Privacy Policy

1. About this policy

Whitehat Agency is a Sydney-based digital marketing agency providing SEO, Google Ads, Meta Ads, web design and development, and AI services. Whitehat Agency is operated by 484 Digital Pty Ltd (ABN 81 651 974 006) (“Whitehat”, “we”, “us” or “our”). We respect your privacy and are committed to protecting your personal information.

This policy explains how we collect, use, hold and disclose personal information, and how we comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). It applies to:

• Our public website at whitehatagency.com.au;
• Our client portal at portal.whitehatagency.com.au (where engaged clients sign in to view performance reports, manage billing, refer new business, complete satisfaction check-ins and chat with Halo, our AI agent);
• All services we provide to clients, including SEO, paid media, web design and development, web hosting, AI services, reporting and consulting.

2. What information we collect

We only collect personal information that is reasonably necessary for our business (APP 3). The information we collect falls into these categories:

• Information you give us via the website — when you submit an enquiry, request a free audit, book an introductory call, subscribe to our newsletter, apply for a role, or otherwise contact us. This may include your name, email address, phone number, business name and website, marketing budget, goals and any other details you choose to share. For job applications this also includes your résumé (uploaded as a file attachment) and the contents of any cover note. If you book an introductory call, the booking page records your name, email address and the time you selected, and emails you a calendar invitation for the meeting.
• What you tell us before and during a call — when you book an introductory call we may send you a short optional form asking about your goals, what you have already tried and who is involved in the decision; we keep whatever you choose to answer, and every question is skippable. During the call itself, the person you speak to writes notes on what you tell us — your objectives and the numbers you are aiming at, how you currently win customers, who your competitors are, and anything else you raise. Both are held against your enquiry so we can prepare properly and so any proposal reflects what you actually asked for, and both are internal notes rather than anything published.
• The AI Search Score: if you run the AI Search Score check on our website, we collect your name, work email address, mobile number and the website you ask us to check, and our servers fetch the page you give us and that site’s robots.txt file, as any visitor’s browser could, to work out the score. We keep the result with your details, email it to you, and add you to our list of enquiries. Unlike our other forms, the check keeps no record of your country or browser, and uses your IP address only to limit how often it can be run, storing it in a scrambled (hashed) form. If you then book a call with us, we prepare a fuller report: our AI tools write around twenty questions a buyer in your industry might ask, based on your public website and leaving out your business’s name, put them to ChatGPT, Perplexity and Google’s AI answers, and record which businesses each answer names, which can include your competitors. Our team receives that report before your call, and it is emailed to you, with a private link to it, shortly after the call. We count how many times that link is opened, and when.
• Proposals we send you: when we send you a proposal as a private web page, we record when it is opened, how many times, and roughly how long is spent on each section, against the proposal rather than against a named reader, so we know what to follow up on. If you accept it on that page, we record the name and email address entered, the option chosen and the price shown.
• Information we capture automatically when you submit a form — the page you submitted from, your IP address, your country (resolved at our edge from your IP), the browser user-agent string, and the date and time of submission. We use this for fraud prevention, lead-source analytics and to comply with our own Australian-only contact policy.
• Information about engaged clients — if you engage Whitehat, we collect business and billing details needed to deliver and invoice for our services, including ABN, contact details, the names and email addresses of nominated portal users on your account, billing email, and payment information (card payments are handled securely by our payment provider; we do not store full card numbers). If you sign up online from a proposal we send you, we also record the name, email address and phone number of the person signing up, your billing contact’s details, the option you chose, and the terms you accepted, exactly as they were shown at the moment you accepted.
• Setup details you give us at the start of an engagement — when we begin work we email you a private link to a setup checklist where you tell us the practical facts about your accounts that we cannot discover ourselves: which inbox your enquiries reach today and who follows them up, the customer system you use, your website’s login address, your domain registrar, your web host and where your email is hosted, your Google Ads customer ID, the names of any paid plugins on your site, the four-digit collaborator request code if your store is on Shopify (a one-time code that lets us send you an access request — not a password), and who on your team approves advertising copy. Some of these answers name a colleague, so they may include that person’s name and work email address. The link itself is what proves it is you — there is no sign-in, so anyone holding the link can open the page; please keep it private and tell us if it is forwarded or exposed so we can reissue it. We deliberately do not ask for passwords or API keys and the page refuses them. Your answers are held against your client record and we send you reminders while items are still outstanding. Where we are designing and building your website, the checklist also asks for the photographs and video you want used and where each came from (your own shoot, a stock licence or a supplier, with the licence or the photographer’s name), and for the details you want published on the site, such as your prices, opening hours, service areas and the phone number and email address to show. The files themselves go into your shared project folder. When you approve the design or the finished site, on your own page or by telling your account manager, we record the name of the person who approved it, when, and how the approval reached us.
