Privacy Policy

Last updated: 25 August 2026  ·  Effective: 25 August 2026

1. Who we are

AutomateX360 ("AutomateX360", "we", "us", "our") builds and manages websites, funnels, CRM systems and marketing automation for small businesses. We are an independently operated, remote-first business and serve customers primarily in the United States, United Kingdom, Canada and Australia.

For the purposes of the UK and EU General Data Protection Regulation, AutomateX360 is the data controller for personal data collected through this website and through our sales and support process. Where we handle personal data inside a website, CRM or automation system that we build and run on your behalf, we act as a data processor and you are the controller — see section 14.

2. What we collect

Information you give us

• Contact and enquiry details — name, email address, phone number, business name, website URL, and anything you write into a form, chat or booking widget on this site.
• Booking details — when you schedule a call, the time slot, time zone and any notes you add.
• Voice and call data — if you use the voice assistant on this site or speak with us by phone, a recording and/or transcript may be created. You are told before a recording starts, and you can decline.
• Project content — logos, images, copy, product details, business hours and similar material you send us so we can build your website.
• Account and billing details — if you subscribe to a paid plan, your billing name, email and subscription status. We never see or store your full card number; card details are entered directly with our payment processor.

Information collected automatically

• Device and usage data — IP address, browser type, device type, operating system, referring URL, pages viewed, time on page and scroll depth.
• Advertising identifiers — click identifiers appended to our links by ad platforms (gclid, fbclid, wbraid, gbraid, msclkid, ttclid) and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content).
• Cookie and pixel data — see section 5.

We do not intentionally collect special category data (health, race, religion, political opinions, biometric or genetic data). Please do not send it to us.

3. How we use it

Purpose	Data used
Reply to enquiries, quote work, book and hold calls	Contact details, booking details, enquiry content
Build, host, maintain and support your website or automation	Project content, contact details, account details
Take payment and manage your subscription	Billing details, account details
Measure which pages and ads produce enquiries	Usage data, advertising identifiers, cookie data
Show and optimise ads on Meta and Google, including remarketing	Cookie and pixel data, advertising identifiers
Send service messages (billing, downtime, changes to terms)	Contact and account details
Send marketing emails, where you have opted in or are an existing customer	Contact details
Detect fraud and abuse, and meet legal or tax obligations	Account details, usage data

We do not sell your personal data for money, and we do not hand it to third parties to use for their own independent marketing. We do use advertising and analytics services — set out in section 5 — in which third-party vendors, including Google and Meta, process data in order to serve and measure our ads. Under the CPRA that activity counts as “sharing” for cross-context behavioural advertising, and you can opt out of it at any time.

4. Legal basis for processing (UK/EU visitors)

• Contract — delivering the service you bought, taking payment, and supporting your account.
• Legitimate interests — responding to enquiries, basic site security, fraud prevention, and understanding which pages perform, balanced against your rights.
• Consent — advertising and analytics cookies and pixels, and marketing email to non-customers. You can withdraw consent at any time (see section 5).
• Legal obligation — keeping tax and accounting records.

5. Cookies and advertising pixels

This site uses cookies and similar technologies. Strictly necessary cookies keep the site working — for example remembering that you have already dismissed a pop-up. The rest are analytics and advertising:

Technology	Provider	What it does
Google Analytics 4	Google	Counts visits and measures which pages and sections lead to enquiries. Google privacy policy
Google Ads conversion tracking & remarketing	Google	Attributes enquiries to ad clicks and allows us to show ads to people who visited this site.
Meta Pixel	Meta Platforms	Measures results from Facebook and Instagram ads and builds remarketing audiences. Meta privacy policy
Local storage	AutomateX360	Remembers pop-up dismissal for 24 hours so you are not shown it repeatedly.

How to control this. You can block or delete cookies in your browser settings, and most browsers offer a private/incognito mode. You can also opt out of interest-based advertising directly with the platforms: Google Ad Settings, Meta Ad Preferences, Google Analytics opt-out add-on. Blocking these does not stop you using the site.

Remarketing and interest-based advertising

We use Google Ads remarketing (Google’s data segments feature) and Meta Custom Audiences to advertise online to people who have previously visited this website. Third-party vendors, including Google, show our ads on sites across the Internet. Third-party vendors, including Google, use cookies and/or device identifiers to serve ads based on someone’s past visits to this website. We also use pixels, web beacons and similar storage technologies from third parties, including Meta, to collect or receive information from this website and elsewhere on the Internet; Meta uses that information to provide measurement services and to target and deliver ads on Facebook, Instagram and other Meta technologies.

We and third-party vendors use first-party cookies (such as the Google Analytics cookie) together with third-party cookies (such as Google advertising cookies) to report on, optimise and serve advertising. Where we enable Google Analytics Advertising Features — Remarketing with Google Analytics, Google Display Network Impression Reporting, and Demographics and Interest Reporting — the same applies. We do not send personally identifiable information to Google or Meta through our remarketing, conversion tracking or audience tags.

How to opt out of interest-based ads. You can opt out of Google’s use of cookies or device identifiers through Google My Ad Center, or install the Google Analytics opt-out browser add-on. You can opt out of a third-party vendor’s use of cookies for personalised advertising through the Digital Advertising Alliance WebChoices tool, the Network Advertising Initiative opt-out page, or, in Europe, Your Online Choices. You can control the ads you see from us on Meta technologies in your Facebook or Instagram ad settings. You can also control device identifiers through your device’s own settings.

