Privacy Policy
1. About This Policy
Humming Web (“we”, “us”, “our”) is a digital marketing agency based in Sydney, New South Wales, Australia. We provide Meta Ads management and social media management services to Australian businesses.
This Privacy Policy explains how we collect, use, store and disclose your personal information. We are committed to complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
By using our website or engaging our services, you agree to the collection and use of information in accordance with this policy.
2. What Information We Collect
From website enquiries and contact forms: your name, email address, phone number, business name, and any details you provide in your message.
From service engagements: business name and contact details, Meta Business Manager access credentials (admin access only, scoped to the agreed account), social media account access, and communications exchanged during the engagement.
Billing information: your billing name, address and subscription details. Card payments are processed securely by our payment provider, Stripe — we do not store your full card number.
From website usage: IP address, browser type, pages visited, time on site, and referral source — collected automatically via analytics tools such as Google Analytics and Meta Pixel.
3. How We Collect Information
We collect personal information directly from you when you fill in a contact or enquiry form on our website, book a strategy call, engage us for services, correspond with us by email or phone, or when you grant us access to your Meta or social media accounts.
We also collect certain information automatically when you visit our website through cookies and analytics tracking.
4. Why We Collect Your Information
We collect and use your personal information to respond to your enquiries and provide information about our services, deliver Meta Ads and social media management services you have engaged us for, manage our client relationships and billing, improve our website and services, and comply with our legal obligations.
We will not use your personal information for any purpose unrelated to why it was collected without your consent.
5. Meta Ads and Social Media Account Access
When you engage us to manage your Meta Ads or social media accounts, you will grant us access to your Meta Business Manager, Facebook Page, Instagram account or other relevant platforms. We will only use this access to perform the services agreed with you. We will not use your ad accounts, pages or data for any purpose other than managing your campaigns and reporting results back to you.
We recommend granting access at the appropriate permission level (typically Partner or Admin on Meta Business Manager) and revoking access when our engagement concludes.
6. Meta Platform Data and Permissions
When you connect your Meta account to Humming Web through our portal, the permissions we request depend on the services you have engaged us for. For social media management, we request the following Facebook Page permissions:
- pages_show_list — to display the Facebook Pages you manage so you can choose which to connect.
- pages_read_engagement — to confirm the connected Page and retrieve performance information (such as reach and engagement) for the reports we provide to you.
- pages_manage_posts — to publish the content you have reviewed and approved to your connected Facebook Page.
Where you also engage us for the relevant services, and only with your authorisation, we may additionally request:
- instagram_basic and instagram_content_publish — if you connect an Instagram Business account, to identify it and publish approved content to it.
- ads_management and ads_read — if you engage us for Meta Ads, to manage campaigns on your behalf and retrieve their performance.
We store an access token that allows us to perform these actions. Facebook Page access tokens remain valid while your connection is active; account-level tokens are renewed as required. Tokens are encrypted at rest, are never shared with third parties, and are deleted within 7 days of you disconnecting your account, and within 30 days of ending your engagement.
You can revoke our access at any time via Meta Business Settings → Business Integrations on your own Meta account.
7. Disclosure of Your Information
We do not sell, rent or trade your personal information to third parties.
We may share your information with trusted third-party service providers who assist us in delivering our services, including our portal infrastructure providers (Supabase and Cloudflare), our payment processor (Stripe), project management and communication tools, and analytics platforms. These providers are required to handle your information in accordance with applicable privacy laws.
We may also disclose your information where required by law or to protect the rights, property or safety of Humming Web, our clients or others.
8. Third-Party Platforms
Our services involve the use of third-party platforms including Meta (Facebook and Instagram), Stripe (payments), Supabase and Cloudflare (infrastructure). These platforms have their own privacy policies and data practices which are outside our control. We encourage you to review Meta’s Privacy Policy at facebook.com/privacy/policy and the terms of any other platform you use in connection with our services.
9. Data Storage, Security and Overseas Processing
Our own primary database is hosted in Australia on Supabase’s Sydney region, and access tokens and sensitive data are encrypted in transit and at rest.
Some of the service providers we rely on operate or process data overseas — in particular Meta (Facebook/Instagram), Stripe and Cloudflare. Publishing content to your social platforms and processing payments necessarily involves transmitting limited data to these providers, which may be located outside Australia. Where we disclose personal information to overseas recipients, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles; however, these providers are also governed by their own privacy policies and the laws of their jurisdictions.
We take reasonable steps to protect your information from misuse, loss, unauthorised access, modification or disclosure, and we limit access to your information to those within our team who need it to deliver your services. While we take all reasonable precautions, no method of data transmission or storage is completely secure. If you become aware of any security concern, please contact us immediately.
10. How Long We Keep Your Information
We retain your personal information for as long as necessary to provide our services and meet our legal obligations. When your information is no longer needed, we will take reasonable steps to destroy or de-identify it. Meta access tokens and connected-account data are deleted within 30 days of disconnection or the end of your engagement.
11. Cookies and Website Analytics
Our website uses cookies and analytics tools including Google Analytics and Meta Pixel to understand how visitors use our site. These tools may collect information such as your IP address, browser, pages visited and time on site.
You can disable cookies through your browser settings, though this may affect the functionality of our website. By continuing to use our website, you consent to our use of cookies as described in this policy.
12. Your Rights
You have the right to request access to the personal information we hold about you, request correction of information that is inaccurate or out of date, request that we delete your information (subject to our legal obligations), and opt out of any marketing communications we send you.
Our services are not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with information, please contact us and we will delete it.
To exercise any of these rights, please contact us using the details below.
13. Data Deletion Requests
To request deletion of your account data — including OAuth tokens, connected accounts, and any content stored on our platform — email hello@hummingweb.com.au with the subject line “Data Deletion Request” and your registered account email.
We will confirm receipt within 5 business days and complete deletion within 30 days. For scheduled or queued content that may have already been published to third-party platforms (such as Facebook Pages or Instagram), deletion of those external posts must be performed on the platform itself; we will assist where possible.
Standing instructions for data deletion are also available at hummingweb.com.au/data-deletion.
14. Marketing Communications
If you have enquired about or engaged our services, we may from time to time send you information about our services or relevant updates. You can unsubscribe from these communications at any time by clicking the unsubscribe link in any email or by contacting us directly.
15. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal information.
16. Changes to This Policy
We may update this Privacy Policy from time to time. The current version will always be available on our website with the date it was last updated. We encourage you to review this policy periodically.
17. Contact Us
If you have any questions about this Privacy Policy, wish to access or correct your information, or have a privacy concern or complaint, please contact us:
Humming Web
Email: hello@hummingweb.com.au
Website: hummingweb.com.au
Location: Sydney, NSW, Australia
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.