Skip to content

Last updated: 10 October 2026

Privacy Policy

1. Introduction

This Privacy Policy describes how PayloadFoundry (Sa’d Yaghi trading as Payload Foundry, ABN 95 399 554 023) collects, uses, stores, and discloses personal information when you visit payloadfoundry.com, book a discovery call, engage our services, or otherwise interact with us.

We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). While as a small business (annual turnover under AUD $3 million) we may not be strictly required to comply, we choose to apply APP standards because our clients (primarily cybersecurity and technical services firms) expect it.

By using our website or services, you agree to this Privacy Policy.

2. Personal Information We Collect

We collect only the personal information necessary to provide our services and communicate with you. This may include:

  • Contact information: name, email address, phone number, business name, ABN, job title
  • Billing information: business address, bank account details (for invoicing), payment card details (processed by Stripe; we do not store card numbers)
  • Communications: the content of messages you send us via email, contact forms, LinkedIn, or booking notes
  • Booking data: the date, time, and details of discovery calls booked via Cal.com
  • Website usage data: aggregated, anonymised analytics via Google Analytics 4 (see Section 5)

We do not knowingly collect sensitive information (as defined under the Privacy Act) unless you provide it to us directly and it is necessary for our services.

2A. Free AI Visibility Scan

When you submit the free AI Visibility Scan form at payloadfoundry.com/scan, we collect:

  • Your business name
  • Your website domain
  • Your work email address
  • Up to three competitor domains (optional, nominated by you)
  • Any free-text notes you include in the “Anything we should know?” field (optional)

To prevent abuse of the free scan we also record your browser’s user agent and a one-way hash of your IP address. We do not store the raw IP address.

We use this information to generate your scan report, deliver that report to the email address you provided, and send one follow-up email about your results as described on the scan page.

We process your scan through our in-house citation tracker Radar (hosted at radar.payloadfoundry.com). Radar fetches the public homepage of the domain you submit to work out your service category, then sends ten buyer-intent prompts to four third-party AI engines (Anthropic Claude, OpenAI ChatGPT, Google Gemini and Perplexity). The prompts are generic category questions and are written not to include your business name or domain.

Separately, we use Anthropic’s Claude Haiku model to detect your service category, to check each engine’s answer for mentions of your firm, and to draft the recommendations in your report. For those steps Anthropic receives your business name, your domain, text from your public homepage, and any competitor domains you nominated. No AI provider receives your email address or your notes.

Scan request records (including your email, domain, competitor list and notes) and your scan results (the prompts used, a short excerpt of each engine’s answer, the firms named, your scores and the recommendations) are retained in our Supabase database for 30 days from the date of your scan request, then deleted at our next scheduled cleanup, within 7 days of that date. This also lets us enforce the limit of one free scan per domain and one per email address every 30 days.

Your report is emailed to you through Resend. A copy of the report is BCC’d to a PayloadFoundry support mailbox and retained for up to 30 days, then deleted by an automated Microsoft 365 retention rule.

If you want your scan record deleted earlier than 30 days, email hello@payloadfoundry.com with your scan domain. We will confirm deletion within five business days.

2B. Scan Waitlist

When the weekly scan slot cap is reached and you join the waitlist at payloadfoundry.com/scan, we collect:

  • Your email address
  • Your domain (optional)

We use this information to send you one notification email when the next week’s scan slots open, usually on the following Monday. We do not use waitlist details for any other marketing purpose unless you later submit a scan form.

Waitlist records are retained for 90 days from the date of your waitlist sign-up, then deleted at our next scheduled cleanup, within 7 days of that date. You may unsubscribe or request earlier deletion by emailing hello@payloadfoundry.com.

3. How We Collect Personal Information

We collect personal information:

  • Directly from you when you contact us, book a call, engage our services, or subscribe to communications
  • Automatically through our website via cookies and analytics (see Section 5)
  • From publicly available business sources (e.g., LinkedIn, company websites, ABN Lookup) when researching prospects or preparing for engagements
  • From third-party service providers we use to deliver services (e.g., Cal.com, Microsoft 365, Stripe)

4. How We Use Personal Information

We use personal information to:

  • Provide, personalise, and improve our services
  • Communicate with you about your enquiries, bookings, and engagements
  • Send invoices and process payments
  • Deliver reports, deliverables, and service updates
  • Respond to complaints or requests
  • Comply with legal obligations (e.g., tax records under the Income Tax Assessment Act)
  • With your consent, send marketing communications and newsletters. You may unsubscribe at any time.