• Performance data we collect on your behalf — with your authorisation we read data from your connected analytics, advertising and SEO accounts (Google Analytics 4, Google Search Console, Google Ads, Google Business Profile, Google Merchant Center, Meta Ads, Bing Webmaster Tools, Ahrefs and similar) for the purpose of producing your reports and managing your campaigns. This is data about your business; it may include limited personal information (for example, customer identifiers in your CRM).
• Customer lists clients provide for advertising audiences — where you ask us to build an advertising audience for your Meta campaigns, you may provide a list of your customers’ contact details (such as email addresses and phone numbers). We process these transiently: each value is normalised and one-way hashed (SHA-256) in memory before it is sent to Meta for matching, we do not keep a copy of the list, and the raw details are never written to our systems or our audit logs — only the count of contacts uploaded is recorded.
• Conversion events we send on a client’s behalf — where we measure advertising results for a client, we send records of completed actions (such as a booking, enquiry or purchase, and where the client provides it, the real-world outcome that followed) to their advertising platform. These may include the customer’s contact details, which are one-way hashed before transmission and are not retained by us.
• Enquiries from lead ads we manage — where we run lead-generation advertising for a client, people who submit the ad’s enquiry form (typically their name, phone number, email address and selected options) give those details to Meta, and they go from Meta to that client. They are the client’s data and stay with Meta and the client: our systems hold none of them, and what we report on is how many enquiries an advertisement produced, which identifies nobody. Our access to the client’s Facebook Page lets our team view a form’s enquiries on Meta; we handle anything seen that way as the client’s data, use it only to provide our services to that client, and do not use it for any other purpose.
• Public comments on advertising and social content we manage — where we run a client’s Facebook or Instagram advertising, we read the comments the public leaves under their posts and ads, including the commenter’s display name, what they wrote and when. We use this only to look after what sits beneath the client’s live advertising — hiding spam, competitor pitches or abuse (which is reversible and which the author still sees), replying on the client’s behalf, or removing a comment at the client’s request — and to tell the client what is being said about them. The comments themselves stay on Meta’s platform; what we keep is a record of any moderation decision we made, noting what the comment was and why we acted, so the decision can be reviewed later.
• Google reviews of your business: where we keep the Google reviews on your website current, our systems read your newest reviews from your Business Profile (each reviewer’s public display name, their star rating, what they wrote and when) and publish them on your website or online store, with Google’s own average rating and review count. Every daily run replaces the whole set, so your site holds nothing older than its last update. A review of three stars or fewer is held back until you decide whether it appears, and we email you about it, reading its words fresh from Google at that time. Where a site is set to need it, only reviews a person at Whitehat Agency has cleared are published. Our own records keep a review’s identifier, its star rating and the decision made about it, and leave out the reviewer’s name and words.
• Website availability data for hosting clients — where we host your website, we continuously monitor its availability and response time (uptime monitoring) so we can respond to outages and report hosting performance to you. This is data about your website, not about individuals.
• Website security and backup data for hosting clients — where we host your website or provide website security as part of your engagement, we run malware scanning, firewall protection and automated backups on the site. This produces malware scan results, security logs (including the IP addresses of requests to your website that were blocked as malicious), encrypted backup copies of your website and its database — which may include personal information your website itself stores (for example, user accounts or form entries) — and a log of the routine software updates we apply to the site. We access this data only to protect and maintain your website and to report that work to you.
• Portal account information — when you sign in to portal.whitehatagency.com.au we record your email address (used as your identifier), display name, phone number if you give one, role within your account (owner, admin, member), session activity (sign-in times and which portal features you use) and your notification preferences. If you work with us for more than one business, one sign-in covers each of them, and we record which business you last opened. We use magic-link sign-in — we do not store passwords for portal users.
• Portal interactions — messages and questions you send to Halo (our AI agent), survey responses you submit to our quarterly Pulse satisfaction check-in (Pulse responses are tied to your client account, but who from your team submitted is not surfaced to teammates), referrals you submit (in the portal or on your referral page), and internal notes about your account written by our team.
• Information collected automatically when you browse — cookies, analytics events, IP address, device and browser type, the pages you view and how you interact with the site. See “Cookies and analytics” below for the specific tools.
• Information from third parties — to qualify and prepare for business enquiries, we may collect publicly available information about you or your business (for example, your company website, professional networks, news, Google search results and the Australian business registers).

