| Data subjects | Visitors to Customer websites; individuals in records Customer submits; Customer's users. |
|---|---|
| Categories of data | IP address, cookie and device identifiers, browser and device type, pages viewed, referrer, timestamps; names, email addresses, phone numbers, job titles and companies in submitted records; user account details. |
| Sensitive data | None. Customer must not send sensitive data or install the tag on sensitive pages. |
| Purpose | Identifying website visitors, enriching and verifying records, delivering results to Customer's tools, and operating and securing the Service. |
| Duration | The term of the Terms, plus the deletion period in section 12. Tag events are kept up to 13 months. |
| Frequency | Continuous. |
To opt out of WhoLayer on every website, visit https://wholayer.com/privacy-request.
``` ## 4\. If you use a cookie banner Outside the US the tag does nothing until your banner records consent. If you set your site to **Require consent everywhere** under Sites in your dashboard, the same applies to US visitors. Call the tag from your banner's accept and decline handlers: ``` ``` See [consent banners and non-US visitors](https://wholayer.com/help/consent-banners) for how the tag treats each visitor. ## 5\. Before you go live - Your privacy policy describes the tag (section 1 or 2 above) before the tag goes on your site. - Your footer has a “Your privacy choices” or “Do Not Sell or Share My Personal Information” link. - Sensitive pages are excluded, such as health, financial hardship, or anything for children. See [excluded paths](https://wholayer.com/help/excluded-paths). - Your cookie banner calls `wholayer("consent", …)` if you use one. - You only install the tag on websites you own or control. Last reviewed: draft, pending attorney review. --- ## Questions Email [legal@wholayer.com](mailto:legal@wholayer.com) or write to WhoLayer, Inc., 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801. For privacy requests, use our [privacy request page](https://wholayer.com/privacy-request). Other policies: [Terms of Service](https://wholayer.com/legal/terms), [Privacy Policy](https://wholayer.com/legal/privacy), [Data Processing Addendum](https://wholayer.com/legal/dpa), [Acceptable Use Policy](https://wholayer.com/legal/acceptable-use), [Cookie Policy](https://wholayer.com/legal/cookies), [Subprocessors](https://wholayer.com/legal/subprocessors), [Fair Use Policy](https://wholayer.com/legal/fair-use). --- # What WhoLayer does, in one minute > WhoLayer tells you who is visiting your website and gives you a verified way to reach them. Category: Getting started Most people who visit a website leave without filling in a form. WhoLayer recognizes some of those visitors and tells you who they are. ## Four products, one account - **Visitor ID** (B2B): the name, title, LinkedIn, and work email of US visitors, plus the company for everyone else. Sent to Slack, Teams, a webhook, or your CRM (HubSpot, Pipedrive, Attio, or Salesforce). - **Shopper ID** (ecommerce): a verified personal email for US shoppers who browse without signing in, sent to Klaviyo. - **Data API and MCP**: look up emails, mobiles, and company data from your own code, Clay, or an AI agent. - **Identity Cloud**: enterprise identity data by contract, for retailers, publishers, ad tech, and platforms. ## How you pay Everything draws from one credit wallet. One credit buys one identified person or one found email. Company-level visitor ID is free. If we don't find someone, you don't pay. See [how credits work](https://wholayer.com/help/how-credits-work). ## What we don't do - We don't identify individual people outside the US. - We don't scrape LinkedIn. - We don't return anyone who has opted out. Ready? Follow the [quickstart](https://wholayer.com/help/quickstart). ## Related - [Quickstart: your first identified visitor in 10 minutes](https://wholayer.com/help/quickstart.md) - [Which WhoLayer product do I need?](https://wholayer.com/help/choose-a-product.md) - [How credits work](https://wholayer.com/help/how-credits-work.md) --- # Quickstart: your first identified visitor in 10 minutes > Create an account, add your site, paste one tag, and connect a destination. Category: Getting started ## 1. Create an account Go to [Start free](https://wholayer.com/register). You get 100 credits every month and unlimited company-level ID. No card needed. ## 2. Add your site Onboarding asks for your domain and whether you're B2B or ecommerce. You'll get a site key that starts with `site_`. ## 3. Paste the tag Put this in the `` of every page, replacing the key with yours: ```html ``` Using a site builder? See the guides for [Google Tag Manager](https://wholayer.com/help/install-gtm), [Shopify](https://wholayer.com/help/install-shopify), [WordPress](https://wholayer.com/help/install-wordpress), [Webflow](https://wholayer.com/help/install-webflow), [Framer](https://wholayer.com/help/install-framer), or [Next.js](https://wholayer.com/help/install-nextjs). Then click **Check my install** (in onboarding, or under each site on **Sites**). We load your homepage and tell you if the tag is missing, has the wrong site ID, is on the page twice, or is blocked by your Content Security Policy, and we point out cookie banners that hold it until consent. Below that, **Waiting for your first visit…** switches on as soon as your first visit is stored. ## 4. Try it in sandbox mode New sites start in **sandbox mode**, which shows clearly fictional test people (on example.com addresses) so you can see the whole flow without spending credits. Visit your own site and open **People** in the dashboard. Read [sandbox vs live](https://wholayer.com/help/sandbox-vs-live). ## 5. Connect a destination Under **Destinations**, add [Slack](https://wholayer.com/help/destination-slack), [Microsoft Teams](https://wholayer.com/help/destination-teams), a [webhook](https://wholayer.com/help/destination-webhook), [Klaviyo](https://wholayer.com/help/destination-klaviyo), or a CRM: [HubSpot](https://wholayer.com/help/destination-hubspot), [Pipedrive](https://wholayer.com/help/destination-pipedrive), [Attio](https://wholayer.com/help/destination-attio), or [Salesforce](https://wholayer.com/help/destination-salesforce). Use **Send test** to check it. ## 6. Go live On **Sites**, turn sandbox off. From then on, real matches appear and spend credits. ## Related - [Sandbox mode vs live mode](https://wholayer.com/help/sandbox-vs-live.md) - [Install the tag on any website (HTML)](https://wholayer.com/help/install-html.md) - [Send identified visitors to Slack](https://wholayer.com/help/destination-slack.md) --- # Sandbox mode vs live mode > Sandbox shows fictional test data and spends nothing; live returns real people and spends credits. Category: Getting started ## Sandbox - Every new site starts in sandbox mode. - Matches are fictional people and companies on `example.com` and `example.org` addresses, labeled with the source "sandbox". - No credits are spent. - Use it to check your tag, filters, and destinations end to end. ## Live - Turn sandbox off for a site under **Sites**. - Matches are real and spend credits (one per person per calendar month). - Live sites only accept events sent from your own domain or its subdomains, so nobody else can spend your credits by copying your tag. ## For the API API keys work the same way: `wl_test_` keys return sandbox data and never spend credits; `wl_live_` keys return real data. See [test API keys](https://wholayer.com/help/test-api-keys). ## Related - [Quickstart: your first identified visitor in 10 minutes](https://wholayer.com/help/quickstart.md) - [Test keys and live keys](https://wholayer.com/help/test-api-keys.md) - [I don't see any visitors](https://wholayer.com/help/no-visitors.md) --- # Which WhoLayer product do I need? > A quick guide to picking Visitor ID, Shopper ID, the Data