Privacy Policy

Last updated: 2 Nov 2025

Who we are. Shopay Pty Ltd (ABN 60 619 658 669) trading as Observant Convo Automation Agency ("Observant Convo", "we", "us").

Websites & apps covered: observantconvo.com, thoughtforge.app, their subdomains, and tools listed at observantconvo.com/tools, including the AI Search Readiness Score and Meta Ad Planner.

Contact: info@observantconvo.com, Sydney, Australia.

1) Scope

This policy explains what we collect, how we use it, who we share it with, how long we keep it, and your rights under Australian law (Privacy Act 1988 (Cth) & Australian Privacy Principles) and applicable US laws (incl. CCPA/CPRA, where relevant).

2) Data we collect

A. Account & Identity

Name, email, company, role, timezone; password (hashed) or SSO identifiers.

B. Platform Data from Meta (for Meta Ad Planner)

Only after you connect and consent, we may access: pages/ad accounts you select, campaign structure & performance metrics, and (optionally) lead form data you direct to your CRM. We request the minimum data to provide enabled features.

B. Platform Data from Meta (for Meta Ad Planner)

Only after you connect and consent, we may access: pages/ad accounts you select, campaign structure & performance metrics, and (optionally) lead form data you direct to your CRM. We request the minimum data to provide enabled features.

C. Content & Usage

Drafts, uploads, schedules, funnels, performance you choose to track; device/browser/IP, timestamps, product events, and error logs.

D. Billing

Processed by Stripe; we don't store full card details.

E. Cookies/local storage

For login sessions, preferences, and privacy-respecting analytics.

3) How we use data (purposes)

  • Provide services (draft → publish, analytics, forecasts, funnels).
  • Operate, secure & improve products (diagnostics, abuse prevention).
  • Billing & account (subscriptions, invoices, fraud prevention).
  • Service communications (updates about features you use).
  • Legal/compliance (enforce terms, respond to lawful requests).

We do not sell personal information and do not "share" it for cross-context behavioral advertising under the CPRA.

4) Retention

  • Account data: while active + up to 24 months after last activity (or sooner on request), except billing records kept up to 7 years.
  • Meta data: tokens deleted on disconnect; cached metrics purged within 30 days.
  • Logs/analytics: typically ≤ 12 months (or anonymised).

5) Sharing & processors

We use vetted service providers under data-processing terms, only for the purposes above, e.g.: Stripe (payments), Supabase/managed Postgres (DB/auth/storage), Hosting/CDN (e.g., Vercel/AWS), Email/support (transactional mail/helpdesk), GoHighLevel (GHL) if you enable CRM sync, and AI/model providers you explicitly use for content transforms.

A current list is available on request at info@observantconvo.com. We may disclose data if required by law or to protect rights/safety.

6) International transfers

Data may be stored/processed in Australia and the United States. We apply reasonable safeguards and access controls.

7) Security & breaches

Encryption in transit and at rest (where supported), credential hashing, least-privilege access, audit logging, backups. If a breach is likely to cause serious harm, we'll notify affected individuals and (in Australia) the OAIC under the Notifiable Data Breaches scheme; in the US, we'll notify as required by state laws.

8) Your rights

Australia (APPs): Request access and correction of your personal information.

US (incl. California): Subject to verification, request to know/access, correct, or delete your personal information. We don't sell/share personal information.

Request anytime at info@observantconvo.com.

You can also revoke platform permissions directly:

  • Meta: Facebook/Instagram Settings → Business Integrations.

9) Cookies

We use necessary cookies (auth), functional cookies (preferences), and privacy-respecting analytics. Blocking some cookies may limit features.

9a) Advertising measurement (Meta pixel and Conversions API)

To measure which advertisements bring people to this site, we use the Meta pixel in your browser and Meta's Conversions API from our servers. Both record the same events — page views, completing the enquiry qualifier, opening the booking calendar, and paid strategy sessions — and share an event identifier so a single action is not counted twice.

What is shared with Meta (Meta Platforms, Inc.): the page visited, the event name and time, Meta's own browser cookies (_fbp, _fbc), your IP address and browser user agent, and — when you submit the enquiry form — your email address, phone number and name, irreversibly hashed with SHA-256 before transmission. We never place these identifiers in page URLs. Purpose: measuring and optimising our advertising. Legal basis: consent where consent is required, legitimate interests elsewhere.

Your choices: where consent is required (the EEA, UK and Switzerland), no advertising cookies are set and no events are sent until you accept on our cookie bar; declining is as easy as accepting, and you can change your choice at any time via "Cookie settings" in the site footer. Elsewhere you can opt out through your Facebook or Instagram ad settings, or by emailing privacy@observantconvo.com. Withdrawing consent stops future events; events already sent cannot be recalled.

10) Children

Our services are for business users and not directed to children under 16. We do not knowingly collect personal information from children under 13.

11) Product-specific details

A) Meta Ad Planner (Meta/Facebook/Instagram)

Access: pages/ad accounts you select; campaign structure & metrics; optional lead form data you route to your CRM.

Use: planning, forecasting, reporting you request; optional CRM sync.

Storage: configuration & aggregated metrics; encrypted tokens.

B) ThoughtForge

Data: articles, drafts and generated posts you create.

Use: transform your content into social posts you can publish.

Control: export/delete content; request account deletion anytime.

12) Data deletion instructions

Email privacy@observantconvo.com with subject "Data Deletion Request" from your account email. Include any linked Meta IDs or profile URLs. We'll delete or anonymise personal information within 30 days (except records we must retain by law, e.g., invoices).

You can also revoke Meta access immediately in their settings (which invalidates tokens).

13) Changes

We'll update this policy as products evolve. Material changes will be announced in-app or by email. The "Last updated" date shows the latest version.