Privacy Policy

Who We Are?

ClientInvite (trading as SocialMate Pty Ltd), hereinafter "ClientInvite", collects, uses, and is responsible for certain categories of your personal information. When doing so, we act as the 'controller' under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and under the GDPR where it applies to you.

We also process data provided by clients during service delivery. In these cases, we act as a data processor (accounting for most processing activities).

Information Collected by Us

We may collect:

• Your name, email, business affiliation and role, and communications with us
• Device and usage information when you browse our website, such as your IP address, browser and device type, pages viewed, and the site or advert that referred you
• Identification data associated with your visit, as described under Cookies and Tracking Technologies below

How We Use Your Personal Information

Purposes include:

• Providing our software services
• Complying with legal/regulatory obligations
• Promoting ClientInvite's services, including measuring our advertising and contacting business visitors who have shown interest
• Handling queries/complaints
• Staff training and service quality monitoring

Data from Google and Meta Accounts You Connect

ClientInvite lets agencies request access to their clients' marketing accounts. When you connect a Google or Meta account to ClientInvite, whether as an agency or as a client following an agency's access link, we access that account's data only to do what you asked us to do there.

What we access

• Your basic profile: your name, email address and profile picture, to show you which account is connected.
• Lists of your accounts: the names and IDs of the Google Ads, Google Analytics, Google Tag Manager and Search Console accounts (and the Meta ad accounts, Pages, pixels and catalogs) that your login can see, and whether you are allowed to manage users on each one. We use this to show you a list to choose from.
• User management: when you choose an account and confirm, we add the agency that sent you the link as a user of that account, at the access level shown to you on the link (for example "Viewer" or "Administrator"). We do this once, for the accounts you picked.

We do not read your reports, campaign data, website analytics, audiences or any other contents of these accounts, and we do not change anything in them other than adding the user you approved.

What we store, and for how long

• Clients: the access token Google or Meta gives us is kept only in an encrypted, HTTP-only session cookie in your browser. It is never written to our database, and the cookie expires after 30 days at most. We store only the name and ID of each account you chose, the access level granted, when you granted it, and the name and email address you entered on the link.
• Agencies: the access and refresh tokens for the Google and Meta accounts you connect are stored in our database, so that ClientInvite can complete the steps that need your side (such as accepting a Google Ads manager link). They are deleted when you disconnect the account in ClientInvite or delete your ClientInvite account.
• You can revoke ClientInvite's access at any time at myaccount.google.com/permissions (Google) or in your Facebook settings under Business Integrations (Meta). To have the data above deleted, email jordan@clientinvite.com; we delete it within 30 days.

How we protect it

• All data is encrypted in transit (HTTPS/TLS) between your browser, our servers, Google and Meta.
• Our database is encrypted at rest (AES-256) by our hosting provider.
• Session cookies holding tokens are encrypted, HTTP-only and sent over HTTPS only, so page scripts cannot read them.
• Tokens are never included in logs, error reports, emails, webhooks or our API.
• Access to production systems is limited to the people who operate ClientInvite.
• We request only the permissions the product needs, and use each one only for the purpose described above.

Sharing and use

Data obtained through Google or Meta APIs is shared only with the agency whose access link you used, and only as described above: the list of accounts you chose, and the access you granted. We do not sell it, use it for advertising, use it to build user profiles, or use it to train AI or machine-learning models. No one at ClientInvite reads it, except with your permission, to investigate a security issue or abuse, to comply with the law, or where it has been aggregated and anonymised for internal operations.

ClientInvite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies. Some are strictly necessary for the site to function. Others are used for analytics, advertising measurement and visitor identification, and these are described below.

Analytics and advertising

We use Google Analytics, Google Tag Manager and the Meta (Facebook) pixel to understand how our website is used and to measure the performance of our advertising. These set cookies in your browser and share data with Google and Meta respectively.

Visitor identification

We use RB2B, a visitor identification service. The following disclosure applies:

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

Your choices, and where these technologies run

Where opt-in consent is required by local law — including the European Economic Area, the United Kingdom and Switzerland — analytics and advertising technologies are not loaded until you accept them using the cookie banner shown on your first visit. If you decline, those scripts are never loaded. You can change your decision at any time by clearing your cookies for this site and making a new selection when the banner reappears.

Visitor identification through RB2B is not operated at all for visitors in those jurisdictions, regardless of any consent given. It runs only where such identification is permitted without prior opt-in consent.

You can also block or delete cookies through your browser settings, and opt out of Google Analytics using Google's browser opt-out add-on.

Legal Bases for Processing

We rely on:

• Consent
  • Sending marketing communications
  • Processing job applications (withdrawable at any time; may affect application)
• Legal Obligations
  • Regulatory compliance, employer duties, ATO and Corporations Act record-keeping, legal defense
• Contract Performance
  • Delivering services under contract
  • Pre-contract arrangements
  • Supplier/customer agreements
• Legitimate Interests
  • Staff training to improve client services (rights/freedoms assessed)

Third-Party Sharing

We share data with:

• Professional advisers/consultants
• Training agencies
• Accountants/solicitors (for legal/financial compliance)
• Data processors (e.g., CRM, email platforms, help desk systems)
• Cloud hosting/storage providers
• Advertising platforms (e.g., Meta, Google) for ad optimization (opt-out via jordan@clientinvite.com)
• Analytics and visitor identification providers (Google Analytics, Google Tag Manager, the Meta pixel and RB2B), as described under Cookies and Tracking Technologies

End-user note: Audit tool users' names, emails, industry, and audit reports are shared only with the referring client—no raw data.

All third parties are bound by GDPR-compliant agreements. We disclose data to authorities (e.g., police, ICO) if legally required.

International Transfers

Data is not routinely transferred outside the EEA. When necessary, we'll inform you of the basis, safeguards, and risks. Clients accessing our systems globally do so under their own controller responsibilities.

Data Retention

We retain data only as long as necessary:

• Client data: 1 year post-contract
• Advice records: 7 years post-advice (or limitation period + 1 year)
• Audit data: 24 months maximum
• Financial records: 7 years (Corporations Act 2001 and ATO record-keeping requirements)
• Marketing data: 30 days post-consent withdrawal

Your Rights

Under the Australian Privacy Principles, and under the GDPR where it applies to you, you have the right to:

• Transparency/access to your data
• Correction/completion of data
• Erasure (in specific circumstances)
• Data portability (to you/third parties)
• Object to direct marketing/other processing
• Restrict processing
• Avoid automated decision-making

Contact us to exercise these rights (response within 1 month).

Complaints

Contact Jordan at jordan@clientinvite.com with concerns. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au/privacy/privacy-complaints. If you are in the EEA, you may also complain to your local supervisory authority.