API, or Identity Cloud. Category: Getting started - **You sell to businesses** and want to know which companies and decision makers visit your site: **Visitor ID**. - **You run an online store** and want to email shoppers who browse without giving you an address: **Shopper ID**. - **You already have a list** of names or companies and need emails, mobiles, or company data: **Data API and MCP**. - **You need identity data at volume**, delivered by file or warehouse share, under a contract: **Identity Cloud**. You don't have to choose just one. Every product uses the same credits, so you can start with one and add another later. Not sure? Take the [two-minute quiz](https://wholayer.com/quiz) or use the [cost calculator](https://wholayer.com/calculator). ## Related - [What WhoLayer does, in one minute](https://wholayer.com/help/what-is-wholayer.md) - [How credits work](https://wholayer.com/help/how-credits-work.md) --- # Install the tag on any website (HTML) > Paste one script into the head of every page. Category: Install the tag 1. In the dashboard, open **Sites** and copy your site key. 2. Paste this just before `` on every page: ```html ``` 3. Publish, then visit your site in a new browser window. 4. Check **People** in the dashboard. In sandbox mode, test matches appear within a minute or two. ## Good to know - The tag is about 2 KB and loads asynchronously, so it doesn't slow your page down. - It uses first-party cookies only: `_wl_vid` (13 months) and `_wl_sess` (30 minutes). - It never reads form fields or records the screen. - It sends nothing for visitors whose browser sends Global Privacy Control. ## Related - [Consent banners and non-US visitors](https://wholayer.com/help/consent-banners.md) - [I don't see any visitors](https://wholayer.com/help/no-visitors.md) - [Exclude pages (careers, account, checkout)](https://wholayer.com/help/excluded-paths.md) --- # Install with Google Tag Manager > Add the tag as a Custom HTML tag that fires on all pages. Category: Install the tag 1. In Tag Manager, go to **Tags**, then **New**. 2. Choose **Custom HTML** and paste: ```html ``` 3. Set the trigger to **All Pages**. 4. If you use a consent banner, add your marketing or analytics consent condition to the trigger, or follow [consent banners](https://wholayer.com/help/consent-banners). 5. Click **Submit**, then **Publish**. Use **Preview** in Tag Manager to confirm the tag fires, then check **People** in the WhoLayer dashboard. ## Related - [Install the tag on any website (HTML)](https://wholayer.com/help/install-html.md) - [Consent banners and non-US visitors](https://wholayer.com/help/consent-banners.md) --- # Install on Shopify > Add the tag to your theme so it loads on every storefront page. Category: Install the tag There isn't a WhoLayer app in the Shopify App Store yet, so you add the tag to your theme. It takes about two minutes. 1. In Shopify admin, go to **Online Store**, then **Themes**. 2. On your live theme, click the **...** menu and choose **Edit code**. 3. Open `layout/theme.liquid`. 4. Paste this just before ``: ```html ``` 5. Click **Save**. ## Tips - When you add the site in WhoLayer, choose **ecommerce** so matches are treated as shoppers for [Shopper ID](https://wholayer.com/help/shopper-id-how-it-works). - If you use Shopify's cookie banner or another consent app, see [consent banners](https://wholayer.com/help/consent-banners). - Switching themes? Paste the tag into the new theme too. ## Related - [How Shopper ID works](https://wholayer.com/help/shopper-id-how-it-works.md) - [Send shoppers to Klaviyo](https://wholayer.com/help/destination-klaviyo.md) - [Consent banners and non-US visitors](https://wholayer.com/help/consent-banners.md) --- # Install on WordPress > Use a header-scripts plugin or your theme's header. Category: Install the tag ## Easiest: a header-scripts plugin 1. In WordPress, go to **Plugins**, then **Add New**. 2. Install a plugin that adds code to the site header, such as WPCode. 3. Paste the tag into the **Header** box and save: ```html ``` ## If you already use Google Tag Manager Add the tag through GTM instead. See [Google Tag Manager](https://wholayer.com/help/install-gtm). ## Caching plugins If you use a caching plugin, clear the cache after adding the tag so every page includes it. ## Related - [Install the tag on any website (HTML)](https://wholayer.com/help/install-html.md) - [Install with Google Tag Manager](https://wholayer.com/help/install-gtm.md) --- # Install on Webflow > Add the tag in Site settings under Custom code. Category: Install the tag 1. In Webflow, open **Site settings**, then **Custom code**. 2. Paste the tag into **Head code**: ```html ``` 3. Click **Save changes**, then **Publish** your site. Custom code only runs on the published site, not in the Webflow Designer preview. ## Related - [Install the tag on any website (HTML)](https://wholayer.com/help/install-html.md) --- # Install on Framer > Add the tag in Site settings under Custom Code. Category: Install the tag 1. In Framer, open **Site Settings**, then **General**, then **Custom Code**. 2. Paste the tag in **End of tag**: ```html ``` 3. Publish your site. Framer sites change pages without a full reload. The tag notices those page changes automatically, so every page view is counted. ## Related - [Install the tag on any website (HTML)](https://wholayer.com/help/install-html.md) - [Single-page apps (React, Vue, Svelte)](https://wholayer.com/help/install-spa.md) --- # Install on Next.js > Use next/script in your root layout. Category: Install the tag Add the tag to your root layout with `next/script`: ```tsx // app/layout.tsx import Script from "next/script"; export default function RootLayout({ children }: { children: React.ReactNode }) { return ( {children} ); } ``` Client-side navigation is tracked automatically: the tag listens for history changes, so you don't need to call anything on route change. ## Related - [Single-page apps (React, Vue, Svelte)](https://wholayer.com/help/install-spa.md) - [Tell WhoLayer about logged-in users](https://wholayer.com/help/identify-known-users.md) --- # Single-page apps (React, Vue, Svelte) > Page changes are tracked automatically; nothing extra to wire up. Category: Install the tag Load the tag once in your HTML shell. It watches `pushState`, `replaceState`, and the back button, and records a page view whenever the URL changes. ```html ``` ## The command queue If you need to call the tag before it has loaded (for example, from a consent banner that renders first), queue the call: ```js window.wholayer = window.wholayer || function () { (window.wholayer.q = window.wholayer.q || []).push(arguments); }; window.wholayer("consent", true); ``` Queued calls run as soon as the tag loads. ## Related - [Install on Next.js](https://wholayer.com/help/install-nextjs.md) - [Tell WhoLayer about logged-in users](https://wholayer.com/help/identify-known-users.md) --- # Consent banners and non-US visitors > Tell the tag when a visitor gives consent; outside the US nothing runs without it. Category: Install the tag ## How the tag treats each visitor - **US visitors:** person-level and company-level matching run by default. - **Visitors outside the US:** nothing is stored or matched unless your banner records consent. With consent, we identify the **company only**, never the person. - **Global Privacy Control:** if the browser sends it, the tag sends nothing at all. ## Telling the tag about consent When a visitor accepts marketing or analytics cookies, call: ```js wholayer("consent", true); ``` If they decline or withdraw, call `wholayer("consent", false)`. ## Require consent everywhere If you'd rather ask everyone, including US visitors, set the site's consent mode to **Require consent everywhere** under **Sites**. Person-level matching then only runs for US visitors who consented. ## Letting visitors opt out of WhoLayer on your