Privacy and data security

1. Introduction

GRIVITY Pty Ltd (ACN 672 078 885), trading as GRIVITY (“we”, “us”, “our”), is committed to protecting your privacy. We are an Australian-based digital growth firm bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains how we handle personal information collected through our website, our client applications and our automation and communication services.

This policy covers GRIVITY’s own handling of personal information. Where we build systems for clients, such as AI voice agents or automations, those systems handle data on the client’s behalf under our written agreement with that client, and the client’s own privacy policy applies to the people they serve.

2. Information we collect

We collect information to respond to your enquiries and design effective growth systems for your business. This includes:

• Identity data: Name, job title, company name.
• Contact data: Email address, phone number and billing address.
• Enquiry and booking data: The details you provide in contact forms and appointment bookings, including your message and preferred times.
• Call data: When you phone us, our telephony provider logs the call details (your phone number, and the time and duration of the call).
• Technical data: IP address, browser type, time zone setting and operating system.
• Usage data: How you interact with our website (such as pages viewed and clicks), measured using Google Analytics.
• Integration data: Performance metrics, campaign data and account information retrieved from connected third-party platforms at the user’s request.

3. How we use your data

We use your information to:

• Respond to your enquiries and schedule and confirm appointments.
• Deliver contracted services (e.g., building your web app).
• Configure automation workflows and CRM pipelines.
• Improve our website performance using anonymous analytics.
• Provide relevant technical updates or marketing communications (you can opt out at any time).

4. AI and automation data handling

We use artificial intelligence (AI) and automation to deliver and support our services. We do this carefully:

• Which AI we use: We use Google’s Gemini models through an enterprise Google Cloud environment, with primary processing configured to an Australian region. This is not the public Gemini service.
• No training on your data: Your data is processed under enterprise terms and is not used to train public AI models.
• Security: Data is encrypted in transit and at rest using enterprise-grade standards (AES-256).

5. Website enquiries and bookings

When you send an enquiry through the form on our website, we receive it by email so we can reply to you.

• What the form collects: Your name, email address, phone number, company, website, the service you’re interested in and your message. With your enquiry, your browser also sends how you reached our site in that visit: the first page you opened, the website that linked you to it, and any campaign tags in its address (such as utm_source or a Google Ads click ID).
• Delivery: Your enquiry is sent to our inbox through Resend, an email delivery service that processes it on our behalf. Resend may store message data outside Australia, including in the United States (see section 7).
• Measurement: When an enquiry is sent, we record in Google Analytics that it happened and which service was selected. Google Analytics receives no contact details or message content.
• Advertising measurement: When an enquiry is sent, a hashed form of the contact details you provided (your name, email address and phone number) is sent to Google Ads so we can measure which advertising leads to enquiries. Hashing turns each detail into a one-way code in your browser before it is sent; the original can’t be recovered from it. Your message is never sent.
• Bookings: If you book a time through our booking link, the booking is made in Google Calendar (Google Workspace), and Google sends the confirmation.

We use enquiry details to respond to you and to discuss any work you ask us about. By sending an enquiry, you consent to us contacting you about it by email or phone.

6. The client dashboard app and platform integrations

Clients may be given access to a reporting dashboard (“the App”) that shows their campaign data. Users may connect third-party platform integrations to supply the data for those reports.

Authentication:

• Users may sign in to the App with Google Sign-In or with an email address and password. Through Google Sign-In we receive your name and email address, which we use for authentication only.

Optional platform integrations:

Users may optionally connect the following platforms to unlock additional App features. Each integration is authorised separately and only activated at the user’s explicit request:

• Google Ads: Used to retrieve campaign performance data for reporting within the App.
• Google Analytics: Used to retrieve website traffic and conversion data for reporting within the App.
• Google Search Console: Used to retrieve organic search performance data for reporting within the App.
• Google Business: Used to retrieve local listing data and review information for reporting within the App.
• Meta (Facebook/Instagram): Used to retrieve ad account performance, page insights and lead data for reporting within the App.

For all integrations:

• We only request the minimum permissions necessary to deliver the features described above.
• We do not sell, share or use platform data for advertising or to train AI models.
• Our use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements.
• Users may disconnect any integration at any time via the App’s settings page, which will revoke our access to that platform’s data.

7. Sub-processors and overseas disclosure

We do not sell your personal information. To deliver our services we rely on a small number of trusted sub-processors. Specific vendors may vary by project, but typically include:

• Cloud infrastructure and AI: Google Cloud, including Google’s Gemini models via enterprise API, with primary processing in an Australian region.
• Email and SMS delivery: Resend, which delivers website enquiries to our inbox, and providers used to send confirmations and transactional messages.
• Scheduling: Google Workspace (Google Calendar).
• Telephony: Twilio, which routes calls to our phone line and logs call details (phone number, time and duration).
• Automation and CRM: Tools used to orchestrate workflows and manage client communications.
• Analytics and advertising: Google Analytics, which measures how our website is used, and Google Ads, which measures which advertising leads to enquiries (see section 5). Google may store data from Google Analytics, Google Ads and Google Workspace outside Australia, including in the United States.

Overseas disclosure: While our primary data processing is located in Australia, some of our providers are located in or store data in the United States. By using our services or submitting your information, you consent to your personal information being disclosed to these overseas recipients. We take reasonable steps to ensure they handle your information in a manner consistent with the Australian Privacy Principles.

8. Cookies and tracking

We use cookies and Google Analytics (via Google Tag Manager) to understand how visitors use our website. You can control cookies through your browser settings, though this may limit site functionality.

9. How long we keep your data

We keep personal information only for as long as we need it:

• Enquiry and booking data: up to 24 months after our last contact with you, unless you ask us to delete it sooner.
• Client records: for the duration of our engagement and for any period we are required to retain them by law (for example, financial records).

When we no longer need your personal information, we delete or de-identify it.

10. Your rights and how to complain

You can ask us to access, correct or delete the personal information we hold about you, or to stop sending you communications, at any time by emailing contact@grivity.com.au. We will respond within a reasonable time.

If you are concerned about how we have handled your personal information, please contact us first so we can try to put it right. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Contact us

Questions about this policy can be directed to our Privacy Officer at contact@grivity.com.au.