Last updated: 2 August 2026
This Privacy Policy explains how ADME Advertising Pty Ltd (ABN 46 613 333 592), trading as XeroFlow ("we", "us", "our"), collects, uses, discloses, and protects personal information through the XeroFlow platform, its website tracking technology, CRM, and related services (collectively, the "Service").
XeroFlow acts as a controller (or equivalent entity under applicable law) for information about our own account users, website visitors, prospects, and business contacts where we determine why and how that information is processed. XeroFlow generally acts as a processor or service provider when a customer uses the Service to collect and manage dealership website interactions, enquiries, leads, CRM records, and related attribution data ("Customer Data"). In that case, the customer — usually the dealership or dealer group — controls the Customer Data and XeroFlow processes it on the customer's documented instructions.
Customers are responsible for ensuring they have an appropriate legal basis, displaying any required collection notice, and obtaining consent or providing an opt-out where required before sending Customer Data to XeroFlow. This policy supplements, but does not replace, the privacy notice that the relevant customer must provide at or before collection. If your information was collected through a customer's website or communications, you should first direct privacy requests to that customer; we will assist the customer in responding where required.
When an authorised user connects a third-party integration, we receive data from that service as necessary to provide the integration (for example, campaign spend data from Meta Ads, advertising lead data, invoice records from Xero, or customer communication data from an enabled provider). We may also receive Customer Data from dealer systems, form providers, webhooks, imports, and other services configured by the customer.
When a customer installs the XeroFlow tracking tag or connects a lead source, the Service may collect and process the following Customer Data, subject to the customer's configuration and the visitor's consent choices:
The standard form listener records form metadata and interaction events. It does not read form-field values unless the customer has separately enabled a supported lead adapter, provider integration, or other configured capture method for that form.
When an authorised user opens nearby dealership discovery, XeroFlow uses Google Maps and Places to preview or resolve a user-confirmed market location, display nearby dealerships, and retrieve a selected candidate's public website for agency review. Google may process the location, search area, IP address, device and request information under its own Privacy Policy.
Google-supplied names, formatted addresses, coordinates, distances, place types, map links, and website values are transient display data and are refreshed rather than retained by XeroFlow. We may persist the Google Place ID permitted for this purpose, user-confirmed address text, review decisions and actors, and an independently validated public domain only after explicit human approval. Raw Google Places responses are not stored in our databases, object storage, analytics, logs, AI inputs, or search indexes.
The Service is not designed to collect sensitive information through general website tracking. Customers must not configure forms, free-text fields, imports, or integrations to collect sensitive information unless it is necessary, lawful, and any required consent has been obtained. You may browse XeroFlow's public website without creating an account, but we generally need identifying information to provide an account, billing, support, CRM, or lead services. Website tracking initially uses pseudonymous identifiers, but those identifiers may become personal information when linked with an enquiry or other identifiable record.
Where applicable privacy law requires a lawful basis, we process personal information for which XeroFlow is the controller on the following bases:
Where XeroFlow acts as a processor or service provider, the customer determines the purposes and lawful basis for processing Customer Data. We process that data under our agreement with the customer and do not independently determine its use except where required to secure, maintain, or comply with law in relation to the Service.
We do not sell personal information or Customer Data for money. Customers may instruct the Service to send lead or conversion data to destinations they configure. Depending on the jurisdiction and the customer's advertising use, that activity may be regulated as targeted advertising, a disclosure, or "sharing" even where no money is exchanged; the customer is responsible for providing any required notice and choice.
We share personal information only where necessary and with appropriate safeguards:
We require service providers that process personal information on our behalf to protect it, use it only for contracted purposes, and maintain appropriate security measures. Third-party integrations selected by a customer may act under their own terms and privacy policies. Customers should review those terms before enabling an integration.
XeroFlow is operated from Australia. Our service providers are likely to process personal information in Australia, the United States, and other countries in which they operate. Those countries may have privacy laws that differ from the laws where you live. We take reasonable steps required by Australian Privacy Principle 8 before disclosing personal information overseas and use contractual and technical safeguards appropriate to the transfer. Where the GDPR or UK GDPR applies, we use an available lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, as applicable. Customers may also configure integrations that transfer Customer Data to countries chosen by them.
We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law:
We implement technical and organisational measures designed to protect personal information, including:
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
Required for the Service to function. These include session tokens for authentication (e.g. session_token, client_session_token) and CSRF protection. These cannot be disabled without impairing the Service.