site Call `wholayer("optout")`. It sets a `_wl_opt` cookie for five years and the tag stops sending anything from that browser. ## Related - [Your responsibilities when you use WhoLayer](https://wholayer.com/help/customer-obligations.md) - [How opt-outs and suppression work](https://wholayer.com/help/how-suppression-works.md) --- # Tell WhoLayer about logged-in users > Send a hashed email for visitors you already know to improve matching. Category: Install the tag If a visitor signs in or gives you their email, you can tell the tag: ```js wholayer("identify", "jane@example.com"); ``` The tag turns the email into a SHA-256 hash in the browser before sending it, so the plain address never leaves the page. The hash helps us match that visitor more reliably. Only call this for people who gave you their email directly, and make sure your privacy policy covers it. ## Related - [Single-page apps (React, Vue, Svelte)](https://wholayer.com/help/install-spa.md) --- # Exclude pages (careers, account, checkout) > Stop the tag from recording visits to certain paths. Category: Visitor ID Page exclusions are included on every plan, including Free. Under **Sites**, add **Pages to ignore**. Any page whose path starts with one of them is ignored: no event is stored, nothing is matched, and no credits are spent. On every plan, pages about health and other sensitive topics are never matched to a person. On the Free plan, keep the tag off any other pages you don't want recorded. Common exclusions: - `/careers` and `/jobs`, so job seekers don't show up as leads - `/account` and `/login`, for existing customers - Pages about sensitive topics, such as health conditions. Our [Acceptable Use Policy](https://wholayer.com/legal/acceptable-use) requires this. ## Related - [Send only your best visitors (filters)](https://wholayer.com/help/filters-and-hot-leads.md) - [Your responsibilities when you use WhoLayer](https://wholayer.com/help/customer-obligations.md) --- # How Visitor ID identifies people and companies > Person-level matches for US visitors, company-level for everyone else, charged once per person per month. Category: Visitor ID ## What happens on each page view 1. The tag sends the page URL, referrer, a first-party cookie ID, and the browser's IP address and user agent. 2. If the visitor is in the US, we try a **person-level** match against our consent-aware identity network. 3. If there's no person match, or the visitor is outside the US and consented, we try a **company-level** match from the visitor's network. 4. We check every person against our suppression list. Anyone who has opted out is never returned. 5. The match appears under **People** and is sent to your destinations. ## What you get - **Person:** name, title, company, LinkedIn URL, location, and a verified work email when we have one. - **Company:** name, domain, industry, and size. ## What it costs - Company-level matches are **free and unlimited**. - A person costs **1 credit the first time they're identified in a calendar month**. Return visits that month are free and still show up in their visit history. ## How many visitors will you identify? It depends on how much of your traffic is from the US, from work networks, and from desktop browsers. Independent tests of person-level tools in this industry have measured roughly 2% to 20% of traffic, well below most vendors' headline claims. The honest way to know is to try it on your own traffic: the free plan is enough. See [low match rate](https://wholayer.com/help/low-match-rate). ## Related - [Send only your best visitors (filters)](https://wholayer.com/help/filters-and-hot-leads.md) - [Why is my match rate low?](https://wholayer.com/help/low-match-rate.md) - [How credits work](https://wholayer.com/help/how-credits-work.md) --- # Send only your best visitors (filters) > Each destination can filter by match type, pages viewed, job title keywords, and company size. Category: Visitor ID Every destination has its own filters. A person is sent only if they pass all the filters you set. - **Match types:** person, shopper, or company. - **Pages viewed contain:** for example `/pricing` or `/demo`. Matches if any page they viewed contains the text. - **Title keywords:** for example `vp`, `head`, `director`, `founder`. Matches if their title contains any keyword. - **Minimum employees:** only companies at or above this size. - **High-intent only** (Slack, Teams, and webhooks): only alert when someone already identified opens one of your [key pages](https://wholayer.com/help/high-intent-pages), like pricing. - **Minimum ICP score:** only people and companies that score at or above this against your [ideal customer](https://wholayer.com/help/icp-scoring). The match type and minimum ICP score filters work on every plan. Page, title, and company size filters are included on **Starter** and above. ## A common setup - Slack: persons, title keywords `vp, head, chief, founder`, pages containing `/pricing`. - HubSpot, Pipedrive, Attio, or Salesforce: all persons. - Webhook: everything, for your own warehouse. Filters decide where people are **sent**. Everyone matched still appears under **People**, and credits are spent when a person is identified, whether or not any destination receives them. ## Related - [Send identified visitors to Slack](https://wholayer.com/help/destination-slack.md) - [Exclude pages (careers, account, checkout)](https://wholayer.com/help/excluded-paths.md) - [How Visitor ID identifies people and companies](https://wholayer.com/help/visitor-id-how-it-works.md) --- # High-intent alerts: key pages like pricing > Get a tagged alert when someone you've identified opens pricing, comparison, demo, or other key pages. Category: Visitor ID Some pages say more than others. When someone you've already identified opens one of your **key pages**, we send a high-intent alert. ## Key pages Set them per site on the **Sites** page, one path per line. A page counts if its path starts with one of them. The defaults are: `/pricing`, `/compare`, `/vs`, `/alternatives`, `/demo`, `/contact`, `/security`, `/trust`. Leave the box empty to turn alerts off for that site. ## What you get - **Slack:** alerts are tagged, like "Viewed pricing" or "Compared alternatives". If the first visit itself is on a key page, the identification alert carries the tag, so you don't get two messages. - **Webhooks:** a separate `visitor.high_intent` event with the identity id, match level, page, and visit count. See the [payload](https://wholayer.com/docs/api#webhooks). - **Digest email** and **Overview:** high-intent visits are counted. To route only these to a channel, turn on **High-intent only** for that Slack or webhook destination. ## Limits - At most one high-intent alert per visitor per site every 24 hours. - Only for visitors we've already identified and are allowed to identify. Never for people who opted out, never on sensitive pages, and it costs no credits. ## Related - [Send only your best visitors (filters)](https://wholayer.com/help/filters-and-hot-leads.md) - [Send identified visitors to Slack](https://wholayer.com/help/destination-slack.md) - [Webhooks: receive matches in your own system](https://wholayer.com/help/destination-webhook.md) - [Daily or weekly digest email](https://wholayer.com/help/email-digest.md) --- # The Companies page > Every company seen on your sites, with the people identified there, visits, and key-page views. Category: Visitor ID **Companies** in the dashboard groups everything we've matched by company: company-level matches (free) plus the company of each person identified. For each company you'll see its domain, size and industry when we have them, how many people were identified there, total visits, key-page views, and when they were last seen. Search by name or domain, or filter by site. Open a company to see the people identified there and the latest pages its visitors viewed. People who have opted out are never shown or counted. ## Related - [How Visitor ID identifies people and companies](https://wholayer.com/help/visitor-id-how-it-works.md) - [High-intent alerts: key pages like pricing](https://wholayer.com/help/high-intent-pages.md) - [Daily or weekly digest email](https://wholayer.com/help/email-digest.md) --- # ICP scoring: a fit score and a reason for every visitor > Describe your ideal customer in a sentence, and every identified person and company gets a 0-100 fit score with a plain-English reason. Category: Visitor ID Tell WhoLayer who you sell to, and it scores everyone it identifies from 0 to 100, with a one-line reason like "VP Sales at a 210-person SaaS company; viewed pricing twice". ## Set it up 1. Open **Ideal customer** in the dashboard. 