Privacy Policy

Macleodglba Pty Ltd trading as TheAgencyIQ (ABN 79 664 444 384) ("we", "us", "our") protects your privacy. This Policy explains how we collect, use, disclose, store and manage your information when you use theagencyiq.ai or our Services.

We comply with the Australian Privacy Act 1988 (Cth), Australian Privacy Principles, Notifiable Data Breaches scheme, and Australian Consumer Law. We align with GDPR and CCPA where applicable.

By using our Services you consent to this Policy.

1. Information We Collect

We collect only what is necessary:

• Personal information — name, email, phone, billing details (Stripe processes payments; we never store full card data).
• Social media data — profile IDs, usernames, encrypted access tokens, and post performance metrics when you connect platforms.
• Usage data — IP address (approximate location), device and browser information, interaction logs.
• Content you provide — brand purpose, AI prompts, generated posts and videos, schedules, preferences.

We do not collect sensitive information unless you explicitly enable a feature and consent.

2. How We Collect It

• Directly from you (account creation, platform connections, uploads).
• Automatically (cookies, logs).
• From connected platforms via secure OAuth (with your permission only).

3. How We Use It

• Deliver and personalise the Services (content generation, scheduling, publishing, closed-loop learning).
• Process billing.
• Provide support and security.
• Meet legal obligations.

We do not use your data for automated decisions with legal or significant effects without your consent or human oversight.

AI and closed-loop learning: With your explicit consent via the learning toggle, we use performance data from your published posts to create a simple report. This report shows how well your Brand Purpose is performing in the real world. We then use these insights to refine how your Brand Purpose is interpreted and expressed in future content and scheduling recommendations. This consent is granted automatically on signup via our Terms and Conditions and may be managed or revoked at any time in Profile → Data & Privacy.

We act as your authorized digital agent. Just as a human strategist would review your results and refine your Brand Purpose strategy, we automate that process continuously and transparently using only your own data.

No Instagram data is used to train general AI models or shared across users. All AI-generated content (via xAI Grok) is based exclusively on your brand purpose, prompts, and approved content.

4. Platform Integrations

We use secure OAuth and request only the minimum scopes required. Tokens are encrypted at rest and in transit. You can revoke access anytime via platform settings or our in-app agent — we immediately deactivate tokens and delete associated data within 30 days.

Instagram — We request instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights, instagram_business_manage_comments (only when you enable automated support), and instagram_business_manage_messages (only when you enable messaging). We access profile data, media, performance metrics, and comments/DMs solely to enable scheduling and publishing you have approved.

LinkedIn — We access your profile and Company Pages you administer solely to publish content you have reviewed and approved.

X (Twitter) — We request read/write access and offline access (long-lived tokens) solely to publish posts you have reviewed and approved. We delete X content within 24 hours upon your request, per X Developer Guidelines. We do not train AI models on X data.

Facebook & YouTube — Publish to Pages/channels you manage and read basic metrics.

All platform integrations are designed to give you full control. Your first schedule is generated in AUTO mode by default (the waterfall). You can switch to MANUAL mode at any time after the initial posts are created. Nothing is published without your review and approval, or your explicit choice to remain in AUTO mode.

5. Google User Data & OAuth (Google Auth Platform / YouTube)

When you connect a Google account (YouTube channel publishing or Google Sign-In), we request only the minimum OAuth scopes required for the Service. We access and store:

• Your Google account ID, email, and YouTube channel identifiers (encrypted at rest and in transit).
• Long-lived access tokens (never shared except with the Google APIs we call on your behalf).

We use this Google user data solely to:

• Enable publishing of content you have reviewed and approved to your YouTube channel.
• Provide closed-loop learning and performance insights for your brand.

We do not transfer Google user data to any third party for any reason other than providing or improving the AgencyIQ Service. Google Analytics is used only for anonymous website usage analytics (no personal or Google OAuth data is sent to Google Analytics). All Google user data is deleted within 30 days of account deletion or platform disconnection.

6. Sharing and Disclosure

We never sell your data. We share only with:

• Service providers (Stripe, Neon, xAI, ElevenLabs, Sentry, Twilio, SendGrid, Google Analytics) under strict contracts that require them to protect your data and use it only to provide services to us. These providers may engage their own subprocessors (including in the locations listed below) subject to equivalent confidentiality and data protection obligations.
• Meta, LinkedIn, X — solely to enable publishing of content you have reviewed and approved (including automatic publishing when AUTO mode is enabled).
• As required by law or in business transfers (with notice).

International transfers of personal data may occur to the United States, European Economic Area, United Kingdom, India, and the Dubai International Financial Centre (DIFC). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognised under applicable data protection laws.

7. SMS Communications

SMS Communications. When you create an account on TheAgencyIQ, you provide your mobile phone number and consent to receive SMS messages from us. These messages include: (a) a one-time verification code to confirm your identity during sign-up, and (b) occasional account notifications if a connected social media platform requires re-authorisation. We do not send marketing, promotional, or advertising messages via SMS. Your phone number is stored securely and is never shared with third parties for marketing purposes. You may withdraw your consent at any time by replying STOP to any message, or by contacting us at support@theagencyiq.ai. Replying HELP returns support information. Message frequency varies. Your consent timestamp is recorded and included in any data export you request under our data portability obligations.

8. Security

We use encryption (TLS in transit, AES-256 at rest), access controls, monitoring, and regular audits. In the event of an eligible data breach we notify you and the OAIC as required.

9. Data Retention and Deletion

We keep data only as long as needed for the Services or legal obligations.

• Account deletion removes all personal data, connections, content and analytics within 30 days (encrypted backups destroyed after 90 days).
• Platform disconnect revokes tokens immediately.

10. Your Rights

All data rights are exercised directly in the agent:

• Go to Profile → Data & Privacy
• Use the self-service tools to access, correct, delete, or restrict your data instantly.

Platform disconnect and full account deletion are available 24/7 with no human interaction required. We process all requests immediately and confirm completion in-app.

11. Cookies

Essential cookies enable the Service. Analytics and marketing cookies are optional — manage via our consent banner or browser settings.

12. User Eligibility

Services are for users 18+ operating business social accounts.

13. Changes

We may update this Policy from time to time. The current version is always published on this page, and the Effective Date, Last Updated date and version number above will be revised whenever changes are made. Material changes (including the addition of new service providers or new countries where personal data may be processed) will be posted on this page at least 30 days before they take effect.

You are responsible for reviewing this Policy periodically to stay informed of any updates. Your continued use of the Services after an updated Policy takes effect constitutes your acceptance of the revised Policy. If you do not agree with a change, you should stop using the Services and may delete your account and data at any time via Profile → Data & Privacy.

14. Contact

support@theagencyiq.ai
Macleodglba Pty Ltd trading as TheAgencyIQ
Queensland, Australia