3. How we use your information

We use personal information (APP 6) to:

• respond to your enquiry, send you an acknowledgement, and follow up about your enquiry or free audit, and prepare for and record a call you book with us so that any proposal reflects what you asked for;
• provide, manage, report on and improve our services to you (including monitoring the uptime of websites we host, protecting them with malware scanning, firewall protection and automated backups, keeping their software current through routine monthly maintenance — plugin and theme updates applied with a backup taken before every update — building and editing your website where web design or development is part of your engagement, which means creating and updating its pages, layouts and menus and uploading images and files to it, whether it runs on WordPress, Sanity or Shopify, checking the publicly available source code of web pages from our own servers to verify that tracking and technical setup are working (this reads only what any visitor’s browser can already see, sends no cookies or credentials, and nothing is stored), scanning up to 60 of your public web pages each week where SEO is part of your engagement and keeping what the scan finds, and sending hosting clients a monthly hosting report);
• give you secure access to your client portal, deliver your scheduled performance reports (by email and in the portal), let you chat with Halo, run the quarterly Pulse check-in, and process referrals you submit;
• build advertising audiences you request from customer lists you provide (one-way hashed before matching — see “What information we collect”), measure the results of your advertising (including by sending records of completed actions, and any real-world outcomes you tell us about, to your advertising platform with any contact details one-way hashed), count the enquiries generated by lead ads we run for you, and moderate the public comments under the posts and ads we manage for you;
• keep the Google reviews on your website or online store current (see “What information we collect”), and prepare work for our team to review: replacement copy for your website saved as an unpublished draft, and replacement ads built switched off in your advertising accounts, all of which goes live only when a person at Whitehat Agency puts it live;
• assess job applications and manage recruitment (your résumé is forwarded to our careers inbox; we do not publish or share it externally);
• process billing and payments, issue invoices, apply referral discounts where earned, and meet our accounting and tax obligations under Australian law;
• operate, secure, analyse and improve our website, portal and services (including portal product analytics, server-side aggregate analytics, error monitoring and rate limiting to detect abuse);
• use AI tools (most notably Halo, powered by Anthropic’s Claude API) to qualify enquiries, score referrals for fit, draft outreach emails, analyse your performance data, write your reports, and draft proposed copy for your website and your ads. AI tools also assist our team inside our own business systems — reading and drafting in our own email, calendar and document accounts, which naturally include correspondence with you and files about your account. That includes reading the files you attach to an email, saving one into your project folder, and creating and sharing that folder with you. Any email drafted this way is reviewed and approved by a person at Whitehat before it is sent. AI tools also read the emails that reach our shared agency inbox each day and summarise the ones that need attention for our team, and answer our team’s questions about the accounts we manage, in the portal and in our internal Slack workspace. A person at Whitehat reviews material decisions before they reach you, and you can ask your account manager to disable AI-generated content for your account at any time;
• send you marketing communications and our newsletter where you have requested them or where otherwise permitted by law (see “Direct marketing” below); and
• comply with our legal obligations, enforce our terms, and protect our and your legal rights.

4. When we disclose your information

We do not sell your personal information. We disclose it only as set out in this policy — mainly to the service providers we use to run the business, to your account manager, to your professional advisers where relevant, and where required by law.