2. Describe your best customers in one or two sentences, for example: "VP+ sales or marketing leaders at B2B SaaS companies with 50–1,000 employees in the US." 3. Save. A small AI model turns your sentence into scoring rules **once**. Check the rules it shows you in plain English, and edit any of them by hand. ## How a score is worked out Scoring uses those rules directly, with no AI per visitor, so it's instant and free. Each rule has a weight from 0 to 5: - **Job title** keywords, **seniority** (for example VP and above), and **department** (people only; they don't apply to company-level matches). - **Industry** and **company size** (employees). - **Country** the visit came from. - **Buying signals:** views of your key pages (like pricing), repeat visits, and how recently they came by. The score is the weighted share of rules a visitor matches. When we don't know something, like a company's size, it counts as a partial match rather than a miss. Titles with words you mark as "never a fit" (like intern) are capped at 15. Open any person to see **Why this score**, rule by rule. Visitors are scored when they're identified and again on every visit, so the score and reason are ready before an alert goes out. To score people identified before you set this up, or after you change the rules, use **Score everyone now**. Shoppers aren't scored. ## Use it - **People** and **Companies:** sort by ICP score and set a minimum score. A company's score is the best score among it and the people identified there. - **Destinations:** set a **Minimum ICP score** on any Slack, Teams, webhook, HubSpot, Pipedrive, Attio, or Salesforce destination. People and companies without a score aren't sent there. - **Slack and Teams alerts** show the score and reason, and so do the notes we add in HubSpot, Pipedrive, Attio, and Salesforce (no custom fields needed). **Webhooks** carry `icp_score` and `icp_reason` on `visitor.identified` and `visitor.high_intent`, and `GET /v1/visitors` returns them too. See the [payload](https://wholayer.com/docs/api#icp-score). ## Teach it with feedback On a person's page, mark them **Good fit** or **Not ICP**. Then use **Re-tune with feedback** on the Ideal customer page: we send your description, the current rules, and up to 50 of your most recent examples to the AI model once, and show you the new rules. Examples include job titles and company facts only, never names or contact details. You can re-tune 5 times a day, and rebuild from a new description 5 times a day. ## Good to know - It's on every plan and costs no credits. - Scores never use personal traits like age or gender, and the model is told to ignore them if a description mentions them. - A score helps you prioritize. It isn't a prediction that someone will buy. ## Related - [Send only your best visitors (filters)](https://wholayer.com/help/filters-and-hot-leads.md) - [High-intent alerts: key pages like pricing](https://wholayer.com/help/high-intent-pages.md) - [The Companies page](https://wholayer.com/help/companies-view.md) - [Webhooks: receive matches in your own system](https://wholayer.com/help/destination-webhook.md) --- # How Shopper ID works > Recognizes anonymous US shoppers and sends a verified personal email to Klaviyo. Category: Shopper ID ## Setup 1. Add your store under **Sites** and choose **ecommerce**. 2. Install the tag on your store. See [Shopify](https://wholayer.com/help/install-shopify) or [HTML](https://wholayer.com/help/install-html). 3. Add a [Klaviyo destination](https://wholayer.com/help/destination-klaviyo). ## What happens When a US shopper we recognize visits your store, we first check whether they're already in your Klaviyo. If they're new to you, we send Klaviyo an event called **WhoLayer Shopper Identified** with their email and the pages they viewed. If they're already in your Klaviyo, we charge half price and don't create anything; we send a **WhoLayer Returning Shopper** event with the products they viewed instead. In Klaviyo, use these events as flow triggers, for example a browse-abandonment flow. See [what we guarantee with Klaviyo](https://wholayer.com/help/shopper-id-klaviyo-guarantees). ## Plan and costs Shopper ID with Klaviyo sync is included on the **Growth** plan and above. Each new shopper costs 2 credits, once, and is refunded if they bounce or mark you as spam within 30 days. Shoppers already on your list cost half: 1 credit. Holdout shoppers, and return visits we recognize by our own cookie, are free. Without a Klaviyo destination, each shopper costs 2 credits the first time they're identified in a calendar month. ## Use it in flows, not blasts These shoppers didn't sign up for your list. Send them a relevant, honest message tied to what they browsed, include your business address and a working unsubscribe link (CAN-SPAM requires both), and honor opt-outs right away. See [your responsibilities](https://wholayer.com/help/customer-obligations). ## Related - [Shopper ID and Klaviyo: what you're charged for, refunds, the daily cap, and the holdout](https://wholayer.com/help/shopper-id-klaviyo-guarantees.md) - [Klaviyo schema: WhoLayer profile properties and events](https://wholayer.com/help/klaviyo-schema.md) - [Send shoppers to Klaviyo](https://wholayer.com/help/destination-klaviyo.md) - [Install on Shopify](https://wholayer.com/help/install-shopify.md) - [Emails are bouncing](https://wholayer.com/help/emails-bouncing.md) - [Your responsibilities when you use WhoLayer](https://wholayer.com/help/customer-obligations.md) --- # Shopper ID and Klaviyo: what you're charged for, refunds, the daily cap, and the holdout > Half price for shoppers already in your Klaviyo, refunds for bounces and complaints, a self-adjusting daily cap, and a built-in holdout. Category: Shopper ID These apply to live ecommerce sites once you've added a [Klaviyo destination](https://wholayer.com/help/destination-klaviyo). Your Klaviyo key needs Profiles (read and write), Events (read and write), and Metrics (read). ## Shoppers already on your list cost half Before we charge for a shopper, we look their email up in your Klaviyo: - **New to you:** we create the profile, send **WhoLayer Shopper Identified**, and charge 2 credits, once. - **Already a profile:** we don't create a duplicate, send **WhoLayer Returning Shopper**, and charge 1 credit, half price, because finding them still costs us a match. We remember the answer by a hash of the email for 30 days (24 hours when they weren't found), so we don't ask Klaviyo again on every visit. If we match the same person again on another device, that match is charged at the half price. We only match new shoppers while your Klaviyo key has worked in the last 24 hours. If Klaviyo has a short outage after we've matched someone, we don't charge or send yet: the shopper waits, hidden from your People list, we retry every hour, and once Klaviyo answers they're charged as above. We pause new matching while 20 or more shoppers are waiting. ## Returning Shopper events When a shopper who is already in your Klaviyo, or one we sent you before, comes back, we