Home →

▪ LEGAL

Privacy policy

Effective date: 2026-09-11 · Last updated: 2026-11-01

1. Who we are

Engaging Machine is a marketing agency based in the United Kingdom, operated as a sole-trader business; company registration details will be published here on incorporation. We provide marketing services — content production, search-engine optimisation, paid advertising analysis and advice, local-presence management, analytics and reporting — to business clients (“clients”).

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018): when we process personal data to run our own business (for example this website, or our billing) we are the controller. When we process personal data on a client’s instructions (for example reading their analytics and advertising performance data to report on it) we act as a processor for that client, under terms agreed with that client. Our registration with the Information Commissioner’s Office (ICO) is in progress; the registration number will be published here once issued.

Data protection contact: hello@engagingmachine.com

2. What this policy covers

This policy explains what personal data we collect, why, how long we keep it and how we protect it — including, specifically, the data we read through Google’s analytics and advertising APIs on behalf of clients who grant us view-only access, and how we would handle Meta and TikTok advertising data if a client engages us for those services.

3. Data we access through platform APIs

We read client analytics and advertising data through the platforms’ official programming interfaces. We only access accounts a client has explicitly granted us access to, and only with the view-only roles our services need. Our AI agents draft and analyse. They cannot send email, publish, or change anything in your accounts. A person reviews every report and every email before it is sent to you.

3.1 Google (Google Analytics 4, Google Search Console, Google Ads API, Places API)

Each client gets its own Google service account, used only for that client. The client adds it to their Google products with view-only roles: Google Analytics 4 Viewer, Search Console Restricted and Google Ads Read only. The client can remove our access at any time by removing the service account from each product. Through this access we read, on behalf of the client:

  • Advertising performance data from Google Ads: campaign, ad-group, ad and keyword settings, and impressions, clicks, conversions, cost and quality metrics. This access is read-only: we read performance data and do not change campaigns, budgets or bids.
  • Aggregated audience and analytics data from Google Analytics 4 and Search Console: page and query performance, aggregated demographic and interest reporting, conversion events.
  • Public Business Profile data: we read the client’s public Google listing (business information, rating and public reviews) through the Places API. We have no access to the client’s Business Profile account.

We also use our own Google Ads account’s Keyword Planner for keyword research. It receives seed keywords and site addresses, not data from client accounts.

We do not use Google API data to build or enrich profiles of identifiable individuals, and we do not sell it. Google user data is used solely to provide the contracted advertising and reporting services to the account’s owner.

3.2 Meta (Marketing API, Business Management API)

We do not currently connect to Meta’s APIs. If a client engages us to manage their Meta advertising, a service we are preparing, we would access through Meta’s APIs, on that client’s behalf and via Partner access to their Business Portfolio:

  • Ad account data: campaign, ad-set and ad configuration; budgets; delivery and performance metrics (impressions, reach, clicks, conversions, spend).
  • Business asset metadata: pages, ad accounts, pixels/datasets and catalogues shared with us by the client.
  • Aggregated audience insights as reported by Meta — never raw user-level identity data.
  • Conversion events, where the client asks us to send them to Meta’s Conversions API on their behalf (for example website leads or WhatsApp click events), configured to hash personal identifiers before transmission as Meta’s terms require.

For that service we would request only the permissions it requires (ads_management, business_management), use Platform Data solely to provide services to the business that owns it, never sell Platform Data, and comply with Meta’s Platform Terms and Developer Policies, including the annual Data Use Checkup.

3.3 TikTok (Marketing API)

We do not currently connect to TikTok’s APIs. If a client engages us to manage their TikTok advertising, a service we are preparing, we would access through TikTok’s APIs, on that client’s behalf: campaign configuration, creative assets and aggregated performance and reporting data for their advertiser account. We would not access or store TikTok end-user personal data beyond aggregated advertising metrics.

3.4 What we never do with platform API data

Across all platforms, we do not: sell or license the data; merge it across clients; use it to build advertising profiles of identifiable individuals for any party other than the account owner. Section 6 explains how long we keep it.