Specifically, we may disclose your information to:

• Whitehat staff — your account manager and the team supporting your account;
• Service providers — hosting, database, email delivery, payment processing, authentication, analytics, uptime monitoring, website security and backup, error monitoring, team messaging and AI providers, and the website and online-store platforms we work in for clients, under arrangements that require them to protect your information and use it only for the services they provide to us (the full list is in the next section);
• Professional advisers — our lawyers and accountants where reasonably necessary;
• Government agencies, regulators or law enforcement where required or authorised by law (see “Requests from public authorities” below);
• A purchaser or successor in the event of a sale, merger or restructure of our business (your information would transfer with the business and remain protected by this policy or an equivalent).

5. Service providers and overseas disclosure (APP 8)

Some of the service providers we use store or process data outside Australia. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles, including by using providers with appropriate certifications (such as SOC 2 Type II and ISO 27001) and contractual commitments to data protection.

Primary database — in Australia:

• Supabase (Sydney, ap-southeast-2) — our primary database. Stores your portal account, your client record, your performance reports, your referrals, your Pulse responses, your goals, the leads submitted through our website (including AI Search Score checks), and the proposals we send and any acceptance of them. Data sovereignty is preserved — this data does not leave Australia at rest.

6. Overseas service providers we use

The following providers may store or process personal information outside Australia. Each is contractually bound to protect that information and has its own published privacy and security commitments, linked below.