send a **WhoLayer Returning Shopper** event with the product pages they viewed, at most once per shopper per day. Use it to trigger your browse-abandonment flow for people who are already opted in. Return visits we recognize by our own first-party cookie, or by the hashed email your site passes with `wholayer("identify")`, are free, because they need no paid lookup. ## Refunds for bounces and spam complaints Every day we read your Klaviyo's Bounced Email and Marked Email as Spam events. If a shopper we sent you bounces (soft bounces, like a full inbox, don't count) or marks your email as spam within 30 days of delivery, we refund the credits automatically and never send that shopper again. Refunds show on the **Usage** page. They share the [refund limit](https://wholayer.com/help/how-credits-work) with reported results: up to 10% of the credits you spent in the last 30 days; above that, our team reviews them. ## Deliverability Guard: a daily cap that adjusts itself Each store has a daily limit on new contacts (200 by default; change it under **Sites**). Once a day we read your Klaviyo account's last 7 days of email: - **Spam complaint rate** = spam complaints ÷ emails received. - **Bounce rate** = bounces ÷ (emails received + bounces). If complaints are over 0.08% or bounces over 2%, we halve today's cap (it pauses below 5). When both are healthy, it rises 10% a day back to your setting. With fewer than 200 emails a week the rates are too noisy to act on, so the cap follows your setting. When the cap is full, we stop matching new shoppers for the day, so you're never charged for someone we can't send. The **Sites** page shows the current rates, the cap, and why. ## Built-in holdout By default 10% of new shoppers (not already in your Klaviyo) go into a holdout group, chosen by a fixed hash of their email. We never send or charge for them, and keep only a hash of their email. Each day we count Placed Order events in your Klaviyo for both groups, within 30 days of each shopper's first match, and the **Sites** page compares purchase rates and revenue per shopper. The report waits until each group has at least 50 shoppers with a full 30 days, shows a 95% range for the difference, and is an estimate, not a guarantee. Set the holdout to 0% (up to 20%) under **Sites**; shoppers already in the holdout stay out. ## How the holdout is paid for Holdout shoppers are free for you, but each one still costs us a paid match. We never sell below cost, so the holdout is paid for out of the shoppers you're charged for: each new-shopper charge covers 0.12 of a holdout shopper and each half-price charge 0.06, over the last 30 days. When that doesn't cover the next one, the shopper who would have gone to the holdout is sent and charged as usual instead. A new store starts this way, and the holdout begins once enough charges cover it. The **Sites** page tells you when the holdout is paused. ## Related - [How Shopper ID works](https://wholayer.com/help/shopper-id-how-it-works.md) - [Klaviyo schema: WhoLayer profile properties and events](https://wholayer.com/help/klaviyo-schema.md) - [Send shoppers to Klaviyo](https://wholayer.com/help/destination-klaviyo.md) - [Emails are bouncing](https://wholayer.com/help/emails-bouncing.md) --- # Klaviyo schema: WhoLayer profile properties and events > The wl_ profile properties and the two WhoLayer events we write to Klaviyo, and what we read. Category: Shopper ID ## Profile properties Set on profiles we create for new shoppers (never added to profiles that were already in your Klaviyo): - `wl_source`: "WhoLayer Shopper ID". - `wl_match_type`: "first_party_hashed_email" when the email matches the hashed email your site passed with `wholayer("identify")`; the resolver's match type (for example "deterministic" or "probabilistic") when it reports one; otherwise "identity_graph". - `wl_confidence`: 0 to 1. Only when the resolver returns one; otherwise left off. - `wl_first_seen`: when we first identified the shopper on your site (ISO 8601, UTC). - `wl_consent_ref`: the data supplier's consent reference for this record. Left off when there isn't one. Use them in segments, for example `wl_source` equals "WhoLayer Shopper ID". ## Events - **WhoLayer Shopper Identified**: a new shopper, once. Properties: `pages` (last 10 paths), `visits`, `site`, `source`, `test`. - **WhoLayer Returning Shopper**: a shopper already in your Klaviyo (or one we sent before) came back, or a paid match turned out to be already in your Klaviyo (charged half price). At most once a day per shopper; the event itself is free. Properties: `viewed_urls` (last 10), `viewed_products` (URLs containing /products/), `last_viewed_url`, `visits`, `site`, `source`. ## What we read Once a day: 7-day counts of Received Email, Bounced Email, and Marked Email as Spam, plus Bounced Email, Marked Email as Spam, and Placed Order events with the profile's email. We hash each email to match shoppers we sent or held out, and store only the hash, the date, and order amounts for matches. Full table: [Klaviyo schema](https://wholayer.com/docs/integrations#klaviyo-schema). ## Related - [Shopper ID and Klaviyo: what you're charged for, refunds, the daily cap, and the holdout](https://wholayer.com/help/shopper-id-klaviyo-guarantees.md) - [Send shoppers to Klaviyo](https://wholayer.com/help/destination-klaviyo.md) --- # Data API quickstart > Create a key and make your first enrichment call with curl. Category: Data API and MCP ## 1. Create a key In the dashboard, open **API keys** and create a key. Choose **test** to start: test keys return sandbox data and never spend credits. The full key is shown once, so copy it somewhere safe. ## 2. Call the API ```bash curl https://api.wholayer.com/v1/people/enrich \ -H "Authorization: Bearer wl_test_YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{"domain":"fieldline.example.com","first_name":"Dana","last_name":"Okafor"}' ``` ## 3. Check your balance ```bash curl https://api.wholayer.com/v1/balance -H "Authorization: Bearer wl_test_YOUR_KEY" ``` ## Endpoints - `POST /v1/people/enrich`: emails, and a mobile if you ask for one - `POST /v1/people/search`: find people by title, seniority, company, location (test keys today; live results coming soon) - `POST /v1/emails/verify`: check deliverability - `POST /v1/phones/lookup`: mobile with carrier and line type (Growth and above) - `GET /v1/companies/{domain}`: company profile - `GET /v1/visitors`: people and companies identified on your sites - `POST /v1/bulk`: up to 1,000 rows per call - `POST /v1/jobs`: up to 100,000 rows, processed in the background ([async jobs](https://wholayer.com/help/async-bulk-jobs)) - `GET /v1/balance`: credits remaining - `POST /v1/estimate`: free quote of the most a call could cost - `POST /v1/report`: report a bad result and get its credits back ([how refunds work](https://wholayer.com/help/report-bad-data)) Every response carries an `X-Credits-Used` header, 0 when the call was free. Full reference: [API docs](https://wholayer.com/docs/api). Try one in your browser on the [Data API page](https://wholayer.com/products/data-api). ## Related - [Test keys and live keys](https://wholayer.com/help/test-api-keys.md) - [API error codes and what to do](https://wholayer.com/help/api-errors.md) - [Connect Claude, ChatGPT, Cursor, or any MCP client](https://wholayer.com/help/mcp-setup.md) - [Keep an AI agent from overspending](https://wholayer.com/help/agent-spend-caps.md) --- # Test keys and live keys > wl_test_ keys return fictional data for free; wl_live_ keys return real data and spend credits. Category: Data API and MCP - **`wl_test_...`**: every endpoint and MCP tool works, returns fictional data on `example.com` addresses, and never spends credits. Responses include `"test_mode": true`. - **`wl_live_...