Store your preferences such as colour mode, sidebar state, and notification settings.
We collect Service usage analytics to understand how the platform is used and to improve reliability and functionality. Analytics may include account, device, log, and interaction information described in Section 1.2. We do not sell this information for money.
On customer websites where the XeroFlow tag is installed, first-party cookies are used to create an anonymous visitor identifier for up to 365 days and a session identifier that is refreshed during activity and expires after approximately 30 minutes of inactivity. A consent-preference cookie may record a visitor's available choices. The tag may also read existing advertising identifiers such as Meta FBC and FBP cookies and capture advertising click identifiers from the page URL for campaign attribution. The exact technologies and events enabled depend on the customer's configuration.
Customers must configure the tracking tag and their website consent experience for the laws that apply to their visitors. Where a visitor records an available consent choice, XeroFlow uses that signal to govern event collection and configured advertising-platform delivery. Visitors should use the controls provided on the relevant customer's website or contact that customer to change their choice. Essential security and service events may still be processed where permitted by law. XeroFlow's general Privacy Policy is not a substitute for a customer's point-of-collection notice or cookie notice.
XeroFlow marketing communications provide an unsubscribe or preference-management method where required. You may also object to our use of your information for direct marketing by contacting privacy@xeroflow.io. Service, security, account, and billing messages are transactional and may still be sent while you use the Service. Customers are responsible for marketing communications they send using or following data processed through XeroFlow; recipients should use the unsubscribe method in the communication or contact the relevant customer directly.
XeroFlow includes AI-powered features that process your data:
AI features process your data only in the context of your organisation. Your data is not used to train general-purpose AI models and is not shared across organisations. Controlled CRM retrieval records privacy-safe operational evidence; source records and confirmed vectors follow the applicable retention and legal-hold rules, and erasure is not reported complete until confirmed erasure covers both database and provider state. No automated decision-making with legal or similarly significant effects is performed without human oversight.
Depending on your jurisdiction, you may have the following rights regarding your personal information:
For information XeroFlow controls directly, contact us at privacy@xeroflow.io. We may need to verify your identity and authority before completing a request. We will respond within the timeframe required by applicable law and will explain if an exception applies.
For Customer Data collected through a dealership website, lead source, CRM, or customer communication, please contact the relevant customer first. The customer controls that data in most cases, and XeroFlow will assist the customer with access, correction, deletion, portability, restriction, or objection requests as required by our agreement and applicable law.
If you have a privacy complaint, email our Privacy Officer with enough information for us to investigate. We will acknowledge the complaint, investigate it fairly, and provide a written response within a reasonable period, generally within 30 days. If you are unsatisfied, you may complain to the relevant regulator — in Australia, the Office of the Australian Information Commissioner (OAIC); in the EEA or UK, your local data protection authority. Where applicable, California residents may also have rights to know, correct, delete, opt out of regulated sale or sharing, limit certain uses of sensitive personal information, use an authorised agent, and exercise rights without discrimination.
We maintain procedures to assess, contain, investigate, and document suspected personal-data breaches. Under Australia's Notifiable Data Breaches scheme, we will take reasonable steps to complete an assessment of a suspected eligible data breach within 30 days and, where an eligible breach is confirmed, notify the OAIC and affected individuals as soon as practicable. Where the GDPR or UK GDPR applies and XeroFlow is the controller, we will notify the competent authority within 72 hours where legally required. Where XeroFlow acts as a processor, we will notify the relevant customer without undue delay and assist with the customer's assessment and notification obligations. Other jurisdiction-specific requirements will be followed where applicable.
XeroFlow is a business-to-business service and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated policy with a revised date and, where required, notify affected users or customers through the Service or by email. If a change requires new consent under applicable law, we will seek that consent separately. An update to this policy does not reduce any rights provided by applicable law.
XeroFlow's Australian privacy practices are governed by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme, and other applicable Australian laws. Where another jurisdiction's privacy law applies — including the GDPR, UK GDPR, or applicable United States state privacy law — nothing in this policy limits rights that cannot lawfully be excluded.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:
ADME Advertising Pty Ltd
ABN 46 613 333 592
Privacy Officer
Email: privacy@xeroflow.io
You may also use this address to request this policy in an alternative accessible format.