• Vercel, Inc. (USA) — hosts and serves the website and portal. Traffic is served from edge locations including Sydney, but processing infrastructure is operated globally. vercel.com/legal/privacy-policy
• Anthropic, PBC (USA) — processes data submitted to Halo, our AI agent, for the purpose of generating your reports, scoring referrals, drafting outreach emails and answering chat questions, and powers the AI tools that assist our team with correspondence and documents held in our own business email, calendar and document systems (which may include correspondence with you). It also reads the emails that reach our shared agency inbox each day to sort them and summarise the ones that need attention, drafts proposed copy for client websites and ads from the existing pages and the search and advertising data behind them, writes the questions for an AI Search Score’s fuller report from the business’s public website and reads the answers that come back, and powers the AI tools our team uses, in the portal and in our internal Slack workspace, to read and work on the accounts, websites and stores we manage for clients. Under Anthropic’s commercial terms, your data is not used to train Anthropic’s models. anthropic.com/legal/privacy
• Stripe Payments Australia Pty Ltd / Stripe, Inc. (Australia, USA, Ireland) — processes card and direct-debit payments and stores billing-related personal information. PCI-DSS Level 1 certified. We do not see or store your full card number. stripe.com/au/privacy
• Xero Limited (New Zealand) — our accounting platform. For clients billed by invoice, invoices are raised and managed in Xero, and we read invoice status from our Xero account to show billing history in the portal. xero.com/au/legal/privacy
• Resend (USA) — delivers transactional and notification emails from our website and portal (lead acknowledgements, portal invites, reminders, proposals, scheduled performance reports), and holds our newsletter subscriber list, including who has unsubscribed. SOC 2 Type II. resend.com/legal/privacy-policy
• Clerk, Inc. (USA) — authenticates portal users (issues magic-link sign-in emails, manages sessions). SOC 2 Type II. clerk.com/legal/privacy
• Google LLC (USA / Ireland) — Google Analytics 4 (website usage analytics), Google Tag Manager (tag management), Google Search Console (organic search performance), Google Ads API (paid campaign data), Google Business Profile API (local search and profile performance, and the reviews on your profile), Google Merchant Center API (Shopping feed and performance for online stores) and Google PageSpeed Insights (performance audits of web pages — data about the page, not about individuals). Google Calendar appointment scheduling powers the booking page embedded on our thank-you page: when you book an introductory call, Google records your name, email address and chosen time, places the appointment on our calendar and sends you the invitation. Where you have authorised it, we also manage who has access to that property, your advertising account, your Business Profile and your Tag Manager account — which is how we add our team at the start of an engagement and withdraw our own access at the end of one. Our own business email, calendar and documents run on Google Workspace, which is also where we keep the shared project folder for your account — the documents you send us, the meeting notes we write for you and the work we hand over — and share it with you. policies.google.com/privacy
• Ahrefs Pte. Ltd. (Singapore) — SEO data and backlink intelligence used in client reports, and Ahrefs Web Analytics on our website. ahrefs.com/privacy
• PostHog, Inc. (USA) — product analytics for the client portal: which portal pages and features are used and how (page views, clicks, feature usage), tied to your portal sign-in, so we can improve the portal experience and support you. It also counts visits and clicks on the private pages we send by link, such as a proposal, a shared report or your setup checklist, with the private link removed from everything it records. Not used on the public website. posthog.com/privacy
• Microsoft Corporation (USA) — Microsoft Clarity provides anonymised session replays and heatmaps of website visits so we can improve the site experience. We also read Bing Webmaster Tools (Bing organic search performance) for client reports, and may submit client pages to Bing for crawling as part of SEO work. privacy.microsoft.com
• UptimeRobot s.r.o. (Czech Republic, EU) — monitors the availability and response times of websites we host for clients, around the clock, so we can respond to outages and report hosting performance. Holds the monitored website addresses and their availability history — data about the website, not about individuals. uptimerobot.com/privacy-policy
• Inactiv.com Media Solutions Pvt. Ltd. / BlogVault Inc. (India / USA, servers in the USA and EU) — operates the WP Remote, MalCare and BlogVault platform we use to protect and back up websites we host or secure for clients: malware scanning, firewall protection and automated backups. Holds encrypted backups of those websites and their databases (which may include personal information the website itself stores, such as user accounts or form entries), malware scan results, and firewall logs including the IP addresses of blocked requests. Backups are encrypted and stored in EU data centres and on Amazon S3. wpremote.com/privacy
• LinkedIn Corporation (USA) — the LinkedIn Insight Tag measures the effectiveness of our LinkedIn advertising. linkedin.com/legal/privacy-policy
• Meta Platforms Ireland Limited / Meta Platforms, Inc. (Ireland / USA) — for clients who run Meta Ads with us, we read Facebook and Instagram advertising performance (spend, results, reach, campaign breakdowns) and manage their advertising (creating and adjusting campaigns, audiences, enquiry forms and ads — and, for online-store clients, product catalogues: product listings, pricing and availability) through Meta’s Marketing API, using access granted to our agency’s Meta Business Manager. Where a client asks us to promote their existing social content, we also read the posts on their own Facebook Page and Instagram account (the published content, its captions and engagement counts) to select and reuse as advertisements the client approves — this is the client’s own published content, not data about individuals. Meta also sends our systems automated service notifications about the advertising accounts we manage (for example, that an ad has a delivery issue) so our team can respond promptly — these notifications are about the advertising account, not about individuals. Where a client provides a customer list for audience matching, each contact detail is one-way hashed before it reaches Meta and the raw list is not retained by us. Where a client asks us to measure advertising results more accurately, we also send conversion events to Meta from our own servers rather than only from the client’s website — for example, that a booking or enquiry was completed. Where the client tells us what happened afterwards in the real world (for example, that an appointment was attended or a quote became a job), we can send that too, so their advertising is measured on real outcomes rather than clicks. These events may include the customer’s contact details for matching: each value is normalised and one-way hashed (SHA-256) in memory before it reaches Meta, we do not keep a copy, and the raw details are never written to our systems or our audit logs — only the number of events and what they were is recorded. Where we run lead ads, Meta collects the enquiry details submitted on the form and passes them to that client; our systems hold none of them. We also read the public comments left under the posts and ads we manage — the commenter’s display name and what they wrote — and, where a comment should not sit under a live advertisement, hide it (reversibly), reply to it or remove it on the client’s behalf. Data we receive from Meta is shown only to the client whose advertising it is, is never sold or shared with any other client, and is handled and deleted in accordance with this policy. facebook.com/privacy/policy
• Shopify Inc. / Shopify Commerce Singapore Pte. Ltd. (Canada / Singapore): where your online store runs on Shopify, your store issues us an access key, held in our hosting platform’s encrypted configuration rather than in our database. We use it to work on an unpublished copy of your store’s theme (changes reach your live store only when a person publishes them), to publish your Google reviews on your store, and to read your product catalogue and store details. When we connect a store through our own app, the permissions it asks for cover the store’s themes, products, discounts, stock, files, pages and redirects, and its orders, and leave out your customer list. shopify.com/legal/privacy
• Sanity AS / Sanity US Inc. (Norway / USA): where your website’s content is managed in Sanity, your Sanity project issues us an access token, held in our database where only our own servers can read it. We use it to read and edit your site’s content, saving changes as unpublished drafts, and to publish a draft when a person at Whitehat Agency asks for it. sanity.io/legal/privacy
• Slack Technologies Limited / Slack Technologies, LLC (Ireland / USA): our team’s internal messaging. We keep internal channels for our clients in our own Slack workspace, where we post the work we have done or scheduled for each client and short summaries of emails we have received about them, and where our team can ask our AI tools about an account. Posts can include your business name, the titles of that work and your performance figures. slack.com/trust/privacy
• DataForSEO OU (Estonia): puts the questions in an AI Search Score’s fuller report to ChatGPT, Perplexity and Google’s AI answers on our behalf, and returns their answers. It receives the questions only, which leave out your name and contact details. dataforseo.com/privacy-policy
• Tina Cloud (USA) — lets our marketing team edit content on the public website. Does not handle client portal data. tina.io/legal/privacy-policy
• GitHub, Inc. (USA) — source-code repository for the website and portal. Holds the application code, not client data. GitHub Privacy Statement

