Privacy Policy

Last updated: September 2026

1. Who we are

The Agency ("we", "our", "us") is an AI marketing and business systems company operating at theagency.io. We are the data controller for the personal data described in this notice. We are established outside the United Kingdom. Because we offer our services to people in the UK and measure how visitors use this site, UK data protection law applies to this processing, and the rights set out below are available to you in full. For any privacy-related enquiries, contact us at hello@theagency.io.

2. What data we collect

We collect the following categories of personal data:

  • • Contact information: Name, email address, phone number, and business name provided through our forms and custom AI strategy.
  • • Business data: Information you provide about your business during onboarding, including services, pricing, and brand preferences.
  • • Usage data: Pages visited, time on site, referral source, browser type, and device information collected through analytics.
  • • Communication data: Messages sent through our contact form, email correspondence, and AI agent conversations.
  • • Application data: If you apply for a job or an internship, the role you select, your first name, your email address, the links you give us, what you write about yourself, and the record we keep of when and where you applied. This is set out in full under If you apply for a job or an internship below.

3. How we use your data

We use your personal data for the following purposes:

  • • To provide and improve our services, including building your AI revenue system and Company Brain.
  • • To communicate with you about your account, enquiries, and service updates.
  • • To send marketing communications where you have given consent (you can opt out at any time).
  • • To analyse website usage and improve performance, where you have consented to analytics or session recording. This data is not anonymous: Google Analytics sets a persistent identifier for your browser.
  • • To comply with legal obligations and protect our legitimate business interests.

4. Legal basis for processing (GDPR)

We process your data under the following legal bases:

  • • Contract: Processing necessary to fulfil our service agreement with you.
  • • Consent: Where you have explicitly consented to marketing communications, and separately, where you have consented to analytics, session recording or our chat widget on this website. These are separate permissions: agreeing to one does not agree to the others, and consenting to marketing email is not the same as consenting to cookies.
  • • Legitimate interest: For service improvement, fraud prevention, assessing people who apply for a role we have advertised, and the server access logs our hosting provider keeps (including your IP address and country) which exist before any choice you make on this site.
  • • Legal obligation: Where we are required by law to retain or share data.

5. Third-party services

We use the following third-party services that may process your data:

  • • GoHighLevel (GHL): CRM, email automation, and client communication, and the same CRM holds job and internship applications, including what you write on the application form. Data stored in the US with appropriate safeguards.
  • • Netlify: Website hosting and form submissions. Data processed in the US under their privacy policy.
  • • Google Analytics: Website usage measurement, loaded only if you consent. It sets a persistent identifier for your browser, so it is not anonymous. Data processed per Google's data processing terms.
  • • Microsoft Clarity: Session recording, loaded only if you consent. Records clicks, scrolling and mouse movement so we can see where people get stuck. Text you type is masked. Data processed per Microsoft's terms, and shared with Microsoft including its Bing services: when Clarity runs, Microsoft sets its own cookies on bing.com and clarity.ms. The full list is on our cookies page.
  • • Stripe: Payment processing. We do not store your card details. All payments are processed securely by Stripe.
  • • Meta (Instagram/Facebook): Only if you follow links to our social profiles; this site sends Meta nothing. Subject to Meta's data policy on their platforms.

6. Cookies

We use essential cookies to make the website work. Everything else waits for your permission.

When you first visit, the banner offers two choices. Accept cookies allows both of the tools below. Accept essential allows neither:

Analytics (Google Analytics). Tells us which pages are useful. Sets a persistent identifier for your browser, so it is not anonymous.
Session recording (Microsoft Clarity). Records clicks, scrolling and mouse movement on the page so we can see where people get stuck. Text you type is masked.

Chat (LeadConnector) is separate from both choices: nothing from the chat is set until you choose to open it by tapping the chat button.

Neither analytics nor session recording loads until you choose Accept cookies. The full list of cookies, lifetimes and how to undo a choice is on our cookies page. You can change your mind at any time using the Cookie settings button at the bottom of any page, which clears your choices, expires the cookies those tools have set, and asks you again. We do not show you adverts and we do not sell your data; one identifier Microsoft sets when Clarity runs (MUID) belongs to Microsoft's advertising platform, which is why we name it plainly on the cookies page.

