Privacy Policy

What we collect

We may collect and hold the following kinds of personal information.

• Identity information. your name, business name, job title, and ABN where applicable.
• Contact information. email address, phone number, and business address.
• Enquiry and booking details. the service you are interested in, preferred times, and any notes you provide when booking.
• Marketing and campaign data. where we manage advertising for you, the performance data attached to your ad accounts, audiences, and conversions. We collect it to run and report on campaigns, nothing else.
• Access credentials. where you give us logins or API keys for your website, CRM, Google Business Profile, ad accounts, or other platforms, we store them securely and use them only for the agreed scope of work.
• Onboarding answers and documents. what you type into our client onboarding portal, and any files you upload there, including logos, photographs, licences, insurance certificates, and price lists.
• Technical and usage data. IP address, browser type, device information, pages visited, time on site, referral source, and UTM parameters, collected automatically through cookies and analytics.
• Payment information. billing details needed for invoicing. We do not store card numbers. Payment processing is handled by a third-party provider.

How we collect it

We collect personal information through:

• our booking and contact forms,
• email, phone, and video call correspondence,
• the client onboarding portal and strategy sessions,
• third-party platforms where you have authorised us to act on your behalf, such as Google Ads, Meta Business Suite, Google Business Profile, and GoHighLevel,
• cookies and analytics tools on this website, and
• publicly available information such as business directories and social media profiles, where it is relevant to delivering our services.

How we use it

We use personal information to:

• respond to enquiries and schedule calls,
• deliver and manage our web, search, advertising, and CRM automation services,
• set up and optimise campaigns on Google Ads, Meta, and other networks,
• create and manage CRM records, automations, and pipeline stages on your behalf,
• build, maintain, and host websites and landing pages,
• generate performance reports and campaign insights,
• send project updates, invoices, and service-related communications,
• improve our own website and services, and
• comply with legal obligations.

We do not sell, rent, or trade personal information to third parties for their marketing purposes.

The client onboarding portal

New clients complete onboarding through a portal at onboarding.echostudios.au. It is worth setting out separately how that works, because it holds more of your business information in one place than anything else we run.

Access is by a one-time code sent to the email address or mobile number we already hold for you. There is no public sign-up. Every answer is saved as you type it, so you can close the tab and come back to it, which means your part-finished answers are stored on our systems from the moment you enter them.

Answers and uploaded files are held in encrypted private storage that is not publicly reachable and not indexed by search engines. Answers are also mirrored into your CRM record so the people doing your work can see them. Uploaded files are retained for the duration of the engagement and are covered by the retention and deletion terms below.

The portal does not ask for card numbers, passwords, or two-factor codes, and we will never ask you for them by email or text. Where a platform needs our access, you add us as a user on your own account rather than handing over your login.

Your customer lists

Some of our work involves your customers rather than you. If you give us a list of customers, past customers, or contacts so that we can load it into your CRM or message them on your behalf, we handle it as follows.

• We act on your instruction. The data stays yours, and we process it only to deliver the services you have engaged us for.
• We do not use it for our own marketing, and we do not disclose or sell it to anyone.
• The phone number and sender identifier we set up are registered to your business, so messages go out in your name and identify you as the sender.
• Every commercial message we configure includes a working unsubscribe, and unsubscribes are recorded and actioned automatically.
• You are responsible for having collected that data lawfully and for holding the consent needed to message those people. That is set out in the terms of service.

If you are a customer of one of our clients and want your details removed, contact the business that messaged you. They control the list. You are also welcome to contact us and we will pass the request on and action it in the system.

Third parties and where data goes

To deliver our services we share or process information through these categories of provider.

• CRM and automation. GoHighLevel, for contact management, booking, pipeline tracking, and automated communications.
• Advertising platforms. Google Ads and Meta Ads Manager, where we manage campaigns using data you have authorised us to access.
• Analytics. Google Analytics 4 for traffic analysis and Google Search Console for search performance.
• Hosting and infrastructure. Vercel, for website hosting, deployment, and encrypted file storage.
• Communication. email providers, video conferencing, and messaging platforms used in the course of client work.
• Payment processing. third-party invoicing and payment tools. We do not handle or store card details.

Some of these providers store or process data on servers outside Australia, including in the United States. Where that happens we take reasonable steps to ensure your data is treated in line with this policy and applicable privacy law.

We may also disclose personal information where required or authorised by law, including to comply with a court order, subpoena, or regulatory request.

Access to your accounts

Where you grant us access to your advertising accounts, CRM, hosting, domain registrar, Google Business Profile, or other platforms, we use that access solely to deliver the agreed services. We do not use it for anything unrelated to your engagement.

When an engagement ends we return or transfer ownership of accounts and assets as set out in the service agreement, and revoke our own access within a reasonable time unless you ask otherwise.

Cookies and tracking

This website uses:

• Essential cookies. required for the site to work, such as session management.
• Analytics cookies. Google Analytics 4, which collects anonymised usage data so we can see how visitors move through the site.
• UTM and referral tracking. we capture utm_source, utm_medium, utm_campaign, and the referring page when you submit a booking form, so we know how you found us.

You can disable cookies in your browser at any time. Turning off analytics cookies will not affect the site or the booking system.

How long we keep it

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.

• Enquiry and booking data stays in our CRM for the length of the relationship and for up to 24 months after the last interaction, unless you ask us to delete it sooner.
• Onboarding answers and uploaded documents are kept for the duration of the engagement. On termination we export your CRM contact records on written request within 30 days, and erase message history, automation configuration, analytics, and system logs.
• Client project data, including campaign reports and website assets, is kept for the engagement and a reasonable period after, to support handover.
• Financial records are kept for 7 years under Australian tax law.
• Website analytics data follows the default retention settings in Google Analytics.

Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

• HTTPS on all traffic.
• API keys and credentials held server-side and never exposed to the browser.
• Private, access-controlled storage for client files and onboarding uploads.
• One-time codes rather than shared passwords for portal access.
• Rate limiting on API endpoints.
• Regular review of the security practices of the third parties we rely on.

No method of electronic transmission or storage is completely secure. We work to protect your information but cannot guarantee absolute security.

Your rights

Under the Privacy Act 1988 you have the right to:

• Access. ask for a copy of the personal information we hold about you.
• Correction. ask us to correct anything inaccurate or out of date.
• Deletion. ask us to delete your personal information, subject to records we are legally required to keep.
• Complain. raise a complaint with us, or with the Office of the Australian Information Commissioner at oaic.gov.au, if you believe your privacy has been breached.

Email info@echostudios.au to exercise any of these. We respond within 30 days.

Changes to this policy

We update this policy from time to time to reflect changes in our services, the law, or how we work. Changes are posted here with a new date at the top. Continued use of the site or our services after a change means you accept the updated policy.