7. Cookies and analytics

Our website uses cookies and similar technologies, loaded through Google Tag Manager, to understand how visitors use the site, measure our advertising and improve the experience. The tools we run are: Google Analytics 4 (site usage analytics), Google Ads conversion tracking (measures enquiries generated by our advertising), Microsoft Clarity (anonymised session replays and heatmaps showing how visitors interact with pages), the LinkedIn Insight Tag (advertising measurement) and Ahrefs Web Analytics (aggregate usage statistics). These tools may collect information such as your IP address (anonymised where supported), the pages you visit, the buttons you click and the time you spend on the site.

Our client portal uses cookies set by Clerk to keep you signed in securely (these are essential and cannot be disabled while you are signed in), and PostHog product analytics to understand how portal features are used (tied to your portal account) so we can improve the portal. PostHog also runs on the private pages we send by link, such as a proposal or a shared report, and counts visits and clicks there with the private link removed.

After you submit an enquiry, our thank-you page embeds a Google Calendar booking page so you can choose a time for an introductory call. That booking page is served by Google inside a frame and may set its own cookies when it loads. It appears only on the thank-you page, and only after you have submitted an enquiry — it is not present anywhere else on the site.

You can control or disable non-essential cookies through your browser settings. Disabling cookies may affect how the website functions. For more on how Google handles data, see Google’s privacy policy.

8. How AI is used (Halo)

We use AI (most notably Halo, our AI agent built on Anthropic’s Claude API) to make reporting and account management faster and more useful. Specifically, Halo:

• writes your scheduled performance report from your connected analytics, advertising and SEO data, judged against the goals your account manager has recorded for you;
• answers questions you ask in the “Ask Halo” chat panel in your portal, using the same data your latest report was written from;
• scores incoming referrals 0–100 for fit and drafts a first outreach email to the referred prospect (your account manager reviews and edits before sending — nothing is sent automatically);
• tags Pulse survey comments with sentiment and theme labels to help our leadership team spot patterns across clients;
• assists our team inside our own business systems — AI tools can read, draft, file and share in our own email, calendar and document accounts, which naturally include correspondence with you and files about your account. That includes reading the files you attach to an email, saving one into your project folder, and creating and sharing that folder with you. Any email drafted this way is reviewed and approved by a person at Whitehat before it is sent, and the same no-training commitment applies;
• drafts proposed copy for your website and replacement ads for your advertising accounts, from your existing pages and ads and the search and advertising data behind them; drafts wait unpublished or switched off until a person at Whitehat Agency reviews them and puts them live;
• reads the emails that reach our shared agency inbox each day, picks out the ones that need our attention, and writes a one- or two-sentence summary of each for our team in our internal Slack workspace; the emails themselves stay in our inbox;
• writes the questions for an AI Search Score’s fuller report from the business’s public website, and reads the answers to record which businesses they name;
• answers our team’s questions about the accounts we manage, in the portal and in our internal Slack workspace, using the same data and the same access limits as the rest of the portal, so an account manager’s questions reach only the clients they work on.

