Who we are and what this policy covers

Bluewave Technology Pty Ltd (“Bluewave”, “we”, “us” or “our”) provides digital marketing, consulting, reporting and technology services from Melbourne, Australia. This policy explains how we collect, hold, use and disclose personal information through bluewavetechnology.com.au, Bluewave Report Studio, AnswerScope, and Bluewave-operated client portals, reporting applications, integrations and automation tools that link to this policy.

It covers website visitors, enquiries, clients, authorised app users and individuals whose information clients authorise us to process. Where we work in a client’s accounts or process their customer information on their instructions, that client also has its own privacy responsibilities and policy. A client-branded service with a separate privacy notice should be read alongside this policy.

Information we collect and how we collect it

The information depends on the service you use, the accounts connected and permissions granted. We collect information directly from you, from authorised client representatives, through connected platforms and from website or application activity.

• Contact and business details: name, email address, phone number, organisation, role, enquiries, correspondence and service requirements.
• Application and access information: user and organisation identifiers, login details, roles, permissions, connected-account identifiers, authorisation tokens and connection status. Platform authorisation generally takes place with the platform; you should not send us your platform password.
• Reporting and marketing data: account and campaign names and IDs, ads and creative, budgets, spend, impressions, clicks, conversions, conversion values, audience breakdowns and performance history available through authorised connections.
• Client-supplied information: briefs, uploaded files, reports, website content and, where required for an agreed service, CRM records, enquiries, lead details, orders and customer interactions.
• Technical and usage information: IP address, device and browser information, pages or features used, timestamps, diagnostic information, security events and cookies or similar identifiers.

Only connect accounts and upload information you are authorised to share. Please do not provide sensitive personal information unless we have specifically agreed that it is necessary and appropriate for the service.

How we use information

We use information to respond to enquiries; set up and administer client accounts; authenticate users; connect authorised data sources; prepare dashboards, reports and analysis; monitor search and AI visibility; deliver agreed campaigns, website projects and automations; provide support; diagnose errors; protect accounts; manage billing and contracts; and meet legal obligations.

Reporting applications retrieve, organise, store and display authorised data and may combine connected-source data in a client report. Campaign-management actions are performed only within the agreed service and granted permissions. Connecting a reporting source does not itself authorise unrelated campaign changes.

We may send relevant service communications and marketing where permitted. You can unsubscribe from marketing or contact us to opt out. Essential account, security and service messages may still be necessary.

Facebook, Instagram and Meta Platform Data

Where you or your organisation authorise a Meta connection, our tools may receive information through Facebook Login, Meta business integrations or Meta APIs. Depending on the features enabled and permissions approved, this includes:

• Basic identity information made available by the login permission, such as a Meta user ID, name and email address where provided.
• Business portfolio, advertising account, Facebook Page and Instagram professional-account identifiers, names and relevant access permissions.
• Campaign, ad set, ad and creative information, delivery settings and advertising performance metrics, including spend, reach, impressions, clicks and reported conversions.
• Page or Instagram content and insights where an authorised social reporting or publishing feature requires them.
• Lead-form information only where a client specifically enables and authorises a lead-management service; it is not required simply to display aggregate advertising reports.
• Access tokens and connection metadata needed to maintain the authorised integration.

We process this data to identify authorised accounts, connect them to the correct client workspace, deliver requested reporting or management features, maintain the integration and provide support. The actual information available is limited by your permissions, the platform and the enabled features.

We do not sell Meta Platform Data, provide it to data brokers or use it for unrelated advertising profiles. We do not use Meta Platform Data to train general-purpose AI or machine-learning models. Access and disclosure are limited to authorised users and service providers needed to deliver the permitted service, or as required by law and allowed by Meta’s terms. This policy does not override Meta’s Platform Terms or other applicable platform restrictions.

You can revoke an integration through your Facebook or Meta account’s Apps and Websites or Business Integrations settings, as applicable, or ask us to disconnect it. Revoking access prevents further access through that authorisation but does not, by itself, erase data already held. All users, regardless of location, can request deletion using the instructions below.

Google and other connected services

Authorised Google Ads, Google Analytics and other connections provide the account information, performance data and permissions needed for the selected service. Email, ecommerce, CRM and publishing integrations may also process customer, order, campaign or content data where included in the agreed scope. Each provider’s own privacy policy governs its independent handling of information.

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. Connected-platform data is used for the requested service, not sold or used to train general-purpose AI models.

