Partner & Program Privacy Notice

Last updated: 17 July 2026

This notice applies to the public pages and qualification flow on partners.attestlayer.com and program.attestlayer.com. It does not govern a Buyer Review Pack purchase or production submission; those activities use the notice published on buy.attestlayer.comor the terms of an executed agreement.

1. Who is responsible

Services AttestLayer, operating as AttestLayer, is responsible for this public qualification flow. Rabie-Abdollah Macbahi is the accountable Privacy Officer. Privacy questions and requests may be sent to privacy@attestlayer.com.

2. Information the qualification form collects

• Required: preferred partner model, company name, and primary work email.
• Optional: legal entity name, company website, expected volume, start timing, billing country and email, procurement and technical contacts, payment preference, purchase-order requirement, expected signer details, target agreement date, and notes.
• Submission metadata: a random request identifier, submission time, selected partner model, confirmation-email status, origin checks, and abuse-prevention events.
• Abuse prevention: the browser computes a short-lived first-party proof from a signed challenge bound to a one-way email digest, a one-way request-network digest, and the site host. No qualification challenge data is sent to a third-party CAPTCHA provider.

The form does not accept source records, Buyer Review Pack files, credentials, payment-card details, or a signature. Please do not place secrets, sensitive personal information, or customer evidence in the notes field.

3. How the information is used

• Assess the requested partner model and respond with fit or an appropriate next step.
• Send the applicant a receipt for the qualification request.
• Prepare a later commercial discussion when both sides choose to continue.
• Protect the form, prevent abuse, troubleshoot delivery, and meet applicable legal obligations.

Submitting the form does not create an order, accept an agreement, or authorize AttestLayer to send unrelated marketing campaigns. The public partner and program surfaces do not load third-party product analytics or tracking pixels.

4. Providers and disclosure

Qualification information is disclosed only as needed to providers that operate the form, business email, and transactional email: Google Cloud Platform, Google Workspace, and SendGrid (Twilio). The current, flow-specific list is on the Subprocessors page. AttestLayer does not sell personal information collected through this flow.

5. Retention

• Qualification messages and related correspondence are retained only as reasonably necessary to assess the request, manage the resulting business relationship, resolve disputes, and meet legal obligations.
• Security and delivery records are retained only as reasonably necessary for abuse prevention, troubleshooting, and incident response.
• In-memory rate-limit keys are one-way hashes used for short abuse-control windows; the application does not log the applicant's email address, company, name, or free-text notes in the qualification event log.

6. Processing outside Québec

The application workload is configured in Google Cloud's Montréal region, but email, provider support, security, and network services may process information outside Québec or Canada. Before communicating personal information outside Québec, AttestLayer must assess the relevant privacy factors, determine that the information will receive adequate protection, and use a written agreement where required by applicable law. This public summary is not evidence that a particular assessment or agreement has been completed for every possible future scope.

7. Access, correction, deletion, and complaints

You may ask to access or correct your personal information, withdraw consent where applicable, or request deletion subject to lawful retention requirements. Email privacy@attestlayer.com and identify the company, email address, and request ID if available. Minimal identity verification may be required before information is disclosed or changed.

8. Changes

Material changes will be published on this page with a new effective date. A specific signed agreement may provide additional privacy terms for a later partner service and controls where it expressly conflicts with this public notice.