9. AI safeguards

You should know:

• AI outputs are advisory — a person at Whitehat reviews and is responsible for material decisions that reach you (proposals, contracts, outreach to referred prospects, scope changes);
• Anthropic does not train its models on data submitted via the Claude API under their commercial terms;
• you can ask us to disable AI-generated content for your account at any time — email hello@whitehatagency.com.au;
• Halo’s context is limited to your own data — it does not share your numbers, goals or notes with any other Whitehat client.

10. Direct marketing

We may send you marketing communications (such as our newsletter, relevant case studies or service updates) where you have opted in, or where you are an existing contact and we are permitted to under the Spam Act 2003 (Cth).

Every marketing email includes an unsubscribe link, and you can opt out at any time by using that link or by emailing us at hello@whitehatagency.com.au. We will action your request promptly. Every email we send you before you become a client (our first reply to your enquiry, our follow-ups, AI Search Score emails, the pre-call form and proposals) carries the same link and, where it goes to you alone, works with your mail app’s own unsubscribe button. One unsubscribe stops all of them and takes you off our newsletter, and we keep a record of the address and when it unsubscribed so it stays that way. Unsubscribing from marketing does not stop transactional or service emails (such as your scheduled performance reports, monthly hosting reports or billing notifications) — those continue while you are an engaged client.

11. How we hold and protect your information (APP 11)

We hold personal information in secure systems and take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. The specific measures we use include:

• Encryption in transit — TLS 1.3 is enforced on every request to our website and portal (HSTS with includeSubDomains and preload).
• Encryption at rest — our database (Supabase, Sydney) encrypts stored data at rest.
• Authentication — portal access uses magic-link sign-in (no passwords for clients), with multi-factor authentication available for agency staff accounts.
• No password collection — we never ask for, collect or store the password to any of your accounts, and our setup checklist refuses one if it is pasted in. Access to your platforms is granted to our agency accounts instead (for example, adding our team as a user in Google, linking via our Google Ads manager account, or partner access in Meta Business Manager). Where we build or maintain your WordPress website, the site issues us its own application password — a dedicated key that is not your login, that you can revoke yourself at any time from your website’s admin, and that we hold in our hosting platform’s encrypted configuration rather than in our database. Where we work on your Shopify store, your store issues us an access key that we hold the same way, and where your website’s content is managed in Sanity, your project issues us an access token, held in our database where only our own servers can read it.
• Row-Level Security — our database enforces per-client isolation at the database layer, so one client cannot read another’s data even if other controls fail.
• Secure links — where we send you a page that needs no sign-in (your setup checklist, a card-details link, a shared report, your referral page or a proposal), the link contains a long random token that acts as the credential and is the only way to reach that page. Each token is tied to your account alone and can be reissued or revoked by us on request — please treat the link as private and tell us if one is forwarded or exposed. These pages are kept out of search engines, and the token is removed from our analytics.
• Audit logging — sensitive administrative actions (status changes, content edits, report generation) are logged with the actor and timestamp.
• Geo-fencing — public contact and application forms only accept submissions originating in Australia or New Zealand, reducing offshore spam and abuse vectors. The AI Search Score check is open to visitors from anywhere and is protected instead by limits on how often it can be run.
• Input validation — every form submission is server-validated; file uploads (job application résumés) are content-sniffed to confirm file type, not just trusted on the browser-supplied MIME header.
• Vulnerability disclosure — security researchers can contact us via /.well-known/security.txt.

12. Security — what you should know

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. You play an important part too: keep your portal sign-in email private, sign out from shared devices, and tell us straight away if you suspect any unauthorised activity on your account.

