-credit rate at the end of the billing month. You can set a hard monthly spending cap on the Usage page of your account. On the Free plan, person-level results pause until the next month; company-level ID continues.
• Cancellation. You can cancel at any time from the Billing page of your account. Monthly plans remain active until the end of the paid period. Annual plans cancelled within the first 30 days receive a prorated refund for the unused portion. Otherwise fees are non-refundable except as these Terms or the law require.
• Price changes. We will give you at least 30 days' notice of price increases, which take effect at your next renewal.
• Taxes. Fees exclude taxes. You are responsible for applicable sales, use, and similar taxes, other than taxes on our income.
• Late payment. If payment fails, we will notify you and may suspend the Service if it remains unpaid 10 days after notice.

8. Suspension

We may suspend your access, in whole or in part, if we reasonably believe your use violates these Terms or the law, creates a security risk, or exposes WhoLayer or any person to harm. We will tell you why and give you a chance to fix the problem unless the law or the risk prevents it.

9. Confidentiality

Each party will protect the other's non-public information with at least reasonable care and use it only to perform under these Terms. This does not apply to information that is public, already known to the recipient, independently developed, or rightfully received from a third party. A party may disclose confidential information when legally required, after giving notice where allowed.

10. Intellectual property

We own the Service, our software, our identity graph, and all improvements to them. You may not reverse engineer, scrape, or copy the Service, or use it to build a competing product. If you send us feedback, we may use it without obligation to you.

11. Warranties and disclaimers

Each party warrants that it has authority to enter into these Terms. We warrant that the Service will perform materially as described in our documentation. Your sole remedy for breach of this warranty is for us to fix the issue or, if we cannot, to let you terminate and refund prepaid fees for the affected period. Except as expressly stated, the Service and Output Data are provided “as is,” and we disclaim all implied warranties, including merchantability, fitness for a particular purpose, accuracy, and non-infringement.

12. Indemnification

You will defend and indemnify WhoLayer against third-party claims, and resulting fines, damages, and reasonable legal fees, arising from (a) your websites, privacy notices, and consent practices; (b) your emails, calls, texts, and other outreach, including claims under the CAN-SPAM Act, the TCPA, and state telemarketing laws; (c) your use of Output Data in violation of these Terms or the law; or (d) Customer Data.

We will defend and indemnify you against third-party claims alleging that the Service, as provided by us, infringes intellectual property rights, or that we obtained the data we supply to you in violation of law or of our suppliers' contracts.

The indemnified party must give prompt notice, allow the indemnifying party to control the defense, and cooperate reasonably. No settlement that imposes obligations on the indemnified party may be made without its consent.

13. Limitation of liability

Except for your payment obligations, your indemnity obligations, and either party's breach of confidentiality: (a) neither party is liable for indirect, incidental, special, consequential, or punitive damages, or lost profits or revenue; and (b) each party's total liability arising out of these Terms will not exceed the fees you paid or owed to WhoLayer in the 12 months before the event giving rise to the claim.

14. Term and termination

These Terms apply while you have an account or a subscription. Either party may terminate for material breach that is not cured within 30 days of written notice. When these Terms end, your right to use the Service ends, and you must delete Output Data that you obtained during the term within 30 days, except data you are required by law to keep. Sections 5, 6 (deletion duties), 9, 10, 11, 12, 13, 15, and 16 survive.

15. Disputes

These Terms are governed by the laws of the State of Delaware, without regard to conflict of laws rules. Any dispute arising out of these Terms or the Service will be resolved by binding individual arbitration administered by JAMS under its Streamlined Arbitration Rules, and not in a class or representative action. Either party may bring an individual claim in small claims court or seek injunctive relief in court for misuse of intellectual property or confidential information. Before starting arbitration, a party must send written notice of the dispute and attempt in good faith to resolve it for 30 days.

16. General

• Changes to these Terms. We may update these Terms. We will give at least 30 days' notice of material changes by email or in the product. Continued use after the effective date means you accept the changes.
• Assignment. Neither party may assign these Terms without consent, except to a successor in a merger, acquisition, or sale of substantially all of its assets.
• Order forms. If you sign an order form with us, it controls over these Terms where they conflict.
• Notices. We send notices to the email address on your account. Send notices to us at legal@wholayer.com.
• Force majeure. Neither party is liable for delay caused by events beyond its reasonable control.
• Entire agreement. These Terms, the policies they reference, and any order form are the entire agreement on this subject. If a provision is unenforceable, the rest remains in effect.
• Publicity. We will not use your name or logo without your permission.

Questions

Email legal@wholayer.com or write to WhoLayer, Inc., 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801. For privacy requests, use our privacy request page.

Other policies: Privacy Policy, Data Processing Addendum, Acceptable Use Policy, Cookie Policy, Subprocessors, Fair Use Policy.