Privacy Policy
Effective 22 July 2026 · Last updated 22 July 2026
This policy explains what personal information this website collects, why, where it goes, how long it is kept, and the rights you have over it.
Who we are
TruthLayer is operated by Karl Ambrosius in Australia. For anything in this policy, contact karlambrosius@outlook.com.au.
What we collect
The only personal information this website collects is what you type into one of our contact forms (pilot, partner, or investor enquiries):
| Field | Why we ask for it |
|---|---|
| Full name | To address you in our reply. |
| Business email | To respond to your enquiry. |
| Organisation | To understand the context of your enquiry. |
| Role / qualifiers | To route your enquiry appropriately (e.g. pilot, partner, investor). |
| Message (free text) | Whatever you choose to tell us about your enquiry. |
When you submit a form, your IP address is processed for two purposes only: rate limiting (submission counts are keyed per IP and expire automatically after one hour) and anti-bot verification via Cloudflare Turnstile, which may process browser signals as described in Cloudflare’s privacy policy. We do not use your IP address for anything else.
We use Cloudflare Web Analytics, which is cookie-free, does not track you across sites, and does not build personal profiles. This site uses no advertising trackers and no cookies for tracking of any kind.
Why we process it
We use form submissions solely to respond to your enquiry and to follow up on it. For visitors in the European Economic Area, our lawful bases under the GDPR are your consent (you choose to submit the form) and our legitimate interest in responding to enquiries you initiate and in protecting the site from abuse (rate limiting and anti-bot verification).
Where it goes
This site is hosted on Cloudflare’s global edge network (Cloudflare Pages, Workers KV). Form submissions are HMAC-signed at the network boundary and forwarded to Zapier, a United States–based automation provider, for lead routing. This means your submission is disclosed to recipients outside Australia — in particular to Cloudflare’s global infrastructure and to Zapier in the United States. We take reasonable steps, consistent with Australian Privacy Principle 8, to ensure these providers handle your information in line with the Australian Privacy Principles. We do not sell personal information, and we do not share it with anyone beyond the sub-processors listed on our sub-processor page.
How long we keep it
Any submission that is not successfully forwarded to our lead-routing provider is held in Cloudflare KV for a maximum of 90 days and then automatically deleted. Submissions that reach Zapier and our CRM are retained until you ask us to delete them. Rate-limit records expire automatically after one hour.
Security
Submissions are HMAC-signed at the network boundary so downstream systems can verify they have not been altered. Data is encrypted in transit (TLS) and at rest on Cloudflare’s infrastructure.
Your rights
Under the Australian Privacy Principles you may request access to the personal information we hold about you and ask us to correct it. Email karlambrosius@outlook.com.au and we aim to respond within 30 days.
If you are in the European Economic Area, you additionally have the right to:
- Access — a copy of the personal data we hold about you.
- Rectification — correction of inaccurate or incomplete data.
- Erasure — deletion of your data where we have no continuing lawful basis to keep it.
- Portability — your data in a structured, commonly used, machine-readable format.
- Objection — to processing based on legitimate interest.
If you are unsatisfied with how we handle a privacy complaint, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.
Platform services
This policy covers this website only. The TruthLayer platform — our evidentiary ledger for AI agent activity — is a business-to-business service. Data our platform customers send to it is processed under the customer agreement and data processing addendum, with jurisdiction-tagged storage and encryption at rest, not under this policy.
Changes
If we change this policy, we will update it here and revise the “last updated” date above. Material changes to how we handle form submissions will be noted prominently on this page.
Contact
Privacy questions, access or correction requests, and deletion requests: karlambrosius@outlook.com.au.