13. Notifiable Data Breach scheme

If a data breach is likely to result in serious harm to individuals whose personal information is involved, we will notify those individuals and the Office of the Australian Information Commissioner as soon as practicable, as required by the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

14. Requests from public authorities

If a government agency or public authority requests personal information we hold, we follow a set process:

• we review the legality of every request before acting on it;
• we challenge requests we consider unlawful;
• we disclose only the minimum information necessary to comply with a valid request; and
• we document every request, our legal reasoning and our response.

15. When our engagement ends

When you stop working with us, your accounts and your data stay yours. We run a standard offboarding process, and you do not need to ask for it:

• We stop your advertising spend first — any live campaigns we manage are paused immediately, so nothing continues to be spent while the handover is arranged;
• We withdraw our own access — we remove our team’s user accounts from your Google Analytics, Google Ads (including unlinking your account from our Google Ads manager account), Google Search Console, Google Business Profile, Google Tag Manager and, where we host or maintain your website, your WordPress site. Where a platform has no way for us to do this ourselves (for example Ahrefs, Bing Webmaster Tools or Meta), we tell you so it can be actioned;
• We will not lock you out — if removing our access would leave your account with no administrator or owner at all, we stop and ask you to add your own first. We will never remove ourselves in a way that leaves you unable to reach your own property;
• You can ask for a handover summary — the platform accounts and property identifiers we held for you, the reports we produced, and the changes we applied to your advertising account. Email hello@whitehatagency.com.au and we will provide it;
• Your account record is deactivated, not deleted — we keep your client record, reports and our audit history for the retention periods set out below, because we are required to retain financial and business records and may need them to answer questions about the work we did. You can still ask us to delete personal information, subject to those obligations (see “Accessing and correcting your information”).

16. How long we keep it

We keep personal information only for as long as we need it for the purposes described in this policy, or as required to meet legal, accounting, billing or reporting obligations (typically 7 years for financial records under Australian tax law).

• Active client data — retained for the duration of our engagement plus 7 years for tax and audit purposes;
• Lead and enquiry data (including AI Search Score checks, any pre-call form answers and the notes taken on a call) — kept until you ask us to delete it (see “Accessing and correcting your information”);
• Enquiries submitted through lead ads we run for a client — the enquirer’s details stay with Meta and the client, and our systems keep none of them. What we keep is how many enquiries an advertisement produced, which identifies nobody;
• Job application data — retained for up to 12 months after the role is filled or withdrawn, unless you ask us to delete it sooner;
• Performance reports and analytics caches — retained for the duration of our engagement and a reasonable period after for reference;
• Audit logs — retained for at least 12 months for security and accountability purposes.
• Offboarding records — when an engagement ends we keep a dated record of the offboarding itself (your business name, the reason given for the engagement ending, and which platforms our access was withdrawn from and when), retained for 7 years alongside our financial records.

17. Accessing and correcting your information (APP 12 and APP 13)

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. You can also request that we delete personal information about you, subject to our legal obligations to retain certain records.

To make a request, email us at hello@whitehatagency.com.au. We will respond within a reasonable time (generally within 30 days). There is generally no charge for making a request, though we may charge a reasonable fee for giving access in some circumstances. We may need to verify your identity before acting on a request.

If you are an active client, much of your personal and account information is also available directly in your portal under Settings.

18. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact us first at hello@whitehatagency.com.au so we can try to resolve it. We will acknowledge your complaint and respond within a reasonable time.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

19. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal information from children under 16. If you believe we have, please contact us and we will delete it.

20. Third-party links

Our website and portal may contain links to third-party websites and tools. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing them with any personal information.

21. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, the services we offer, or our legal obligations. The current version will always be available on this page, with the “last updated” date shown above. Significant changes will be made prominent where appropriate (for example, by notifying portal users by email or by an in-portal banner).

22. Contact us

For any privacy question or request, contact us:

Whitehat Agency (484 Digital Pty Ltd, ABN 81 651 974 006)
136 Epsom Rd, Zetland NSW 2017, Australia
Email: hello@whitehatagency.com.au
Security disclosures: security@whitehatagency.com.au
Phone: 1800 465 300