`**: real data, and credits are spent only when a result is returned. Build and test your integration with a test key, then swap in a live key. Nothing else changes. ## Related - [Data API quickstart](https://wholayer.com/help/api-quickstart.md) - [Sandbox mode vs live mode](https://wholayer.com/help/sandbox-vs-live.md) - [Keep your API keys safe](https://wholayer.com/help/api-key-security.md) --- # Connect Claude, ChatGPT, Cursor, or any MCP client > Add the WhoLayer MCP server so your AI agent can enrich contacts. claude.ai and ChatGPT connect by signing in, no key needed. Category: Data API and MCP **Server URL:** `https://mcp.wholayer.com/mcp` (Streamable HTTP). Connect by signing in (OAuth), or send an API key in the `Authorization: Bearer` header. ## claude.ai, Claude Desktop, and Claude mobile 1. Go to **Customize, Connectors** and click **Add custom connector** (on Team and Enterprise plans, an Owner adds it under **Organization settings, Connectors**). 2. Paste `https://mcp.wholayer.com/mcp`. If asked, choose **Sign in now** and **Use Claude's published identity**. Leave the client ID and secret empty. 3. Click **Add**, then **Connect**. Log in to WhoLayer, choose the workspace, the access, and the daily credit cap, and click **Connect**. ## ChatGPT 1. Open **chatgpt.com/plugins**, select **+**, then **Add custom MCP server**. 2. Name it WhoLayer, paste the URL, and choose **OAuth** for authentication. 3. Sign in to WhoLayer when asked and approve. In a new chat, type `@` and pick WhoLayer. Availability of custom connectors depends on your Claude or ChatGPT plan. ## What you approve when an app signs in - **Workspace:** the app sees only that workspace's data and spends only its credits. Owners and admins can connect apps. - **Access:** look people up and spend credits (default), or read only (free tools only). - **Daily credit cap:** 100 credits by default. Change it, or leave it empty for no cap. Connected apps are listed under **API keys, Connected apps**, where you can disconnect one at any time. It stops working immediately. ## Claude Code with an API key ```bash claude mcp add --transport http wholayer https://mcp.wholayer.com/mcp --header "Authorization: Bearer wl_test_YOUR_KEY" ``` ## Cursor Add to `~/.cursor/mcp.json`: ```json { "mcpServers": { "wholayer": { "url": "https://mcp.wholayer.com/mcp", "headers": { "Authorization": "Bearer wl_test_YOUR_KEY" } } } } ``` ## Tools `enrich_person`, `search_people`, `verify_emails`, `lookup_phone`, `get_company`, `list_visitors`, `get_balance`, `estimate_cost` (free quote), `get_compliance_policy`, `report_bad_data` (refund for a bad result), and `add_to_suppression`. Every tool reports the credits it used and how many remain, and declares MCP annotations (read-only, destructive, idempotent, open-world) so your client can ask before paid calls. Start with a test key so your agent can practice for free, then set [spend caps](https://wholayer.com/help/agent-spend-caps) before giving it a live key. ## VS Code, Claude Desktop, and other clients The [MCP server docs](https://wholayer.com/docs/mcp) have copy-ready config for Claude Desktop, VS Code, and any other client, plus an Add to Cursor button. ## Docs-only server, no sign-in To let an assistant read WhoLayer's docs, pricing, and help center without an account, connect `https://mcp.wholayer.com/docs`. It has `search_docs`, `read_page`, `get_pricing`, `get_products`, and `list_help_articles`, and works as a custom connector in claude.ai and ChatGPT with no authentication. ## Related - [Keep an AI agent from overspending](https://wholayer.com/help/agent-spend-caps.md) - [Test keys and live keys](https://wholayer.com/help/test-api-keys.md) - [Data API quickstart](https://wholayer.com/help/api-quickstart.md) --- # Keep an AI agent from overspending > Daily caps per key, a per-call ceiling, read-only keys, and free retries. Category: Data API and MCP Agents loop. Set limits before you hand one a live key. - **Daily cap per key:** when creating a key, set a maximum number of credits per day. Once reached, calls fail with `credits_exhausted` until the next UTC day. - **Daily cap per connected app:** apps that sign in (claude.ai, ChatGPT) get the cap chosen on the consent screen, 100 credits a day by default, enforced the same way. You can also connect them read only. - **Per-call ceiling:** one call can't spend more than 250 credits unless you raise it with the `X-Max-Credits` header (REST) or `max_credits` argument (MCP), up to 10,000. - **Read-only keys:** can only list visitors, look up companies, check the balance, get cost quotes, and read the compliance policy and your suppression-list count. They can't reveal contact details or change your suppression list. - **Free quotes:** `POST /v1/estimate` (REST) or `estimate_cost` (MCP) returns the most a call could spend before the agent runs it. - **Free retries:** send an `Idempotency-Key` header (REST) and repeated identical requests within 30 days return the saved result at no charge. Identical MCP tool calls are also free within 30 days. - **Workspace overage limit:** set under **Usage** so the whole workspace can't go past a limit you choose. ## Related - [Connect Claude, ChatGPT, Cursor, or any MCP client](https://wholayer.com/help/mcp-setup.md) - [Running out of credits, overage, and limits](https://wholayer.com/help/overage-and-spend-caps.md) - [API error codes and what to do](https://wholayer.com/help/api-errors.md) --- # Enrich or verify big lists with async jobs > POST /v1/jobs takes up to 100,000 rows, runs them in the background, and caps the whole job's spend. Category: Data API and MCP `POST /v1/bulk` handles up to 1,000 rows while you wait. For bigger lists, start a job and come back for the results. ## Start a job ```bash curl https://api.wholayer.com/v1/jobs \ -H "Authorization: Bearer wl_test_YOUR_KEY" -H "Content-Type: application/json" \ -d '{"operation":"enrich","max_credits":5000,"rows":[{"external_id":"crm-1","name":"Dana Okafor","company_domain":"fieldline.com","reveal":["work_email"]}]}' ``` - `operation`: `enrich` (each row is a `/people/enrich` body) or `verify` (each row is `{"email": "..."}`). - Up to 100,000 rows. Add `external_id` to any row to match results back to your CRM. - Files over 4 MB: gzip the body and send `Content-Encoding: gzip`. - The MCP server has the same thing as `create_job` and `get_job`. ## What it costs Each row is billed exactly like a single call, and only on hits. Verify jobs charge each address once per job. Credit costs are on the [pricing page](https://wholayer.com/pricing). `max_credits` (default 250, up to 2,000,000) caps the whole job. If the job could cost more than that in the worst case, it's refused before anything runs, and it never spends past it while running. Quote it first for free with `POST /v1/estimate` (`operation` `bulk` or `verify`, plus `rows`). Test keys (`wl_test_...`) run sandbox jobs and never spend. ## Follow progress - `GET /v1/jobs/{id}`: status (queued, running, completed, failed), progress, and credits used. - Or pass `webhook_url` when you create it: we send a signed `job.completed` or `job.failed` event, with the same signature headers as our other webhooks. - Up to 2 jobs can be queued or running per workspace at once. A job stops early if your wallet, overage limit, or a key's daily cap runs out, or if the key that created it is revoked. Rows it didn't reach come back as `not_processed`; send them in a new job. ## Get the results `GET /v1/jobs/{id}/results` returns rows in order, 100 per page by default (`limit` up to 1,000, then `cursor`). Add `?format=csv` to download everything as a spreadsheet. People who opted out, are on a deletion list, or are on [your suppression list](https://wholayer.com/help/your-suppression-list) are never returned: the row says `person_not_available` with a reason and isn't charged. We check again every time you read results, so someone who opts out after the job ran is withheld too. Results are deleted 30 days after the job was created. ## Related - [Data API quickstart](https://wholayer.com/help/api-quickstart.md) - [Keep an AI agent from overspending](https://wholayer.com/help/agent-spend-caps.md) - [API error codes and what to do](https://wholayer.com/help/api-errors.md) - [Upload your own suppression list](https://wholayer.com/help/your-suppression-list.md) --- # API error codes and what to do > Every error the API returns, and how to fix it. Category: Data API and MCP Errors look like `{"error": {"code": "...", "message": "..."