Privacy Policy

Last updated: 2 August 2026

This Privacy Policy explains how ADME Advertising Pty Ltd (ABN 46 613 333 592), trading as XeroFlow ("we", "us", "our"), collects, uses, discloses, and protects personal information through the XeroFlow platform, its website tracking technology, CRM, and related services (collectively, the "Service").

XeroFlow acts as a controller (or equivalent entity under applicable law) for information about our own account users, website visitors, prospects, and business contacts where we determine why and how that information is processed. XeroFlow generally acts as a processor or service provider when a customer uses the Service to collect and manage dealership website interactions, enquiries, leads, CRM records, and related attribution data ("Customer Data"). In that case, the customer — usually the dealership or dealer group — controls the Customer Data and XeroFlow processes it on the customer's documented instructions.

Customers are responsible for ensuring they have an appropriate legal basis, displaying any required collection notice, and obtaining consent or providing an opt-out where required before sending Customer Data to XeroFlow. This policy supplements, but does not replace, the privacy notice that the relevant customer must provide at or before collection. If your information was collected through a customer's website or communications, you should first direct privacy requests to that customer; we will assist the customer in responding where required.

1. Information We Collect

1.1 Information you provide

  • Account data — name, email address, job title, and organisation name when you register.
  • Financial data — invoicing details, billing addresses, and payment information processed through our payment provider.
  • Client & project data — briefs, tasks, files, comments, and other content you create within boards, projects, and the client portal.
  • Communications — messages sent through in-app chat, email correspondence, and support requests.
  • Integration credentials — OAuth tokens and connection details for third-party services you choose to connect (e.g. Xero, Meta Ads, Google Ads).

1.2 Information collected automatically

  • Usage data — pages viewed, features used, click events, session duration, and referring URLs.
  • Device & log data — IP address, browser type and version, operating system, device identifiers, and access timestamps.
  • Cookies & similar technologies — see Section 8 below.

1.3 Information from third parties

When an authorised user connects a third-party integration, we receive data from that service as necessary to provide the integration (for example, campaign spend data from Meta Ads, advertising lead data, invoice records from Xero, or customer communication data from an enabled provider). We may also receive Customer Data from dealer systems, form providers, webhooks, imports, and other services configured by the customer.

1.4 Dealership website tracking, attribution, and lead data

When a customer installs the XeroFlow tracking tag or connects a lead source, the Service may collect and process the following Customer Data, subject to the customer's configuration and the visitor's consent choices:

  • Lead and enquiry details — name, email address, phone number, enquiry text, form fields, vehicle or service interests, and submission details.
  • Website interactions — page views, page URL and title, referrer, clicks, scroll and engagement events, form starts and submissions, phone-link clicks, and configured provider interactions such as Podium or Xtime iframe engagement.
  • Attribution data — UTM parameters, campaign and advertisement identifiers, and advertising click or browser identifiers such as GCLID, GBRAID, WBRAID, FBCLID, FBC, FBP, TTCLID, MSCLKID, LinkedIn and email click identifiers.
  • Technical and consent data — anonymous visitor and session identifiers, event timestamps, browser and user-agent information, website origin, a salted hash of the IP address where configured, and a snapshot of available consent preferences.

The standard form listener records form metadata and interaction events. It does not read form-field values unless the customer has separately enabled a supported lead adapter, provider integration, or other configured capture method for that form.

1.5 Nearby dealership discovery

When an authorised user opens nearby dealership discovery, XeroFlow uses Google Maps and Places to preview or resolve a user-confirmed market location, display nearby dealerships, and retrieve a selected candidate's public website for agency review. Google may process the location, search area, IP address, device and request information under its own Privacy Policy.

Google-supplied names, formatted addresses, coordinates, distances, place types, map links, and website values are transient display data and are refreshed rather than retained by XeroFlow. We may persist the Google Place ID permitted for this purpose, user-confirmed address text, review decisions and actors, and an independently validated public domain only after explicit human approval. Raw Google Places responses are not stored in our databases, object storage, analytics, logs, AI inputs, or search indexes.

