How we treat your data, accounts and confidential information when we work together.
Last updated: October 2026
Ad accounts, analytics properties, tag managers, domains, code repositories and CMS instances are created in your name or transferred to you. We work through delegated, revocable access — never shared passwords.
Team members get only the access a task needs, for as long as it is needed. Access is reviewed during the engagement and removed when it ends.
Everything you share with us is treated as confidential. We are happy to sign a mutual NDA before you share sensitive information.
Where an engagement involves your customers’ personal data, we process it only on your instructions and under a data processing agreement. We minimize what we touch and prefer aggregated or pseudonymized data for analysis.
We use multi-factor authentication, encrypted storage and transport, and reputable infrastructure providers. Credentials are kept in a password manager, never in documents or chat.
We hand over documentation, remove our access and delete working copies of your data, except where the law requires us to keep records.
Write to [email protected] for our current list of sub-processors or for a data processing agreement.