Legal

Privacy Policy

Last updated: August 2026

1. Who we are

The Agency ("we", "our", "us") is an AI marketing and business systems company operating at theagency.io. We are the data controller for the personal data described in this notice. We are established outside the United Kingdom. Because we offer our services to people in the UK and measure how visitors use this site, UK data protection law applies to this processing, and the rights set out below are available to you in full. For any privacy-related enquiries, contact us at hello@theagency.io.

2. What data we collect

We collect the following categories of personal data:

  • Contact information: Name, email address, phone number, and business name provided through our forms and custom AI strategy.
  • Business data: Information you provide about your business during onboarding, including services, pricing, and brand preferences.
  • Usage data: Pages visited, time on site, referral source, browser type, and device information collected through analytics.
  • Communication data: Messages sent through our contact form, email correspondence, and AI agent conversations.

3. How we use your data

We use your personal data for the following purposes:

  • To provide and improve our services, including building your AI revenue system and Company Brain.
  • To communicate with you about your account, enquiries, and service updates.
  • To send marketing communications where you have given consent (you can opt out at any time).
  • To analyse website usage and improve performance, where you have consented to analytics or session recording. This data is not anonymous: Google Analytics sets a persistent identifier for your browser.
  • To comply with legal obligations and protect our legitimate business interests.

4. Legal basis for processing (GDPR)

We process your data under the following legal bases:

  • Contract: Processing necessary to fulfil our service agreement with you.
  • Consent: Where you have explicitly consented to marketing communications, and separately, where you have consented to analytics, session recording or our chat widget on this website. These are separate permissions: agreeing to one does not agree to the others, and consenting to marketing email is not the same as consenting to cookies.
  • Legitimate interest: For service improvement, fraud prevention, and the server access logs our hosting provider keeps (including your IP address and country) which exist before any choice you make on this site.
  • Legal obligation: Where we are required by law to retain or share data.

5. Third-party services

We use the following third-party services that may process your data:

  • GoHighLevel (GHL): CRM, email automation, and client communication. Data stored in the US with appropriate safeguards.
  • Netlify: Website hosting and form submissions. Data processed in the US under their privacy policy.
  • Google Analytics: Website usage measurement, loaded only if you consent. It sets a persistent identifier for your browser, so it is not anonymous. Data processed per Google's data processing terms.
  • Microsoft Clarity: Session recording, loaded only if you consent. Records clicks, scrolling and mouse movement so we can see where people get stuck. Text you type is masked. Data processed per Microsoft's terms, and shared with Microsoft including its Bing services: when Clarity runs, Microsoft sets its own cookies on bing.com and clarity.ms. The full list is on our cookies page.
  • Stripe: Payment processing. We do not store your card details. All payments are processed securely by Stripe.
  • Meta (Instagram/Facebook): Only if you follow links to our social profiles; this site sends Meta nothing. Subject to Meta's data policy on their platforms.

6. Cookies

We use essential cookies to make the website work. Everything else waits for your permission.

When you first visit, the banner offers two choices. Accept cookies allows both of the tools below. Accept essential allows neither:

Analytics (Google Analytics). Tells us which pages are useful. Sets a persistent identifier for your browser, so it is not anonymous.
Session recording (Microsoft Clarity). Records clicks, scrolling and mouse movement on the page so we can see where people get stuck. Text you type is masked.

Chat (LeadConnector) is separate from both choices: nothing from the chat is set until you choose to open it by tapping the chat button.

Neither analytics nor session recording loads until you choose Accept cookies. The full list of cookies, lifetimes and how to undo a choice is on our cookies page. You can change your mind at any time using the Cookie settings button at the bottom of any page, which clears your choices, expires the cookies those tools have set, and asks you again. We do not show you adverts and we do not sell your data; one identifier Microsoft sets when Clarity runs (MUID) belongs to Microsoft's advertising platform, which is why we name it plainly on the cookies page.

Where this data goes. If you accept cookies, Google and Microsoft process the analytics and session recording data on their own servers, which can be outside the UK, including in the United States. The safeguards each relies on for those transfers are set out in their own data protection terms, linked from the cookies page. If you choose Accept essential, none of that data is created in the first place.

Record of your choice. When you make a choice we send a diagnostic note to our own server recording what was chosen, when, the page you were on, your country, and a shortened version of your browser identifier. We do not record your name, your email or your full IP address, and we cannot link it back to you. It is kept only as long as our hosting provider retains server logs, which is a short period, and it exists so we can check the banner is working and that a refusal was acted on.

7. Data retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected. Contact form submissions are retained for 2 years. Client data is retained for the duration of your subscription plus 1 year. Analytics and session recording data is retained by Google Analytics and Microsoft Clarity under their own retention settings, and is deleted when that period expires. It is not anonymous. The diagnostic record of your cookie choice is kept only as long as our hosting provider retains server logs, which is a short period. You can request deletion at any time.

8. Your rights (GDPR)

Under the UK GDPR and Data Protection Act 2018, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data ("right to be forgotten").
  • Restriction: Request that we limit processing of your data.
  • Portability: Request your data in a machine-readable format.
  • Objection: Object to processing based on legitimate interest.

To exercise any of these rights, email us at hello@theagency.io. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Data security

We implement appropriate technical and organisational measures to protect your personal data. All data is transmitted over HTTPS with TLS encryption. Access to client data is restricted to authorised team members and AI systems that require it for service delivery. We regularly review and update our security practices.

10. AI systems and automated interactions

We build and operate AI systems, and we use them in our own business. This section explains where you are interacting with one.

  • Our chat assistant is AI, not a person. The chat window on this site is an AI assistant. It is not a human, and it will tell you so if you ask. You can request a human at any time and we will follow up by email.
  • AI is used to produce and analyse content. We use AI systems to research, draft and analyse material as part of delivering our services. A person reviews the output before it reaches you or your customers.
  • What the assistant records. Messages you send to the chat assistant are stored in our CRM alongside any contact details you provide, and are handled under the same terms as the rest of this policy.
  • Talking to a human. If you would rather not interact with an AI system at all, email us at hello@theagency.io and a person will reply.

11. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email to active subscribers. The "last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically.

12. Contact

For any questions about this privacy policy or how we handle your data, contact us at:

Email: hello@theagency.io
Website: theagency.io