1.6 Sensitive information, anonymity, and pseudonymity

The Service is not designed to collect sensitive information through general website tracking. Customers must not configure forms, free-text fields, imports, or integrations to collect sensitive information unless it is necessary, lawful, and any required consent has been obtained. You may browse XeroFlow's public website without creating an account, but we generally need identifying information to provide an account, billing, support, CRM, or lead services. Website tracking initially uses pseudonymous identifiers, but those identifiers may become personal information when linked with an enquiry or other identifiable record.

2. Lawful Basis for Processing

Where applicable privacy law requires a lawful basis, we process personal information for which XeroFlow is the controller on the following bases:

  • Performance of a contract — to provide the Service, manage your account, and process billing.
  • Legitimate interests — to improve the Service, detect fraud, ensure security, and conduct analytics. We balance these interests against your rights and only proceed where the impact on you is proportionate.
  • Consent — where required by law, such as for optional marketing communications or AI-assisted features that process your content. You may withdraw consent at any time.
  • Legal obligation — to comply with applicable laws, regulations, and enforceable governmental requests.

Where XeroFlow acts as a processor or service provider, the customer determines the purposes and lawful basis for processing Customer Data. We process that data under our agreement with the customer and do not independently determine its use except where required to secure, maintain, or comply with law in relation to the Service.

3. How We Use Your Information

  • Provide, operate, and maintain the XeroFlow platform.
  • Process transactions and send related billing and service notifications.
  • Authenticate users and enforce role-based access controls.
  • Facilitate integrations with accounting, advertising, and email services you connect.
  • Provide website measurement, campaign attribution, lead capture, CRM, deduplication, reporting, and authorised lead-delivery services for customers.
  • Send configured conversion events and attribution signals to advertising or analytics destinations selected by the customer, subject to available consent signals and destination settings.
  • Power AI-assisted features, including the AI chat assistant, intent classification, content suggestions, and anomaly detection (see Section 9).
  • Analyse aggregated usage patterns to improve functionality and user experience.
  • Detect, investigate, and prevent security incidents, fraud, and abuse.
  • Comply with legal obligations and respond to lawful requests.

We do not sell personal information or Customer Data for money. Customers may instruct the Service to send lead or conversion data to destinations they configure. Depending on the jurisdiction and the customer's advertising use, that activity may be regulated as targeted advertising, a disclosure, or "sharing" even where no money is exchanged; the customer is responsible for providing any required notice and choice.

4. Data Sharing & Third-Party Sub-Processors

We share personal information only where necessary and with appropriate safeguards:

  • Infrastructure & hosting — Cloudflare, Inc. (CDN, edge compute, R2 storage, Workers, Durable Objects, AI inference, Vectorize).
  • Database — Neon, Inc. (serverless PostgreSQL hosting).
  • Email delivery — Resend, Inc. (transactional and notification emails).
  • AI processing — Groq, Inc. (LLM inference for AI chat and classification); Cloudflare Workers AI (controlled edge inference and CRM embeddings only when the off-by-default capability is enabled).
  • User-initiated integrations — Xero Limited (accounting), Meta Platforms, Inc. (advertising), Google LLC (advertising). These connections are established by you and governed by each provider's own privacy policy.
  • Mapping and place discovery — Google LLC (Google Maps and Places), when an authorised user uses nearby dealership discovery.
  • Customer-configured recipients — CRM systems, dealerships, dealer groups, lead-management services, spreadsheets, webhooks, advertising platforms, analytics services, and other destinations selected by the customer.
  • Professional and corporate recipients — advisers, auditors, insurers, and a successor in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and legal safeguards.
  • Legal requirements — we may disclose information to law enforcement or regulatory authorities where legally required or to protect rights, safety, or property.

