Privacy policy
1 Who we are and how to contact us
Agensio is a product of Hustle Holdings Pty Ltd, ABN 69 159 750 722, referred to in this policy as “Agensio”, “we”, “us” and “our”. Our website is getagensio.com.
For privacy questions, access or correction requests, deletion requests or complaints, contact our Privacy Contact at support@getagensio.com. Our postal address is 1/43 Crescent St, Rozelle NSW 2039. Please do not include identity documents, passwords or payment-card details in an initial email.
This policy explains our handling of personal information through our website, enquiries, client portal and marketing services. Personal information includes information or opinions about an identified person or a person who is reasonably identifiable. It can include business contact details, online identifiers and inferences about a person.
We distinguish information used to run our own business from information we handle for a client about that client’s customers, prospects or other people. The client’s own privacy notices also apply to its collection and use of that information. This policy does not replace the service agreement or any agreed data-processing terms, or remove obligations that apply to us under privacy law.
2 Enquiries and our business relationships
When you enquire or request a strategy call, we collect the information you provide. This can include your first and last name, work email, phone number, business name and type, preferred tier, goals, current advertising-spend range, campaigns, preferred start time and additional notes. We use it to assess your enquiry, respond, arrange a call and discuss suitable services.
Where lawful and practicable, you may deal with us anonymously or using a pseudonym. We need sufficient contact details to respond to an enquiry, and accurate account, authority and billing information to provide services. If necessary information is not provided, we may be unable to complete the relevant request or service.
When you become a client, use the portal or contact us for support, we may also collect:
- Your role, organisation, account and workspace identifiers, authorised-user details and communication preferences.
- Agreements, approvals, instructions, service requests, correspondence, support records, meeting notes and deliverables.
- Billing contact information, invoices, transaction and subscription records, payment status and payment-method references or limited card details, such as card brand, expiry and last four digits.
- Connection records, including account names and identifiers, permissions granted, connection status and authentication information needed to maintain authorised integrations.
- Technical and activity records needed to operate the service, investigate faults and protect accounts, including relevant logs and audit records.
Payments are handled through Stripe. Stripe collects and processes the card payment. We store a Stripe customer identifier, a payment-method identifier, the card brand, the expiry and the last four digits. We do not store the full card number or the card security code. Do not send full card numbers or card security codes to us by email, chat, support request or file upload.
We use these records to deliver and administer the agreed service, manage access and approvals, provide support, reconcile fees, keep appropriate business records, investigate misuse and meet legal obligations. Information is not collected merely because it might be useful for an unspecified future purpose.
3 Identity checks and meeting recordings
Identity checks
Identity-document checks form part of our onboarding process. Before a check, we explain why it is requested, which information is needed, who receives it, the consequences of declining and any available alternative.
The check uses Stripe Identity. It is a document check to confirm the identity of the person opening the account before services start. Stripe collects the identity document and runs the check. We store the Stripe verification session identifier and whether the check succeeded. We do not store a copy of the identity document. If the check does not succeed, you can try again. If you decline the check, we cannot complete that onboarding step. If Stripe’s verification step asks for a selfie or a biometric comparison, that request happens in that step.
Any required consent for biometric verification is requested separately at the verification step. Agreement to this policy is not consent to biometric processing. Identity documents should be supplied only through the designated verification process, not through ordinary enquiry forms, chat or email.
Calls and meetings
We use call or meeting recordings and transcripts to keep an accurate account of discussions, agreed instructions, decisions and action items. These records may include your name, voice, image, contributions, shared content and information you choose to discuss. We explain when recording or transcription will occur and obtain any consent required before it starts.
A recording or transcript is not guaranteed. If you do not want to be recorded, tell us before recording starts and we will continue the meeting without recording you.
A client arranging a meeting must help ensure all participants receive the relevant notice. We remain responsible for the obligations that apply to our recording and use of the material.
4 Information handled for clients
For a client’s agreed marketing services, we handle relevant information supplied by the client, its authorised users or connected accounts. The scope depends on the service and permissions agreed with that client. It can include:
- Customer or prospect names, business and contact details, customer identifiers, CRM records, deal stages, enquiries and communication history.
- Customer-list and audience records, segmentation, marketing-consent evidence, unsubscribe preferences and suppression records.
- Advertising-account identifiers, campaign settings, audiences, spend, performance and attribution information.