The third parties that may collect, receive or use your personal data through this website for advertising are Google LLC (Google Ads and Google Analytics) and Meta Platforms, Inc. You can read how Google processes data and how Meta uses cookies. If you ask us to stop using your data for advertising, we will remove you from the audiences we have built, including our Meta Custom Audiences and Google data segments.

We honour Global Privacy Control signals where a browser sends one, treating them as an opt-out of sharing for cross-context behavioural advertising.

6. Who we share data with

We share personal data only with service providers who help us run the business, and only as far as they need it. Each is bound to protect it and use it only on our instructions.

Provider	Why
GoHighLevel (HighLevel Inc.)	CRM, forms, booking calendar, email and SMS delivery
Vercel	Website hosting and delivery
Google (Analytics, Ads, Workspace)	Analytics, advertising, email
Meta Platforms	Advertising measurement and delivery
Payment processor (Stripe and/or the processor connected to our CRM)	Taking subscription payments — they receive card data directly, we do not
Domain registrars and DNS providers	Registering and pointing your domain, at your request
Voice assistant provider (Vapi)	Powering the voice widget on this site, where you choose to use it

We may also disclose data where the law requires it, to enforce our Terms of Service, or as part of a merger or sale of the business — in which case you will be told before your data is transferred to a new controller.

7. International transfers

We are established outside the United Kingdom and the European Economic Area, and we use service providers based mainly in the United States and the European Union. That means personal data belonging to UK, EU, Canadian and Australian visitors is transferred outside the country it was collected in.

The country in which we are established has not received an adequacy decision from the UK or the European Commission. Where we transfer personal data of UK or EU residents, we rely on Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) with our providers, together with practical safeguards such as encryption in transit, access control and data minimisation. You can ask us at any time for the country in which we are established and for details of the safeguards that apply to you.

8. How long we keep data

Data	Kept for
Enquiries that do not become customers	24 months from last contact, then deleted
Customer account and project files	The life of the subscription, plus 12 months
Billing and tax records	As long as tax law requires, typically 6–7 years
Call recordings and transcripts	12 months, unless needed for a live dispute
Analytics and advertising data	As set in each platform, typically up to 14 months for GA4 event data
Marketing email list	Until you unsubscribe, plus a suppression record so we do not email you again

9. Security

We use HTTPS across the site, restrict access to customer data to the people who need it, use unique credentials with multi-factor authentication on the platforms we rely on, and keep card data out of our own systems entirely by using a payment processor. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data and creates a risk to your rights, we will notify you and the relevant regulator as required by law.

10. Your rights — UK and EU (GDPR)

If you are in the UK or the European Economic Area you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Rectify data that is inaccurate or incomplete.
• Erase your data ("right to be forgotten"), where we have no overriding legal reason to keep it.
• Restrict processing while a dispute about accuracy or legitimate interests is resolved.
• Object to processing based on legitimate interests, and to direct marketing at any time — direct-marketing objections are always honoured.
• Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider.
• Withdraw consent at any time, without affecting processing that already happened.
• Complain to a supervisory authority — in the UK, the Information Commissioner's Office; in the EU, your national data protection authority.

Email Email Us to exercise any of these. We respond within 30 days and will not charge you unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before releasing data.

We do not carry out automated decision-making that produces legal or similarly significant effects on you.

11. Your rights — California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and why, to request a copy of it, to correct it, to delete it, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights — we will not deny service, change prices, or reduce quality because you made a request.

In the twelve months before the date at the top of this page we collected the categories of personal information described in section 2 — identifiers, commercial information, internet activity, geolocation inferred from IP address, audio where you use the voice assistant, and inferences drawn for advertising. Sources and purposes are set out in sections 2 and 3.

Sale and sharing. We do not sell personal information for money. However, using advertising cookies and pixels to build remarketing audiences on Meta and Google counts as "sharing" for cross-context behavioural advertising under the CPRA. To opt out, block advertising cookies in your browser, use the platform opt-out links in section 5, enable Global Privacy Control, or email us and we will action it. We do not knowingly sell or share the personal information of anyone under 16.

You may use an authorised agent to make a request; we will ask for written proof of authorisation. Submit requests to Email Us with "CCPA Request" in the subject line. We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days with notice.

12. Your rights — Canada and Australia

Canada (PIPEDA). You may access the personal information we hold about you, ask for corrections, and withdraw consent subject to legal and contractual limits. Unresolved complaints can be taken to the Office of the Privacy Commissioner of Canada. Our commercial email complies with CASL — every message identifies us and carries a working unsubscribe link.

Australia (Privacy Act / APPs). You may request access to and correction of your personal information. Complaints can be made to us first, and then to the Office of the Australian Information Commissioner. We will tell you if we cannot give access and explain why.

13. Children

This site and our services are for businesses and are not directed at anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

14. Websites and systems we build for clients

When we build and manage a website, funnel, CRM or automation for you, personal data belonging to your customers may pass through those systems — contact form submissions, booking requests, call records. In that context you are the data controller and we act as your processor. We process that data only to run the service for you, we do not use it for our own marketing, and we return or delete it when your subscription ends in line with our Terms.

You are responsible for publishing your own privacy notice on your website and for having a lawful basis to contact your customers. We can install a privacy page for you on request, but it is your obligation, not ours.

15. Changes to this policy

We may update this policy as the business, the law, or the tools we use change. The "last updated" date at the top always reflects the current version. If a change materially affects how we use your data, we will notify active customers by email before it takes effect.

16. Contact us

Questions, requests, or complaints about privacy go to:

We aim to reply to every privacy request within 30 days. If you are not satisfied with our response, you can contact the regulator in your country as described above.