}}`. - **400 `invalid_request`**: a field is missing or malformed. The message names the field. - **401 `unauthorized`**: missing, wrong, or revoked key. Send `Authorization: Bearer wl_live_...`. - **402 `credits_exhausted`**: out of credits on the free plan, a key's daily cap or your overage limit was reached, or (agency client workspaces) the client's monthly budget is used up. - **403 `forbidden`**: a read-only key tried an endpoint that reveals contact details or adds to your suppression list. - **403 `plan_restricted`**: your plan doesn't include this feature, such as mobile numbers (Growth and above). The error's `required_plan` says which plan does. Upgrade under **Billing**. - **404 `person_not_available`**: no match for this person. You're not charged. - **409 `duplicate_request`**: you reused an `Idempotency-Key` with a different request body. - **413 `payload_too_large`**: more than 1,000 rows in one `/bulk` call (use an [async job](https://wholayer.com/help/async-bulk-jobs) instead), more than 100,000 rows in one job, or your suppression list would pass 1,000,000 entries. - **451 `person_not_available`**: the person is withheld. `error.reason` says why: `opted_out` (opted out or asked for deletion), `drop_deleted` (California DROP deletion list), or `customer_suppressed` (on your own suppression list). No data is returned and you're not charged. - **429 `rate_limited`**: too many requests per second, or two async jobs are already queued or running in your workspace. Wait for the `Retry-After` seconds. Limits per second: Free 2, Starter 10, Growth 25, Scale 100. - **503 `provider_unavailable`**: a data source is temporarily unavailable, or the lookup is switched off on live keys. Live people search is off until we've confirmed its supplier cost (1 credit per 10 results once it's on); test keys work now. Retry later; you weren't charged. ## Related - [Data API quickstart](https://wholayer.com/help/api-quickstart.md) - [Keep an AI agent from overspending](https://wholayer.com/help/agent-spend-caps.md) - [Upload your own suppression list](https://wholayer.com/help/your-suppression-list.md) --- # Read our compliance rules from the API > GET /v1/policy and the get_compliance_policy MCP tool return the rules WhoLayer enforces, as JSON. Free. Category: Data API and MCP `GET https://api.wholayer.com/v1/policy` (or the `get_compliance_policy` MCP tool) returns a versioned JSON document generated from the same code that enforces it. It's free and works with read-only keys. It covers: - Person-level identification in the US only; outside the US, company level only and only after consent; sites set to wait for consent everywhere. - Global Privacy Control: requests with `Sec-GPC: 1` are dropped. - The sensitive-page categories and keywords where we never identify people. - Where suppression is checked, the suppression sources, and the `451` reason codes. - Retention periods for page events, the delivery log, revealed API people, and the idempotency cache. - A reminder that phone numbers mustn't be used for calls or texts without the consent the TCPA requires. Give it to your agent so it knows what WhoLayer will and won't do before it calls other tools. ## Related - [API error codes and what to do](https://wholayer.com/help/api-errors.md) - [How opt-outs and suppression work](https://wholayer.com/help/how-suppression-works.md) - [Upload your own suppression list](https://wholayer.com/help/your-suppression-list.md) --- # Identity Cloud: data licensing for enterprises > Person-level resolution, identifiers, and attributes under contract, with a free match test first. Category: Identity Cloud Identity Cloud is for companies that need identity data at volume: retailers filling in their CDP, publishers enriching audiences, ad tech platforms, and products that want to embed identity. ## How it starts 1. [Tell sales](https://wholayer.com/contact?topic=sales) what you need to resolve and how you'll use it. We confirm it fits our [Acceptable Use Policy](https://wholayer.com/legal/acceptable-use). 2. We run a **free match test** on a sample of your records so you see real coverage before you sign. 3. Delivery is set up by contract: API, files, warehouse share, or managed audiences. ## Pricing Volume pricing from $0.02 a credit with an annual commitment of 250,000+ credits a month. ## What it can't be used for Credit, employment, insurance, or housing decisions, or anything else covered by the Fair Credit Reporting Act. WhoLayer is not a consumer reporting agency. ## Related - [Your responsibilities when you use WhoLayer](https://wholayer.com/help/customer-obligations.md) --- # Report a wrong match and get a refund > Report a wrong person, a bounced email, or outdated details within 30 days and we refund the credits for that result. Category: Credits and billing If we gave you a wrong person, an email that bounced, or details that are out of date, tell us and we'll give the credits back. ## How to report - **Dashboard:** open the person under **People** and use **Report a wrong match**. - **API:** `POST /v1/report` with `result_id` (the `per_` id from `/people/enrich` or `/phones/lookup`) or `identity_id` (a visitor's `person_id` from `/visitors`), plus a `reason`: `wrong_person`, `bounced`, or `outdated`. - **MCP:** the `report_bad_data` tool takes the same fields. ## What happens - We refund the credits charged for that result if it was charged in the last 30 days. Each result can be refunded once. - We flag it, so it's never delivered to your destinations or returned by the API again. - Refunds in any rolling 30 days are capped at 10% of the credits your workspace spent in that window. Above the cap, the report waits for our team to review it, and nothing is refunded automatically until then. Refunds show in your **Usage** ledger as "Refund for a reported result". See [Fair billing](https://wholayer.com/fair-billing) for every billing rule. ## Related - [How credits work](https://wholayer.com/help/how-credits-work.md) - [Running out of credits, overage, and limits](https://wholayer.com/help/overage-and-spend-caps.md) - [API error codes and what to do](https://wholayer.com/help/api-errors.md) --- # How credits work > One wallet for every product; you pay only when we return something. Category: Credits and billing Every product draws from the same monthly credit balance. ## What a credit buys - Company identified on your site: **free** - Person identified on your site: **1 credit**, once per person per calendar month - Shopper identified for ecommerce (new to your list): **2 credits**; with a Klaviyo destination once per new shopper and refunded if they bounce or complain within 30 days, without one once per shopper per calendar month - Shopper recognized who is already in your Klaviyo: **1 credit** (half price, never duplicated) - Work email found and verified: **1 credit** - Personal email found and verified: **2 credits** - Reverse email lookup (send an email, get the person): **10 credits**, only when we find them - Mobile number with carrier check: **5 credits** - Email verification only: **0.25 credits** per address - Company profile: **1 credit** - People search: **1 credit per 10 results** (test keys today; live results coming soon) You're never charged when nothing is found, or for anyone who has opted out. If a result