legal / privacy
Privacy Policy
Last updated 1 October 2026
This policy explains what personal information MD Media collects, why we collect it, who we share it with, how long we keep it, and how you can see, correct or delete it. We have tried to write it in plain English. If anything is unclear, email hello@mdmmarketing.com.au.
1. Who we are
MD Media Marketing Pty Ltd (ABN 75 681 730 512), trading as MD Media (“MD Media”, “we”, “us”), is a social media and content marketing agency based in Melbourne, Australia. Our address is Unit 56/23 Chambers Rd, Altona North VIC 3025.
This policy covers our website mdmmarketing.com.au, our client and team app at app.mdmmarketing.com.au, and the social media work we do for our clients. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Contact for anything in this policy: hello@mdmmarketing.com.au.
2. What we collect, and why
What we hold depends on how you deal with us. Each group below says what we collect, where it comes from, and what we use it for.
Visitors to our website
- We use Microsoft Clarity on the public marketing pages to understand how visitors use the site (pages viewed, clicks, scrolling, device and browser type). Clarity uses cookies. It is switched off on the signed-in app, the client portal and our intake forms.
- Our hosting provider keeps standard server logs (such as IP address and the page requested) for security and troubleshooting.
People who contact us or book with us
- Contact and enquiry forms: your name, email, phone, business name, the service you are interested in, budget, timeline and your message. We use this to reply to you and to manage the enquiry as a sales lead.
- Newsletter and event sign-ups: your email address (and, for event invitations, your name and what you tell us about yourself), to send you what you asked for.
- Bookings: your name, email, phone, notes, the time you booked and payment status. Card payments are handled by Stripe; we never see or store your full card number.
- Emails to our business inboxes: we automatically scan new emails that arrive in our own business Gmail inboxes to find genuine business enquiries. The content of an email is sent to Anthropic’s Claude AI model, which decides whether it is an enquiry and pulls out the sender’s name, business, phone and the service they asked about. If it is an enquiry, we record it as a lead. We keep a log of each scanned email (sender, subject, date and the result) so the same email is never processed twice.
Businesses we are talking to about working together (prospects)
- We keep a record of prospective clients: business name, contact name and role, email, phone, website, public social media handles, notes, and the history of our conversations (for example when we reached out, when you replied, and when a call was booked).
- To keep that record up to date, an AI assistant (Anthropic’s Claude) reads the emails exchanged between you and our business inboxes and the Instagram direct messages exchanged between you and MD Media’s own Instagram accounts, and notes events such as a reply or a booked call. A person on our team can review and correct what it records.
- We may look up your business’s public Instagram profile (such as bio, follower count and recent public posts) through ScrapeCreators, a third-party data service, to prepare for a conversation with you.
- We never send an automated message to a prospect. Every message to a prospect is written or approved by a person.
Our clients and their teams
- Account and contact details: names, roles, email addresses and phone numbers of the people we work with, and your sign-in to our client portal (managed by Clerk).
- Brand and project information: your answers to our intake forms, brand guidelines, content plans, scripts, feedback, approvals and comments you leave on content.
- Files: photos, videos and documents you give us or that we produce for you. These are stored with Cloudflare (R2 storage and Stream video), and a copy of a large video may be processed by our video encoder (hosted on Fly.io) to fit a social network’s limits. We also read files from our own Google Drive.
- Logins you choose to share with us for your platforms are stored encrypted, and only the team members who need them can see them.
- Shoots: shoots we book with you are added to our Google Calendar.
- Other tools you connect: if you connect Linktree, we store the connection so we can update your links. We may track project tasks in Asana.
- We use this to deliver the services you engaged us for, to report on results, and to bill you.
Our clients’ connected social media accounts
When a client connects a social media account (for example Instagram, Facebook, LinkedIn or TikTok) so we can post and manage it for them, the connection is made through Zernio, a social media management service that acts as our processor. Zernio holds the access permissions; we store the account’s name, username, profile picture, platform, connection status and the account ID Zernio gives us.
- Posts: captions, images, videos, scheduled times, approval history and the published post’s link. We use this to schedule and publish the client’s content.
- Post performance: figures such as views, reach, likes, comments, shares and saves, to report results to the client.
People who comment on, message or follow our clients’ accounts
If you interact with a business we manage, we may process some information about you on that business’s behalf:
- Comments and direct messages. Our team reads and answers comments and direct messages sent to our clients’ accounts through Zernio. These are shown live and are not copied into our database in bulk. We keep a short note that a person was in touch: their username, display name, whether it was a comment or a message, and when. We do not keep the words of the message in that note.