Where this data goes. If you accept cookies, Google and Microsoft process the analytics and session recording data on their own servers, which can be outside the UK, including in the United States. The safeguards each relies on for those transfers are set out in their own data protection terms, linked from the cookies page. If you choose Accept essential, none of that data is created in the first place.

Record of your choice. When you make a choice we send a diagnostic note to our own server recording what was chosen, when, the page you were on, your country, and a shortened version of your browser identifier. We do not record your name, your email or your full IP address, and we cannot link it back to you. It is kept only as long as our hosting provider retains server logs, which is a short period, and it exists so we can check the banner is working and that a refusal was acted on.

7. If you apply for a job or an internship

When you apply for a role with us, you fill in a short form on this site. We do not take file uploads, so we never receive or store a file from you. Alongside what you type, we record the role you chose, the page you applied from, and the date and time you applied, and we label the application so our team can find it.

  • • What you give us: The role you select, your first name, your email address, a link to work you have made, a link to a CV you host yourself (optional), and the paragraph you write about yourself.
  • • What we add ourselves: The address of the page you applied from, the date and time your application arrived, a status showing where it has got to, and two labels, one marking the record as an application and one naming the role.
  • • Why we use it: To consider you for the role you applied for. Applying does not add you to our marketing, and we do not send you our sales emails.
  • • Where it goes: Into GoHighLevel, the CRM named in third-party services above, which we use for client communication and for hiring. Your application is normally held there as a contact record, a note carrying what you wrote, and a card on our internal hiring list. It is seen by our team, and by GoHighLevel as the provider running that system for us. If something goes wrong while we are saving your application, an alert carrying your email address goes to our internal Google Chat so a person can put it right, and our hosting provider Netlify keeps a short-lived server log of the request.
  • • Our legal basis: Legitimate interests, being the assessment of candidates for a role we have advertised.
  • • How long we keep it: Six months after we last hear from you about the application, whichever is later than the date you applied. After that a scheduled job removes it. If by then you have become a client, or you are in touch with us about something else, that other record is covered by the rest of this notice rather than by this section.
  • • Your rights: The rights set out under Your rights below apply to your application in full, including asking us to delete it and complaining to the ICO.

8. Data retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected. Contact form submissions are retained for 2 years. Client data is retained for the duration of your subscription plus 1 year. Job and internship applications are kept for six months after we last hear from you about them, and a scheduled job then removes them. Analytics and session recording data is retained by Google Analytics and Microsoft Clarity under their own retention settings, and is deleted when that period expires. It is not anonymous. The diagnostic record of your cookie choice is kept only as long as our hosting provider retains server logs, which is a short period. You can request deletion at any time.

9. Your rights (GDPR)

Under the UK GDPR and Data Protection Act 2018, you have the right to:

  • • Access: Request a copy of the personal data we hold about you.
  • • Rectification: Request correction of inaccurate or incomplete data.
  • • Erasure: Request deletion of your personal data ("right to be forgotten").
  • • Restriction: Request that we limit processing of your data.
  • • Portability: Request your data in a machine-readable format.
  • • Objection: Object to processing based on legitimate interest.

To exercise any of these rights, email us at hello@theagency.io. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Data security

We implement appropriate technical and organisational measures to protect your personal data. All data is transmitted over HTTPS with TLS encryption. Access to client data is restricted to authorised team members and AI systems that require it for service delivery. We regularly review and update our security practices.

11. AI systems and automated interactions

We build and operate AI systems, and we use them in our own business. This section explains where you are interacting with one.

  • • Our chat assistant is AI, not a person. The chat window on this site is an AI assistant. It is not a human, and it will tell you so if you ask. You can request a human at any time and we will follow up by email.
  • • AI is used to produce and analyse content. We use AI systems to research, draft and analyse material as part of delivering our services. A person reviews the output before it reaches you or your customers.
  • • What the assistant records. Messages you send to the chat assistant are stored in our CRM alongside any contact details you provide, and are handled under the same terms as the rest of this policy.
  • • Talking to a human. If you would rather not interact with an AI system at all, email us at hello@theagency.io and a person will reply.

12. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email to active subscribers. The "last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically.

13. Contact

For any questions about this privacy policy or how we handle your data, contact us at:

Email: hello@theagency.io
Website: theagency.io