is wrong, [report it for a refund](https://wholayer.com/help/report-bad-data). Every rule is on [Fair billing](https://wholayer.com/fair-billing). ## When credits arrive Plan credits are added on the 1st of each month. On paid plans, unused credits roll over for one month. Free plan credits don't roll over. See [Pricing](https://wholayer.com/pricing) or estimate your cost with the [calculator](https://wholayer.com/calculator). ## Related - [Plans, upgrading, and annual billing](https://wholayer.com/help/plans-and-upgrades.md) - [Running out of credits, overage, and limits](https://wholayer.com/help/overage-and-spend-caps.md) - [How Visitor ID identifies people and companies](https://wholayer.com/help/visitor-id-how-it-works.md) --- # Plans, upgrading, and annual billing > Free, Starter $49, Growth $199, Scale $799, or Platform by contract. Upgrade any time. Category: Credits and billing ## Plans (monthly) - **Free:** $0, 100 credits, 1 site - **Starter:** $49, 1,000 credits, 1 site - **Growth:** $199, 5,000 credits, 3 sites - **Scale:** $799, 20,000 credits, 10 sites - **Platform:** custom contract, volume pricing from $0.02 a credit with an annual commitment of 250,000+ credits a month Paying yearly saves about 16% compared with monthly. ## Upgrading Open **Billing** in the dashboard and choose a plan. You'll pay through a secure Stripe checkout page. The new plan's credits are added as soon as the payment goes through, so you can use them right away. ## Invoices and payment method Use **Manage billing** on the Billing page to update your card or download invoices. ## Related - [How credits work](https://wholayer.com/help/how-credits-work.md) - [Cancel or downgrade](https://wholayer.com/help/cancel-or-downgrade.md) - [Running out of credits, overage, and limits](https://wholayer.com/help/overage-and-spend-caps.md) --- # Running out of credits, overage, and limits > Free accounts pause; paid accounts keep working and pay overage, unless you set a limit. Category: Credits and billing ## Free plan When credits run out, person-level matching pauses until the 1st of next month. Company-level matching keeps working because it's free. ## Paid plans Matching keeps working. Extra credits are billed at your plan's overage rate and added to your next invoice: - Starter: $0.06 a credit - Growth: $0.05 a credit - Scale: $0.045 a credit ## Set a limit On **Usage**, set an **overage limit**. When it's reached, paid matching stops until next month, so you never pay more than you planned. For API keys you can also set a [daily cap per key](https://wholayer.com/help/agent-spend-caps). ## Related - [How credits work](https://wholayer.com/help/how-credits-work.md) - [Keep an AI agent from overspending](https://wholayer.com/help/agent-spend-caps.md) - [Plans, upgrading, and annual billing](https://wholayer.com/help/plans-and-upgrades.md) --- # Cancel or downgrade > Cancel any time from Billing; your plan runs until the end of the period. Category: Credits and billing 1. Open **Billing** and choose **Manage billing**. 2. Cancel or switch plans in the Stripe billing page. Monthly plans stay active until the end of the period you've paid for, then move to the free plan. Annual plans can be cancelled for a prorated refund in the first 30 days; after that they run to the end of the year. Your sites, people, and settings are kept on the free plan. Nothing is deleted or switched off when you move to a smaller plan. Extra sites, HubSpot or Klaviyo destinations, filters, page exclusions, and teammates keep working. You just can't add new ones, or change those settings, until you upgrade again. To remove everything instead, see [delete your workspace](https://wholayer.com/help/delete-workspace). ## Related - [Plans, upgrading, and annual billing](https://wholayer.com/help/plans-and-upgrades.md) - [Delete your workspace](https://wholayer.com/help/delete-workspace.md) --- # The affiliate program > Share your referral link and earn 25% of what your referrals pay, excluding tax, for 24 months. Category: Credits and billing ## Join Partner sign-up in the dashboard isn't open yet. [Apply on the Partners page](https://wholayer.com/partners) and we'll tell you when it opens. Once it does, you join from **Partners** in the dashboard and get your referral link right away. ## How referrals are counted - A click on your link sets a first-party cookie, `_wl_ref`, on wholayer.com for 90 days. It holds only your code. - If the visitor clicks another partner's link later, that link replaces yours (last click wins). - If they create a WhoLayer account within 90 days, their new workspace is credited to you. That's permanent: later clicks don't change it. - People who already have an account, or who join a teammate's workspace by invitation, aren't counted as referrals. - Clicks are counted as a daily total per link. We don't store IP addresses or anything else about the visitor. ## What you earn - **25%** of every payment a referred workspace makes, excluding tax, for **24 months** from its first payment. Upgrades count. - Commission is based on what we actually collect. If a payment is refunded or charged back, we deduct the matching commission. - Self-referrals don't earn commission: your own workspaces, sign-ups using your company email domain, and workspaces that share your billing account. ## Getting paid - Commission is **pending** for 30 days after each payment, then becomes **payable**. - We pay once a month, by hand, when your payable balance is at least **$50**. Below that it rolls over to the next month. - Choose **PayPal** (enter your PayPal email) or **bank transfer** (we'll contact you for your details) under **Payout method** on the Partners page. ## Your dashboard The **Partners** page shows your links with copy buttons, clicks, sign-ups, paying customers, pending, payable, and paid commission, and a statement of every commission, deduction, and payout. Agencies running WhoLayer for clients: see [Partners](https://wholayer.com/partners). ## Related - [Plans, upgrading, and annual billing](https://wholayer.com/help/plans-and-upgrades.md) - [How credits work](https://wholayer.com/help/how-credits-work.md) --- # Send identified visitors to Slack > Post each match to a Slack channel with a Slack incoming webhook. Category: Destinations 1. In Slack, create an **incoming webhook** for the channel you want (Slack's help center explains how: search "incoming webhooks"). Copy the URL, which starts with `https://hooks.slack.com/`. 2. In WhoLayer, open **Destinations**, choose **Slack**, and paste the URL. 3. Add [filters](https://wholayer.com/help/filters-and-hot-leads) so only the visitors you care about post to the channel. 4. Click **Send test**. A sample message should appear in Slack within seconds. ## Related - [Send only your best visitors (filters)](https://wholayer.com/help/filters-and-hot-leads.md) - [My destination isn't receiving anything](https://wholayer.com/help/webhook-not-firing.md) --- # Webhooks: receive matches in your own system > We POST signed JSON to your HTTPS endpoint for every match. Category: Destinations ## Setup 1. Open **Destinations**, choose **Webhook**, and enter your HTTPS URL. 2. Copy the **webhook signing secret** shown on the same page. 3. Click **Send test**. ## Events - `visitor.identified`: a person or company identified on a B2B site. Company matches have `data.level = "company"`. - `shopper.identified`: a shopper identified on an ecommerce site. - `visitor.high_intent`: someone already identified opened one of your [key pages](https://wholayer.com/help/high-intent-pages), like pricing. At most once a day per visitor. It has no contact details; match it to the earlier event by `data.identity_id`. Turn on **High-intent only** on a webhook to receive just `visitor.high_intent`. ## Verify the signature Each request has a `WhoLayer-Signature` header in the form `t=