- Conversion events, website or campaign interactions, leads, purchases, order values, revenue and related identifiers used to understand campaign results.
- Photos, video, audio, testimonials, brand assets and other content containing identifiable people.
We use this information to carry out the agreed campaign, CRM, content, measurement or reporting work and related support. Where a service involves uploading customer lists, audience matching, retargeting, conversion tracking, email or SMS, the relevant account, purpose, fields and recipients must be agreed before that activity begins. Hashing a contact identifier does not necessarily make it anonymous.
Clients are responsible for having authority to provide the information and for the notices, permissions and consents required for their proposed marketing activities. The presence of a person in a CRM or customer list does not, by itself, establish permission to market to them. We handle client information within the agreed instructions and applicable law. Any separate use for Agensio’s own purposes requires its own lawful basis and appropriate transparency.
People whose information comes from a client can contact that client about its marketing and records. They can also contact us about our handling of their information. We may need to coordinate with the client to identify and respond to the request, while meeting any obligations that apply directly to us.
5 AI assisted services
Agensio uses AI services including Claude, ChatGPT and xAI/Grok to assist its human-led marketing work. An Agensio Team Member directs the work, reviews outputs and approves work before it is launched.
Depending on the agreed task, AI assistance can involve drafting or editing content, summarising material, analysing campaign information and preparing recommendations. Personal information contained in material submitted to an AI service, and personal information generated in its output, is covered by this policy.
Authorising AI assistance for an agreed service does not, by itself, authorise general-purpose model training using identifiable client or customer information. Any such use must meet the separate authorisation requirements in our service terms and applicable law.
For an agreed task, the personal information sent to Claude, ChatGPT or xAI/Grok can include details in briefs, campaign information, customer or prospect records, and content you supply. It is used for the drafting, editing, summarising, analysis or recommendations described above. Sending that material is not permission to train a general-purpose model on identifiable client or customer information.
AI-generated statements and inferences may be inaccurate. You can ask us to review or correct personal information in an output using the contact details above. Human review does not remove the need to assess and explain how an AI system uses personal information.
Stripe Identity makes an automated assessment of whether the document check succeeds. That outcome completes the identity step of onboarding or leaves it incomplete. It does not decide marketing eligibility or whether a client’s customer is contacted. You can ask us to review the outcome, and you can retry the check.
6 Who receives personal information
We disclose relevant personal information where needed for the purposes described in this policy to:
- The Agensio Team Members and other authorised personnel working on the matter.
- Providers of hosting, storage, authentication, email, payment processing, identity verification, communications, recording, transcription, AI and other tools used to deliver the service.
- Advertising, analytics, CRM, email, SMS and collaboration platforms involved in the client’s agreed services or accounts the client has authorised us to use.
- The client and its authorised users, where information forms part of that client’s service records or deliverables.
- Professional advisers, regulators, courts or other recipients where disclosure is required or permitted by law for a relevant purpose.
For our own systems, those providers currently include Stripe for payments and identity checks; Amazon Web Services for sign-in, email, file storage and hosting, with sign-in and file storage configured for Sydney; MongoDB for the application database; Google Tag Manager for website measurement after you accept optional tracking; Slack for workspace communication where a workspace uses it; and Anthropic, OpenAI and xAI for the AI services named in this policy.
Some platforms also handle information for their own purposes under their own terms and privacy notices. The permissions you grant to a platform, and its handling of information, are separate from Agensio’s obligations. We do not treat a client’s authorisation to connect one account as unrestricted permission to access unrelated accounts or disclose unrelated information.
7 Overseas handling
Our team is based in Australia. That does not mean all information is stored or processed only in Australia. Cloud, AI, communications, payment and other providers may handle information overseas, including through their support personnel or subprocessors.
Stripe, Google, Slack, Anthropic, OpenAI and xAI are based in the United States and may handle information outside Australia. Amazon Web Services sign-in and file storage are configured for Sydney.
Where Australian privacy law requires it, we take reasonable steps before an overseas disclosure to ensure the recipient handles the information consistently with the applicable Australian Privacy Principles, unless a lawful exception applies. This policy does not ask you to waive protections for overseas disclosures.
8 Cookies and website measurement
We use cookies and similar technologies for website functions and, when you accept optional tracking, website and advertising measurement. Our consent-choice cookie, agensio_consent, records acceptance or rejection for up to one year. Portal cookies also support sign-in and workspace functions where those features are used.