5. Cookies and Analytics

Our website uses cookies and similar technologies to understand how visitors use the site. Specifically:

  • Google Analytics 4 collects aggregated, anonymised information about page visits, referral sources, device type, and general geographic region (city-level, never precise location). IP addresses are anonymised. This data is used only to improve the site and our marketing.
  • Essential cookies are required for the site to function (e.g., session cookies for the Cal.com booking widget).

You can disable cookies via your browser settings. Disabling cookies may reduce site functionality.

You can accept or decline cookies via the banner shown when you first visit our site. You can change your choice at any time by clicking Cookie Settings in the footer.

6. Disclosure of Personal Information

We do not sell personal information. We may disclose personal information to third-party service providers that help us operate our business:

  • Vercel (United States, global edge network) for website hosting
  • Cloudflare (United States, global network) for DNS, security, and Access gating
  • Microsoft 365 (United States, global) for email and productivity
  • Cal.com (United States, European Union) for booking calendar
  • Google Analytics 4 (United States) for website analytics
  • Stripe (United States, Australia) for payment processing
  • Xero (Australia, New Zealand) for invoicing and accounting
  • Supabase (Singapore, AWS ap-southeast-1 region) for database hosting of Radar scan requests and waitlist records
  • Trigger.dev (United States, AWS us-east-1, N. Virginia) for background job orchestration of the Free AI Visibility Scan
  • Resend (Japan, AWS ap-northeast-1, Tokyo) for scan report email delivery
  • Anthropic (United States) for Claude Haiku-based citation extraction and for the Claude engine used in Free AI Visibility Scans
  • OpenAI (United States) for the ChatGPT engine used in Free AI Visibility Scans
  • Google (United States, global) for the Gemini engine used in Free AI Visibility Scans
  • Perplexity (United States) for the Perplexity engine (official API) used in Free AI Visibility Scans

We require each of these providers to protect personal information consistent with applicable privacy laws.

We may also disclose personal information to:

  • Government agencies where required by law, including the Australian Taxation Office
  • Professional advisors (e.g., accountants, lawyers) under confidentiality obligations

7. Overseas Recipients

Some of our service providers are located overseas, including the United States, Singapore, Japan, the European Union, and other Google Cloud regions. When we disclose personal information to these providers, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles, as required under APP 8. By using our website or submitting a Free AI Visibility Scan request, you consent to the overseas disclosure of your personal information for the purposes described in this policy.

8. Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Measures include:

  • Encrypted transmission (HTTPS with modern TLS)
  • Multi-factor authentication on all critical accounts
  • Access limited to necessary personnel
  • Regular review of security practices

Consistent with Part IIIC of the Privacy Act 1988 (the Notifiable Data Breaches scheme), if we become aware of a suspected data breach we will assess it within 30 days. If the breach is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable after that assessment.

Despite our best efforts, no method of internet transmission or storage is 100% secure. You are responsible for keeping your account credentials confidential.

9. Direct Marketing

We may send you marketing communications (e.g., newsletters, service updates) where you:

  • Are an existing client
  • Have opted in explicitly (e.g., by subscribing)
  • Would reasonably expect such communications in the context of our business relationship

Every marketing email includes an unsubscribe link. You may also opt out by emailing hello@payloadfoundry.com. We comply with the Spam Act 2003 (Cth).

10. Accessing and Correcting Your Personal Information

You have the right to:

  • Request access to the personal information we hold about you
  • Request correction of inaccurate or outdated information
  • Request deletion of your personal information, subject to legal retention requirements (for example, tax records must be retained for five years under Australian law)

To exercise these rights, contact us at hello@payloadfoundry.com. We will respond within a reasonable time, usually within 30 days.

11. Complaints

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, please contact us first at hello@payloadfoundry.com so we can investigate and respond.

If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by phone on 1300 363 992.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent version. Material changes will be communicated via our website or by email where possible.

13. Contact Us

PayloadFoundry Sa’d Yaghi trading as Payload Foundry ABN: 95 399 554 023 Email: hello@payloadfoundry.com Website: payloadfoundry.com Location: Sydney, New South Wales, Australia