Privacy policy

Who I am

LayerOps is a business run by me, Jarek Piotrowski, trading as LayerOps in Canberra, ACT, working with businesses Australia-wide. In this policy "I", "me" and "LayerOps" mean the same person. Contact: jarek@layerops.tech or 0404 003 240.

I handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988. A business of my size may not be legally bound by the APPs, but I follow them anyway.

The short version

• I collect only what you type into a form, what you send me, and basic website analytics.
• I don't sell or rent personal information, and I don't use it to train AI models.
• Some service providers process data for me. Most are in the United States (see Overseas).
• You can ask to see, correct or delete what I hold about you: email jarek@layerops.tech.

What I collect and why

Call-back and enquiry form

The form on most pages asks for your name, a phone number or email (or both), what you need, and an optional message. I also record the page you sent it from, the time, a reference number and the country Cloudflare reports for your connection. I use this to reply to you and to keep a record of the enquiry.

The enquiry is stored in a Cloudflare database and emailed to me at jarek@layerops.tech, which is a Google Workspace mailbox. To limit spam, your IP address is held for up to 2 hours as part of a rate-limit counter, then deleted automatically.

Free AI answer check

The free check also asks for your business name, website and three questions your customers ask. It is stored and emailed the same way as an enquiry. If you ticked the box for a 30-day re-check (offered until 25 October 2026), I send you one follow-up with the same questions checked again. The box was never ticked for you.

AI crawler checker

The free AI crawler checker asks only for a website address. It reads that site's public robots.txt and home page and shows you the result. It keeps the result for that website for 1 hour so repeat checks are fast, and keeps a scrambled (salted and hashed) form of your IP address for 2 hours to limit how often one person can use it. It doesn't ask for or store your name or email. To check the address, the site's name is looked up through Cloudflare's public DNS service.

AI Visibility Snapshot

To order a Snapshot you give a website address, business name, the kind of business, what you do, your city or region, your state or territory, and an email address for the report. I use these to build the questions, run the checks, write the report and send it to you.

• Payment. Online orders are paid by card through Stripe. Your card details go to Stripe and are never seen or stored by me. Stripe tells me the payment succeeded, the amount, and the email and order details above.
• The order record (the details above, payment status and reference numbers, and the order's progress) is kept for 180 days, then deleted automatically.
• Orders placed with the form on this site are stored and kept the same way as an enquiry (see How long I keep it); the report itself is kept for 180 days.
• The report is kept for 180 days at a private link, then deleted automatically. Anyone who has the link can open it, so share it only with people you want to see it. The link is long and random, and the report page asks search engines not to index it.
• While the report is being made, Cloudflare's Workflows service holds the order details and the results of each step so a failed step can be retried. Cloudflare deletes this working state after a limited period under its own retention rules.
• The dashboard. For the dashboard: your order details, your priority questions, each week’s answers counts and the businesses they name, the actions you tick, and the alerts are kept while the plan is active and for 180 days after your last refresh or after you cancel, then deleted automatically. The link is private and long; anyone who has it can see the dashboard, so share it only with people you want to.
• Payment records are kept for as long as Australian tax law requires (generally 5 years).

The checks themselves look only at public information and at the answers AI search tools give to the questions. What we read: your homepage and one service page, the list of your pages (your sitemap, or up to 30 pages found through your own links), your robots.txt, public DNS records for your email settings, your site’s response headers, public certificate logs, your public Google Business Profile listing, and, for WordPress sites when you order with an email at your website’s domain, one request to the public user-count endpoint (a count only, no user names). For the comparison: the public Google Business Profile listings, homepages and page lists (up to 30 pages each) of the five businesses AI names most, and the directory pages the answers cite. No logins, no scanning, and it doesn’t try to exploit or break anything. Your website's address is also looked up in public certificate logs (crt.sh), which receive the address only.

Email

If you email me, or I reply to you, the messages are kept in my Google Workspace mailbox. Snapshot reports and order notices are sent through Resend, an email delivery service, which receives your email address and the message text.

Booking a call

"Book a 15-minute call" opens Google Calendar's booking page. Google collects the name, email and any notes you enter there, under Google's privacy policy, and shares them with me so we can meet.