- Comment-to-message automations. A client may switch on an automation for one specific post: if you comment a chosen keyword on that post, you receive a direct message (usually with a link) and a public reply to your comment. We keep a record of each one sent: your username and display name, your comment, the message we sent, and whether it was delivered. This record makes sure you are only ever messaged once per post. Nothing is sent unless a person switched the automation on for that post.
- Public post previews. To show a preview of a public Instagram post or video, we may fetch it through Apify (a third-party service) or Meta’s oEmbed service.
Our team
- Name, email, role, working hours and sign-in (managed by Clerk), and a record of work done in the app, so we can run our business and keep the app secure.
Emails we send
- The app sends service emails (for example that content is ready to approve, or a booking is confirmed) through SMTP2GO. We keep a log of each email sent: recipient, subject, content and delivery status, so the same email is not sent twice.
3. Why we are allowed to use it
We collect personal information only where it is reasonably necessary for our business and the services described above, and we use it for the purpose we collected it for, or a related purpose you would reasonably expect. In practice that means:
- You gave it to us (a form, an email, a booking) and asked us to act on it;
- To deliver a contract with our clients, including managing their social media accounts with their permission;
- Our legitimate business interests, such as following up a business enquiry or keeping the app secure; and
- Your consent, where the law requires it (for example our newsletter, which you can ask us to stop sending at any time).
When we process information about people who interact with a client’s social media account, we do so on that client’s instructions. If you are visiting from the European Union or the United Kingdom, the grounds above correspond to consent, contract and legitimate interests under the GDPR.
5. How long we keep it
- Client and project information: for as long as we work together, then for 7 years.
- Leads and prospects who do not become clients: 2 years after our last contact.
- Comment and automation records for a client’s account: while we manage that account, and deleted within 90 days after the client leaves us.
- Records of data deletion requests: kept so we can show the request was handled.
We do not yet delete data automatically on a timetable; a person on our team removes it. You can ask us to delete your information at any time (see below).
6. How we keep it safe
- The app is only available to signed-in team members and clients, or through private links we send to a client, and each person sees only what their role needs.
- Passwords and connection keys we hold are stored encrypted; social media access permissions are held by Zernio, not by us.
- All data travels over encrypted (HTTPS) connections.
- No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
7. Your rights: access, correction and deletion
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong or out of date;
- delete your information; or
- stop sending you marketing emails.
Email hello@mdmmarketing.com.au (for deletion, use the subject line “Data deletion”) or follow the steps on our data deletion page. We may need to confirm who you are before acting. We will respond within 30 days. If we cannot do what you ask (for example, because the law requires us to keep a record), we will tell you why.
If you are unhappy with how we handled your information, please tell us first so we can fix it. If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
8. Facebook, Instagram and other Meta platforms
Meta’s Platform Termsrequire us to explain how we handle information we receive from Meta’s platforms (“Platform Data”). Today our access to Facebook and Instagram is through Zernio; if we connect to Meta directly through our own app, this section applies in the same way.
What Platform Data we process
- For accounts our clients connect: the account’s ID, name, username and profile picture, and its connection status;
- the client’s own posts and their performance figures (views, reach, likes, comments, shares, saves);
- comments on the client’s posts and direct messages sent to the client’s account, including the sender’s username and display name;
- for comment-to-message automations a client switched on: the commenter’s username, display name, comment, and the message we sent them.
How and why we use it
- only to provide our social media management service to the client who connected the account: publishing their content, reporting on its results, and replying to comments and messages on their behalf;
- we do not sell Platform Data, use it for advertising profiles, or share it with anyone other than the processors listed in section 4 who help us provide the service.
How to ask us to delete your data
- Email hello@mdmmarketing.com.au with the subject “Data deletion” and your Instagram or Facebook username; or
- if you have used our app through Facebook, remove it in your Facebook settings (Settings & privacy → Settings → Apps and websites) and choose to send a deletion request. You will get a confirmation code you can check on our data deletion page.
A client can disconnect an account at any time, and we stop accessing it through Zernio from that point.
9. Children
Our services are for businesses, and we do not knowingly collect personal information from children under 16. If you believe a child has given us their information, contact us and we will delete it.
10. Changes to this policy
We will update this policy when what we collect or how we use it changes. The date at the top shows the latest version. If a change is significant, we will tell our clients directly.
11. Contact us
MD Media Marketing Pty Ltd
Unit 56/23 Chambers Rd, Altona North VIC 3025
Email: hello@mdmmarketing.com.au