The website loads Google Tag Manager, container GTM-5BC95GW2, after optional tracking is accepted. That container includes a Google measurement tag. After a successful strategy-call submission with tracking accepted, the website makes a lead event named generate_lead available to that tag-management system. The event includes the email, first name, last name and, when you supplied one, the phone number in international form, together with the form type, Contact Form, and the button used. We do not hash those fields before the event is made available. Google’s privacy policy is at https://policies.google.com/privacy.
If you reject optional tracking, the strategy-call form still sends your enquiry to Agensio so we can respond, without adding that optional lead event. To reset the current website’s recorded choice, clear this site’s cookies and reload the page, then make a new choice. This does not remove information already sent to a third party. Your browser may also let you block or remove cookies; doing so can affect sign-in and other functions.
9 Marketing choices
We respond to enquiries and send communications needed to provide requested services. If we send separate promotional emails or SMS, we do so only where permitted by applicable law and provide a way to unsubscribe. You can also contact support@getagensio.com to ask us to stop direct marketing to you.
An unsubscribe request does not prevent necessary service or transaction messages. We may retain the minimum suppression information needed to respect your preference. For marketing sent on behalf of a client, use the unsubscribe method in the message or contact the identified client; you can also raise a concern about Agensio’s involvement with us.
10 Security and information quality
We hold electronic records in our business systems and in the systems of providers described above.
We take reasonable technical and organisational steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. The measures must be appropriate to the information and risks involved. No system is completely secure.
Please help us keep relevant contact details and instructions accurate, and report suspected unauthorised access to support@getagensio.com. Do not put passwords, full payment-card details or identity documents into ordinary service requests or materials intended for AI assistance.
If a data breach occurs, we assess and respond to it and notify affected people and regulators where legally required. We also address notification and cooperation obligations under applicable client agreements.
11 Retention and deletion
We retain personal information for as long as it is needed for the purposes for which it may lawfully be used, including providing services, keeping required records and handling genuine disputes. Different information may need different retention periods. Where applicable law requires it, we take reasonable steps to destroy or de-identify information that is no longer needed, unless retention is required by law or a court or tribunal order.
You can ask us to delete information or close an account. We assess the request against applicable law, the client’s instructions where relevant and any continuing lawful need to retain particular records. We explain any material limitation that applies. Deletion of a working record may not immediately remove a copy from a backup or from a platform that keeps information under its own obligations.
Disconnecting an integration, cancelling a service and requesting deletion are separate steps. You can revoke permissions through the connected provider and contact us to coordinate disconnection, account closure and any return or deletion of client information. Disconnection does not automatically erase information already collected, published or held by third-party platforms.
12 Access and correction
Contact support@getagensio.com to request access to personal information we hold about you or to ask us to correct it. Tell us enough to locate the relevant information. We may take proportionate steps to verify your identity or your authority to act for another person. Please do not send extra identity information unless we explain what is needed and how to provide it securely.
We respond within the period required by applicable law. For Australian access and correction requests, we aim to respond within 30 calendar days and will explain if more time is needed. There is no charge for making a request or correcting information. If a permitted charge for providing access is proposed, we explain it before proceeding.
If we refuse access or correction where the law allows, we give the required reasons and complaint information. You can ask us to associate a statement of disagreement with information we decline to correct. Where applicable, you can also ask us to notify other recipients of a correction. Other rights may apply under laws relevant to your circumstances; contact us to discuss them.
13 Complaints
If you believe we have mishandled personal information, contact our Privacy Contact at support@getagensio.com. Describe what happened, the relevant dates and the outcome you are seeking. We review the complaint, make appropriate enquiries and aim to respond within 30 calendar days. If we need more time, we explain the reason and expected next step.
If you are not satisfied with our response, or have not received a response within a reasonable time, you may be able to complain to the Office of the Australian Information Commissioner. Information is available at https://www.oaic.gov.au/privacy/privacy-complaints or on 1300 363 992. Other regulators or complaint rights may apply depending on the circumstances.
14 Changes to this policy
We update this policy when our practices or relevant requirements change and show the effective date at the top. Where a change requires a new notice or consent, publishing revised wording alone does not replace that requirement. Contact us if you need this policy in another accessible format.