Layer1 SEO

Privacy Policy

Effective October 17, 2026

1. Who we are

Layer1SEO is operated by Layer1 Data Service Inc, doing business as Layer1SEO ("Layer1SEO," "we," "us"). This policy explains what information we collect when you use our website, free scan, or a paid account, how we use it, and who we share it with. Questions: sales@layer1seo.com.

2. What we collect

Free scans: the website address you submit, the scan results, your IP address, and your email address if you choose to give it.
Accounts: your email address and password (the password is stored by our sign-in provider, Supabase, in hashed form; we never see it), the websites you add, your scan history and Fix Kits, your platform choice, your language (English or Spanish, so emails reach you in it), and your plan and billing status.
Billing: your name, email and payment details are collected by Stripe. We never see or store your full card number.
Sign-in security: when two-factor sign-in is on, we store a scrambled (hashed) copy of each emailed code, never the code itself, plus a record of each trusted device or browser (a hashed device token, the browser type, IP address and dates).
Agreements: when you accept our Terms of Service and Privacy Policy, or confirm the Fix Kit acknowledgment, we record the date and time, the version you accepted, your IP address and browser type.
"Send to my web developer": the developer's email address and any note you add, so we can deliver the email and apply sending limits.
Usage and logs: our servers record technical information such as IP addresses, pages requested, dates and times, and error messages. Error logs may include your email address or account ID.

3. Websites you submit

To scan a website, we read its publicly available pages, robots.txt, sitemap and similar public files, the same way a search engine does. We never log in to, access, or change your website.

4. How we use AI

AI-personalized Fix Kits: for paid scans, we send your site's page title, meta description, headings and a short excerpt of its visible text (up to about 1,500 characters), together with the list of failing checks, to Anthropic (Claude) to write fixes for your site.
AI engine checks: if you turn on a live check for ChatGPT (OpenAI), Claude (Anthropic) or Perplexity, we send that provider a question that includes your website's domain, and we show you the answer.
We send these providers only what's needed for the feature you use. We don't send your password, payment details or sign-in codes.

5. How we use information

To run scans and show your results; to send Fix Kits, alerts, sign-in codes and account emails; to bill you through Stripe; to keep accounts secure and prevent abuse (for example, rate limits); to check that the service is working (automated health checks of our own systems send status reports, which can include customer email addresses and billing status, only to us); to follow up about a free scan if you left your email; and to meet legal obligations. We don't sell your personal information, and we don't use advertising or cross-site tracking.

6. Who we share it with

We share information only with providers that help us run the service:

Supabase: accounts, sign-in and database storage.
Stripe: payments and billing.
Resend: email delivery (alerts, sign-in codes, Fix Kit emails and account notices).
Anthropic, OpenAI and Perplexity: AI processing, as described in section 4.
DigitalOcean: server hosting.
Google Fonts, jsDelivr and cdnjs: our pages load fonts and code libraries from these networks, which receive your IP address and browser details when the page loads.

We may also share information if required by law, to protect our rights or users, or as part of a sale or merger of our business.

7. Cookies and browser storage

We don't use advertising or analytics cookies. We use:

A security cookie that remembers a trusted device for 30 days after you enter a sign-in code.
Browser storage that keeps you signed in (managed by Supabase), remembers your language choice, and briefly stores sign-in and admin settings for the current tab.

8. How long we keep it

Account data, sites and scan history: while your account is open. We may delete scan history 90 days after you cancel.
Sign-in codes expire after 10 minutes; trusted devices expire after 30 days.
Records of what you agreed to are kept even after an account is closed, as proof of agreement.
Free-scan records and emails left on the free scan are kept until you ask us to delete them.
Web server access logs are kept for 14 days, and application logs (including error logs) for 30 days.
Billing records are kept by Stripe and as required for tax and accounting.

9. Your choices

You can ask us to access, correct or delete your information by emailing sales@layer1seo.com. Deleting your account removes your sites, scans and Fix Kits; we keep agreement records and billing records where needed for legal reasons. Depending on where you live, you may have additional privacy rights; contact us to use them.

10. Security

We use encrypted connections (HTTPS), hashed sign-in codes and device tokens, access controls on our database, and a firewall on our server. Two-factor authentication by email code is required on every account. No system is perfectly secure; tell us right away at sales@layer1seo.com if you think your account has been accessed without permission.

11. Children

Layer1SEO is meant for businesses and isn't directed at children. We don't knowingly collect information from children under 13.

12. Where information is processed

We and our providers may process information in the United States and other countries where they operate.

13. Changes to this policy

We may update this policy. We'll change the date at the top, and we'll email account holders about material changes before they take effect.

14. Contact

Questions about this policy: sales@layer1seo.com.