Privacy policy

1. What we collect

We only collect what we need to run the business and do the work you ask for. That can include:

• Contact details: your name, email address, phone number and business name.
• Business details: your website, industry, what you sell, your offer, your ad spend and your goals. You give us these in our intake form or on a call.
• Payment details: Stripe processes your card. We see the amount, the date and the last four digits of the card. We never see or store your full card number.
• Ad account data: if you buy an audit, we look at your Meta ad account. See section 2.
• Messages and recordings: emails, texts, form answers, call notes, and any call recordings (we will always tell you before we record).
• Website and device data: pages you visit, the links you click, your browser, device type, rough location (city level), and your IP address. See section 5.
• Ad response data: if you fill in one of our Meta instant forms, Meta passes us the details you entered.

We do not ask for sensitive information, such as health details, and we ask you not to send it. Our services are for businesses. They are not meant for anyone under 18.

2. Your ad account during an audit

To do the $97 Meta Campaign Audit, we need to see your Meta ad account. Here is how we handle that:

• Read-only access. You grant us access through Meta’s own partner or user settings. We ask for view-only (analyst) access. We cannot change, pause or spend anything on your account.
• No passwords, ever. We will never ask for your Facebook or Meta password, your two-factor codes, or your login. If anyone claiming to be us asks for these, do not send them, and let us know.
• What we see. Your campaigns, ads, audiences, budgets, results and pixel or event setup. If your account holds lead data from your own customers, we may see some of it. We only look at what we need for the audit.
• Kept confidential. Your account data, results and strategy stay private between us. We do not share them with anyone except the tools listed in section 8 that we use to prepare your report.
• Access removed after. Once we deliver your report, we remove our access, or ask you to remove it, within 7 days.
• You can revoke any time. You can remove our access in your Meta Business settings whenever you like, even mid-audit. If you do that before we finish, we may not be able to complete the report. See our refund policy for what happens then.
• Anonymised use only with permission. We will never publish your name, brand, ads or numbers. We would only use your results, with every identifying detail removed, as a case study or example if you say yes in writing first.

3. How we collect it

Mostly, you give it to us directly. For example, when you:

• fill in a form on our website or a Meta instant form
• buy an audit or another service through our order form
• complete our intake form
• book or attend a call
• email, text or message us.

We also collect some information automatically through cookies, the Meta pixel, the Meta Conversions API and Google Analytics when you use our website. Sometimes we get information from third parties, such as Meta (when you respond to our ads) or Stripe (to confirm a payment).

4. Why we use it

We use your information to:

• deliver the audit, strategy call or campaign build you paid for
• take payments, send receipts and handle refunds
• reply to your questions and keep you updated on your work
• send you marketing, if you have agreed to it (see section 7)
• measure and improve our website and our ads
• keep our systems secure and prevent fraud
• meet our legal duties, such as tax record-keeping.

We will not use your information for anything unrelated to these reasons unless you agree or the law allows it. We do not sell your personal information.

5. Cookies, pixels and analytics

Cookies are small files your browser stores. Pixels and tags are small bits of code that report what happens on a page. We use them to see how people use our site and whether our ads work.

What we use

• Meta pixel. Records visits and actions on our site (such as viewing a page or buying) and reports them to Meta.
• Meta Conversions API. Sends the same kind of event from our server to Meta, so results are measured even when browsers block the pixel. Where contact details are sent (such as an email address after a purchase), they are hashed first. Hashing scrambles the data into a code before it leaves us.
• Google Analytics. Tells us how many people visit, which pages they read and where they came from. We use this in summary form.
• GoHighLevel. Our forms and order pages use cookies to work properly and to connect a form entry to your record.

How to opt out

• Block or delete cookies in your browser settings. Most of our site will still work.
• Use the Google Analytics opt-out browser add-on.
• Control how Meta uses your data for ads in your Meta ad preferences.
• Control Google ads in My Ad Center.
• Opt out of interest-based ads from many companies at Your Online Choices.

6. Remarketing

If you visit our site, you may later see our ads on Facebook, Instagram or other sites. This is called remarketing. It works through the Meta pixel, the Conversions API and similar tools.

We may also build audiences in Meta from our customer or lead lists, for example to leave out people who have already bought. When we do this, the details are hashed before upload, and Meta uses them only to match and then discards them, under its own terms.

You can turn off ads based on your activity using the links in section 5.

7. Email and SMS marketing

We follow the Spam Act 2003 (Cth). That means:

• We only send you marketing emails or texts if you have agreed, or where the law says consent can be inferred (for example, you are a current customer and it relates to what you bought).
• Every marketing message says it is from AutoConvert Digital and how to reach us.
• Every marketing message has an easy way to unsubscribe. For email, click “unsubscribe”. For SMS, reply STOP.
• We act on your unsubscribe within 5 business days, usually straight away.

Messages about work you have bought (such as your audit report, receipts or access requests) are not marketing. You will still get those after you unsubscribe.

8. Who we share it with

We share information only with the service providers that help us run the business, and only what they need. They include:

• GoHighLevel — our CRM, website forms, order forms, and email and SMS system. Hosted in the United States.
• Stripe — payment processing.
• Google Workspace — Gmail, Google Drive and Google Calendar, for email, file storage and bookings.
• Meta — for our ads, instant forms, the Meta pixel and the Conversions API.
• Google Analytics — website measurement.
• Loom — to record and share your audit walkthrough video.
• AI tools (Anthropic’s Claude) — to help analyse what we see in your ad account and on your landing page during an audit. We share only what the audit needs, and never your passwords. Luke reviews every finding before it reaches you.

We may also share information with our accountant or professional advisers, or if the law requires it (for example, a court order). If we ever bring in a contractor to help deliver your work, they will be bound to keep your information confidential.

9. Overseas disclosure

Several of the tools above store data outside Australia. It is most likely to be held in the United States. Some providers also use data centres in other countries, such as Ireland, the European Union, Singapore or elsewhere, depending on their own setup.

We choose well-known providers with strong security and privacy commitments, and we take reasonable steps under APP 8 to make sure they handle your information in line with the APPs. By using our services, you understand that your information may be stored and processed overseas.

10. Security

We take reasonable steps to protect your information from misuse, loss and unauthorised access. These include:

• two-factor authentication on our business accounts
• read-only access to client ad accounts, never passwords
• limiting access to the people who need it
• using providers that encrypt data in transit.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

11. How long we keep it

• Payment and tax records: at least 5 years, because tax law requires it.
• Audit reports, notes and recordings: up to 2 years after delivery, so we can answer follow-up questions, then deleted.
• Leads and enquiries: until you ask us to remove them, or 2 years after we last heard from you.

When we no longer need information, we delete it or make it anonymous. You can ask us to delete your information sooner. We will do so unless the law requires us to keep it.

12. Access and correction

You can ask to see the personal information we hold about you, and ask us to fix anything that is wrong or out of date. Email us at sales@autoconvertdigital.com.au.

We will reply within 30 days. It is free. If we cannot give you access (the law allows this in a few cases), we will tell you why in writing.

13. Staying anonymous

You can browse our site and ask general questions without telling us who you are. To buy an audit or other service, we need your name, contact details and business details.

14. Complaints

If you think we have mishandled your information, please tell us first at sales@autoconvertdigital.com.au. We will look into it and reply within 30 days.

If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

15. Changes to this policy

We may update this policy as our business or the law changes. The date at the top shows the latest version. If a change is significant, we will put a notice on our website or email current clients.

16. Contact us