Analytics

layerops.tech uses Google Analytics 4 to count visits and see which pages lead to enquiries. It records things like the pages you view, how you arrived, your device and browser, your approximate location, and when you tap the phone number, the email address or the booking link, or send the form. It doesn't receive what you type into the forms. Google Analytics uses cookies (see Cookies).

Hosting and security logs

The site and its forms run on Cloudflare. Like any web host, Cloudflare processes your IP address, browser details and the pages requested to deliver the site and protect it from attacks. Short-lived error logs may include request details; I don't log form contents in them.

Who else receives information

I use these service providers. Each receives only what it needs for its job, and none of them receives your payment card details except Stripe.

Service providers and what each receives

Provider	What it does	What it receives
Cloudflare	Hosting, forms, databases, DNS, security (including Turnstile, which checks that a form is sent by a person, not a bot), the Snapshot's processing	Everything sent through the site and its forms, IP addresses, browser details (Turnstile reads browser signals to tell people from bots; it sets no advertising cookies)
Google	Analytics; my Workspace email; the booking page	Analytics data; emails and enquiries sent to me; booking details you enter
Stripe	Snapshot payments online	Card and billing details, your email, the order details
Resend	Sends Snapshot reports and notices	Your email address and the email's contents (including the report link)
DataForSEO	Runs the Snapshot's questions in Google AI Overviews, Google AI Mode and Perplexity, and looks up your Google Business Profile	The question text (20 questions name your service and city; 4 more name your business, to see what AI says about you), and the business names and city for the profile lookups (yours and the five businesses AI names most)
OpenAI	Runs the questions in ChatGPT search	The question text only (4 of the questions name your business)
xAI	Runs the questions in Grok search	The question text only (4 of the questions name your business)
Anthropic	Lists the businesses the AI answers name, and writes the Snapshot summary and fixes (Claude)	The text of the AI answers with your service and city (for the names), and the collected evidence: business name, kind of business, service, city, website address and page list, the questions, and the results of the public checks. Not your email or payment details.

I may also disclose information if the law requires it, or to my professional advisers (for example an accountant) where needed to run the business.

Overseas

Most of these providers are based in the United States, and they may process data in the US and other countries where they operate. Cloudflare runs a global network, so a request may be handled outside Australia. I choose established providers that publish their own privacy and security commitments, but their handling of data overseas is governed by their terms and the laws of those countries, not only by Australian law.

Cookies and opting out of analytics

The site itself sets no cookies and stores nothing in your browser. Google Analytics sets cookies (named starting with _ga) to tell repeat visits apart. Cloudflare may set a strictly necessary security cookie to tell people from bots.

• Block or delete cookies in your browser settings. The site works without them.
• Install Google's Google Analytics opt-out browser add-on.
• Use a browser or extension that blocks trackers.

How long I keep it

• Enquiries and free-check requests: up to 2 years after our last contact (5 years for tax records), unless you become a client, then for as long as I need them for the work and my records.
• Snapshot orders and reports: 180 days. A Snapshot ordered with the form on this site is an enquiry record too, kept as above.
• AI crawler checker results: 1 hour. Scrambled IP addresses for rate limits: 2 hours.
• Payment and tax records: as long as tax law requires (generally 5 years).
• Google Analytics data: no longer than Google's retention setting for the account (at most 14 months for event-level data).

When I no longer need information, I delete it or remove what identifies you.

Security

Accounts that hold your information use strong, unique passwords and two-step sign-in where offered. Data travels over HTTPS. Report links are long random addresses. No system is perfectly secure: if a breach is likely to cause you serious harm, I will tell you and, where it applies, the Office of the Australian Information Commissioner (OAIC).

Seeing, correcting or deleting your information

Email jarek@layerops.tech to ask what I hold about you, to correct it, or to delete it. I'll reply within 30 days and won't charge you. I may need to confirm who you are first. If I can't do what you ask (for example because tax law requires me to keep a payment record), I'll tell you why.

You can contact me anonymously or under a different name, but I need a way to reply, and I can't sell you a Snapshot without an email address for the report.

Marketing: I only send follow-up email you have asked for, such as the 30-day re-check. Each one tells you how to stop them, and you can reply "stop" at any time.

Complaints

If you think I've mishandled your information, email jarek@layerops.tech with the details. I'll reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (1300 363 992).

Changes to this policy

If the way I handle information changes, I'll update this page and the date below. See also the terms for the Snapshot and one-off work.

Last updated 25 October 2026.