We require service providers that process personal information on our behalf to protect it, use it only for contracted purposes, and maintain appropriate security measures. Third-party integrations selected by a customer may act under their own terms and privacy policies. Customers should review those terms before enabling an integration.

5. International Data Transfers

XeroFlow is operated from Australia. Our service providers are likely to process personal information in Australia, the United States, and other countries in which they operate. Those countries may have privacy laws that differ from the laws where you live. We take reasonable steps required by Australian Privacy Principle 8 before disclosing personal information overseas and use contractual and technical safeguards appropriate to the transfer. Where the GDPR or UK GDPR applies, we use an available lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, as applicable. Customers may also configure integrations that transfer Customer Data to countries chosen by them.

6. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law:

  • Account data — retained for the duration of your account and for 30 days after deletion to allow recovery.
  • Financial records — retained for 7 years from the end of the relevant financial year, as required by Australian tax law.
  • Website tracking events — retained for the period configured for the relevant tracking site (395 days by default), after which an automated retention process deletes expired events.
  • Lead and CRM Customer Data — retained for the customer account term and any additional period required by the customer's documented instructions, configured lifecycle rules, or applicable law. Customers may export, correct, or delete records using available Service functions.
  • Security and operational logs — retained only for a reasonable period needed for security, troubleshooting, fraud prevention, and legal compliance.
  • AI conversation data — retained for 90 days to improve AI quality, then automatically purged unless you choose to save a conversation.
  • Nearby market records — Google-supplied display data remains transient; Place IDs, user-confirmed address text, decisions, actors, and independently validated domains are retained with the relevant customer record and audit history.
  • Backups — encrypted backups may persist for up to 30 days after data deletion from the live system.

7. Data Security

We implement technical and organisational measures designed to protect personal information, including:

  • Encryption in transit and encryption at rest through our managed infrastructure and storage providers.
  • Role-based access controls with least-privilege principles.
  • OAuth 2.0 token management — integration credentials are encrypted and never exposed to other users.
  • Web Application Firewall (WAF) and DDoS protection via Cloudflare.
  • Salting and hashing of IP addresses stored with website tracking events where tracking is configured.
  • Regular vulnerability assessments and secure development practices.
  • Audit logging of administrative and data-access actions.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Cookies & Similar Technologies

8.1 Essential cookies

Required for the Service to function. These include session tokens for authentication (e.g. session_token, client_session_token) and CSRF protection. These cannot be disabled without impairing the Service.

8.2 Functional cookies

Store your preferences such as colour mode, sidebar state, and notification settings.

8.3 Analytics

We collect Service usage analytics to understand how the platform is used and to improve reliability and functionality. Analytics may include account, device, log, and interaction information described in Section 1.2. We do not sell this information for money.

8.4 Customer website tracking

On customer websites where the XeroFlow tag is installed, first-party cookies are used to create an anonymous visitor identifier for up to 365 days and a session identifier that is refreshed during activity and expires after approximately 30 minutes of inactivity. A consent-preference cookie may record a visitor's available choices. The tag may also read existing advertising identifiers such as Meta FBC and FBP cookies and capture advertising click identifiers from the page URL for campaign attribution. The exact technologies and events enabled depend on the customer's configuration.

8.5 Consent and opt-out choices

Customers must configure the tracking tag and their website consent experience for the laws that apply to their visitors. Where a visitor records an available consent choice, XeroFlow uses that signal to govern event collection and configured advertising-platform delivery. Visitors should use the controls provided on the relevant customer's website or contact that customer to change their choice. Essential security and service events may still be processed where permitted by law. XeroFlow's general Privacy Policy is not a substitute for a customer's point-of-collection notice or cookie notice.

8.6 Direct marketing

XeroFlow marketing communications provide an unsubscribe or preference-management method where required. You may also object to our use of your information for direct marketing by contacting privacy@xeroflow.io. Service, security, account, and billing messages are transactional and may still be sent while you use the Service. Customers are responsible for marketing communications they send using or following data processed through XeroFlow; recipients should use the unsubscribe method in the communication or contact the relevant customer directly.