Who can receive information

We may disclose information to authorised Bluewave personnel and contractors; the relevant client’s authorised users and nominated advisers; and providers of hosting, storage, authentication, communications, analytics, support and other infrastructure necessary to deliver the service. We may also disclose information where legally required or permitted to protect legal rights and security.

Reports and exports are shared with the intended client and recipients they authorise. A recipient may retain their own copy, which is subject to their information-handling responsibilities. We do not make private client reports public without authorisation.

Where an agreed workflow uses an external AI service, relevant inputs may be sent to that provider to generate the requested analysis or content. Personal information should be minimised, and connected-platform restrictions continue to apply. This policy does not authorise unrestricted disclosure of client data to AI services.

Storage, security and overseas processing

Information is held in the websites, applications, databases, document systems and service-provider environments used to deliver our services. These include Australian and overseas infrastructure. Providers operating internationally, including in the United States, may store or process information outside Australia. Locations depend on the particular platform and service; contact us for information about the providers and locations relevant to your engagement.

We take reasonable steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Access is limited according to service requirements. No internet transmission or storage system is completely secure. Please keep account credentials confidential and notify us promptly of suspected unauthorised access.

How long we keep information

We retain information only for as long as reasonably needed for the purposes described here, the agreed service, and applicable legal requirements. Relevant factors include whether the account or engagement is active, the reporting history requested by the client, support requirements, contractual obligations and mandatory record-keeping.

Authorisation credentials are removed or invalidated when the relevant connection is ended. Personal information that is no longer needed is deleted or de-identified. Meta Platform Data is deleted when required by Meta’s terms, including following a valid deletion request or when it is no longer needed for the authorised purpose, unless retention is legally required. Residual backup copies are isolated from routine use and removed through backup expiry; any legally required retained information is restricted to that purpose.

Request deletion of your data

You do not need to sign in or have an active subscription to request deletion. These instructions apply to Bluewave Report Studio, AnswerScope and other Bluewave tools covered by this policy, including data received from Meta.

1. Email info@bluewavetechnology.com.au with the subject Data deletion request.
2. Provide your name, the email address used with the tool, the tool’s name and, if relevant, your organisation and connected account or Page ID. Tell us whether you want a particular connection’s data deleted or your whole Bluewave tool account removed.
3. We will verify your identity and authority using only information reasonably necessary, clarify the request if needed, and confirm the action taken. Do not send passwords, access tokens or identity documents unless a secure verification method has first been agreed.

Following verification, we will delete the applicable personal and connected-platform data from our active systems and instruct relevant service providers as necessary, subject to legally required retention. We aim to complete requests within 30 days and will explain any delay, legal exception or remaining backup retention. You can request a status update at the same email address.

Removing a connection, uninstalling an app or deleting a Bluewave account does not delete your Facebook, Instagram, Google or other source-platform account. We cannot directly erase copies held independently by a client or another platform, but can help identify the appropriate contact. If your information was supplied by a client, we may coordinate your request with them; you can still contact us directly.

Access, corrections and your choices

You can ask us to access or correct personal information we hold about you, withdraw an optional permission, or request deletion using the contact details below. We may verify identity and authority before acting. If we cannot fulfil a request, we will explain why, subject to legal restrictions, and describe available complaint options.

You can make a general enquiry anonymously or using a pseudonym where practicable. Some services need identity, contact and account information to operate; if you do not provide it, we may be unable to supply those services.

Website cookies and third-party content

Our website and applications may use cookies and similar technologies for sessions, security, preferences and usage measurement. Analytics and marketing technologies, where enabled, can collect device identifiers, website activity and interactions such as enquiry or contact-link clicks. Embedded content may allow the provider to collect information under its own policy.

You can manage cookies in your browser and any consent controls provided by the relevant service. Blocking some cookies may affect login or other functionality. Where consent is required for optional tracking, that requirement applies independently of this policy.

Contact, complaints and policy updates

For privacy questions, access, corrections, deletion requests or complaints, contact:

Privacy Officer — Steve Mills
Bluewave Technology Pty Ltd
Email: info@bluewavetechnology.com.au
Phone: 0407 402 011
Melbourne, Australia

Please describe your concern and how you would like us to respond. We will review the matter, seek further information if needed and aim to respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner about matters within its jurisdiction, or the relevant privacy regulator in your location.

Our services are intended for business use and are not directed to children. Contact us if you believe a child has provided personal information inappropriately.

We may update this policy to reflect changes to our services, practices or obligations. The current version is published on this page with its effective date. We will provide additional notice or seek consent where required for a material change.