4. Data we collect directly

  • Client and prospect contact data: names, business email addresses, phone numbers and billing details — to deliver and invoice our services (lawful basis: performance of a contract; legitimate interests for business-to-business prospecting).
  • Website data: this site uses Google Analytics 4, loaded through Cloudflare Zaraz, for aggregated visitor analytics. Analytics runs only after you accept it in the consent banner; declining sets no analytics cookies. The enquiry form sends what you type to us by email via Web3Forms and is used only to respond to you.
  • Lead and enquiry data processed for clients: we do not handle clients’ leads today. If a client engages us to, we would process the form submissions, calls and messaging enquiries their campaigns generate as processor on the client’s behalf, pass them to the client, and agree retention with that client.

5. Purposes and lawful bases

We process personal data to: (a) deliver contracted marketing services; (b) measure and report campaign performance; (c) bill and administer client relationships; (d) meet legal obligations; and (e) secure our systems. Our lawful bases under UK GDPR Article 6 are contract performance, legitimate interests, legal obligation, or consent where sought. Data collected for a stated purpose is not reused for an incompatible one.

6. Retention

  • Platform API performance data: kept while we provide the service, for as long as it is needed for reporting, trend analysis and year-on-year comparison. We do not yet delete it on a fixed schedule; we are putting a retention schedule in place and will state it here.
  • Access credentials: each client’s access runs through a Google service account dedicated to that client. When an engagement ends we delete that service account, which ends every access grant at once. Copies of its key file can remain in our backups for up to 14 days.
  • Client contractual and billing records: retained as required by UK tax and company law (typically six years).

When an engagement ends, the client can ask us to return or delete the personal data we hold for them, and we will do so unless the law requires us to keep it.

7. Security measures

We apply appropriate technical and organisational measures (UK GDPR Article 32), including: encrypted transport (TLS) for traffic to third-party APIs; a dedicated Google service account for each client, with view-only roles, rather than shared passwords; and keys and passwords kept out of AI prompts, our code repository and our logs. The platform runs on dedicated infrastructure we own and operate, not shared cloud hosting. It is not exposed to the public internet: its database and internal services accept connections only from the server itself, and the dashboard is reachable only over our private, encrypted network. Only our founder can sign in. We notify affected clients and, where required, the ICO of any personal-data breach within the statutory windows.

8. Sharing and sub-processors

We share personal data only with: the client that owns the relevant accounts; Google, whose APIs we read client data through (and Meta or TikTok, only if a client engages us for advertising there, as described in section 3); and the service providers below, under those providers’ data-protection terms. We do not sell personal data.

  • Cloudflare (website hosting, Zaraz tag management and consent; hosting for sites we publish)
  • Google (Workspace email; Analytics, Search Console and Ads, read through a Google service account dedicated to each client; Places API for public Business Profile listings; Gemini, for image generation)
  • Web3Forms (enquiry-form delivery)
  • Resend, United States (emails to clients, including report PDFs)
  • Anthropic (Claude models for drafting and analysis of marketing content)
  • Slack (internal operational alerts to our founder: client name, run status and error text)
  • GitHub (private code hosting; publishing pull requests for sites we publish to)
  • Microsoft (Bing Webmaster Tools and IndexNow: site URLs, for sites we publish to)
  • WorkOS (client-portal sign-in, once the portal is offered; it is not yet available)

9. International transfers

Several of the services listed in section 8 process data outside the UK, principally in the United States. Where we process personal data for clients outside the UK — including South African clients — the flows and safeguards are set out in the terms agreed with that client; for South African clients this includes support for the client’s own cross-border obligations under POPIA.

10. Your rights

Under UK data protection law you may request access to your personal data, request rectification or erasure, object to or restrict processing, and request portability. Contact hello@engagingmachine.com; we respond within one month. You may complain to the Information Commissioner’s Office at ico.org.uk. Where we act as processor, we will refer or relay your request to the responsible client. Where a client’s audience is in South Africa, you also have rights under POPIA, exercisable against the client as responsible party; we assist as operator.

11. Changes to this policy

We post any changes on this page with an updated “Last updated” date. Material changes to how we use platform API data are also reflected in our platform attestations (for example Meta’s Data Use Checkup).

12. Contact

Engaging Machine · hello@engagingmachine.com