9. Artificial Intelligence & Automated Processing

XeroFlow includes AI-powered features that process your data:

  • AI Chat Assistant — answers questions about your agency data using large language models. Conversations are processed by Groq and/or Cloudflare Workers AI.
  • Intent classification & anomaly detection — analyses patterns in your data to route queries and surface proactive insights.
  • Content suggestions — AI-generated copy and creative recommendations within the banner studio.
  • Controlled CRM semantic assistance — off by default and limited to approved agency-assistant contexts. When enabled, Workers AI creates embeddings only for authorized people, companies, and opportunities; Vectorize stores scoped vectors, and only records at confirmed index state are eligible. Portal semantic ranking remains unavailable.

AI features process your data only in the context of your organisation. Your data is not used to train general-purpose AI models and is not shared across organisations. Controlled CRM retrieval records privacy-safe operational evidence; source records and confirmed vectors follow the applicable retention and legal-hold rules, and erasure is not reported complete until confirmed erasure covers both database and provider state. No automated decision-making with legal or similarly significant effects is performed without human oversight.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access — request a copy of the personal information we hold about you.
  • Rectification — request correction of inaccurate or incomplete data.
  • Erasure — request deletion of your personal data, subject to legal retention obligations.
  • Restriction — request that we limit processing of your data in certain circumstances.
  • Data portability — receive your data in a structured, machine-readable format (JSON or CSV export).
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

For information XeroFlow controls directly, contact us at privacy@xeroflow.io. We may need to verify your identity and authority before completing a request. We will respond within the timeframe required by applicable law and will explain if an exception applies.

For Customer Data collected through a dealership website, lead source, CRM, or customer communication, please contact the relevant customer first. The customer controls that data in most cases, and XeroFlow will assist the customer with access, correction, deletion, portability, restriction, or objection requests as required by our agreement and applicable law.

If you have a privacy complaint, email our Privacy Officer with enough information for us to investigate. We will acknowledge the complaint, investigate it fairly, and provide a written response within a reasonable period, generally within 30 days. If you are unsatisfied, you may complain to the relevant regulator — in Australia, the Office of the Australian Information Commissioner (OAIC); in the EEA or UK, your local data protection authority. Where applicable, California residents may also have rights to know, correct, delete, opt out of regulated sale or sharing, limit certain uses of sensitive personal information, use an authorised agent, and exercise rights without discrimination.

11. Data Breach Notification

We maintain procedures to assess, contain, investigate, and document suspected personal-data breaches. Under Australia's Notifiable Data Breaches scheme, we will take reasonable steps to complete an assessment of a suspected eligible data breach within 30 days and, where an eligible breach is confirmed, notify the OAIC and affected individuals as soon as practicable. Where the GDPR or UK GDPR applies and XeroFlow is the controller, we will notify the competent authority within 72 hours where legally required. Where XeroFlow acts as a processor, we will notify the relevant customer without undue delay and assist with the customer's assessment and notification obligations. Other jurisdiction-specific requirements will be followed where applicable.

12. Children's Privacy

XeroFlow is a business-to-business service and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated policy with a revised date and, where required, notify affected users or customers through the Service or by email. If a change requires new consent under applicable law, we will seek that consent separately. An update to this policy does not reduce any rights provided by applicable law.

14. Governing Law

XeroFlow's Australian privacy practices are governed by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme, and other applicable Australian laws. Where another jurisdiction's privacy law applies — including the GDPR, UK GDPR, or applicable United States state privacy law — nothing in this policy limits rights that cannot lawfully be excluded.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

ADME Advertising Pty Ltd

ABN 46 613 333 592

Privacy Officer

Email: privacy@xeroflow.io

You may also use this address to request this policy in an alternative accessible format.