Privacy Policy

Version 1.7 · Effective 14 September 2026

This Privacy Policy describes how Mmedia Limited ("Mmedia", "we", "us") handles information in connection with our advertising platform and this website. It forms part of the agreement described in our Terms of Service. This policy is published in English and Chinese; if the two versions differ, the English version prevails.

Information we collect

Account and contact information. Your name, email address and business details when you subscribe or contact us. Payments are processed by Stripe; we do not store your card numbers.
Advertising account data. With your authorization, we access your advertising accounts (such as Google Ads and Meta) through official APIs to manage campaigns and retrieve performance reports. Access is granted via OAuth (Google) or Business Manager partner authorization (Meta), and you can revoke it at any time.
Business and website data. Your website content, product and service information, industry, target markets, and conversion data you choose to share, used to build and optimise your campaigns.
Blueprint requests. If you request a free Growth Blueprint, we collect the website address, email address, budget range and industry you submit, and use them to prepare and deliver the Blueprint and related onboarding communication. You can unsubscribe at any time.
Partner applications. If you apply to the Partner Program, we collect the name, company, country, email, website, LinkedIn, business type and the free-text answers you submit, and use them to assess the application and set up the partnership. We also record which version of the Partner Terms you accepted and when.
Referred leads. Partners in our Partner Program may give us the name, business name and business contact details of a business they are introducing to us. Partners are required to have told you and obtained your agreement before doing so. When we first contact you, we will say which Partner referred you, why we are contacting you, and how to stop further contact. You can ask us at any time to delete your details.
Client portal and the Mia assistant. If you use the client portal, we record your sign-in email and the pages you use. The portal includes an AI assistant ("Mia"). What you type into Mia is sent to an AI model provider so that it can generate the reply, together with a summary of your account's campaign data. Whatever you type is sent — please do not put contact details, passwords, payment details or anything else sensitive into the chat. Conversations are logged and are read by our team so we can follow up on anything you raise. Notes you leave through the portal are handled the same way.
Correspondence. If you email us, we keep the correspondence.
Website advertising and analytics tags. This website uses Google and Meta (Facebook) advertising tags, which set cookies to measure visits and build remarketing audiences, and Microsoft Clarity, which records how pages are used — which parts of a page people scroll to and click on — so we can find and fix what is confusing. Clarity is set to mask what you type: the contents of form fields, including your email address and company name, are never recorded. We can see that a field was used, not what was entered. We do not load these tags at all for visitors in the EU/EEA, the United Kingdom or Switzerland — no cookies are set, no session is recorded and no data is collected there. Where a visitor's location cannot be determined, we treat them as being in that group and load nothing. Elsewhere, you can opt out of personalised advertising at Google Ads Settings and Facebook Ad Preferences.
Enquiry records. When someone enquires through your website after clicking one of your ads, we keep a record of the ad click identifier, the time, the landing page and the page the enquiry was sent from, the keyword that triggered the ad, the company website entered on the form where a form asks for one, and any outcome you mark (qualified, not qualified, won and an optional amount). We do not keep the enquirer's name, phone number or email address. Click identifiers are cleared after 90 days. Outcomes you mark may be sent back to the advertising platforms you have authorised as offline conversions so those platforms can optimise towards real customers. What you report or mark never changes your plan price. Where your own website sends us these records, it does so under your privacy policy; we do not receive the enquirer's identity.

How we use information

To create, manage, and report on advertising campaigns on behalf of our clients.
To measure advertising performance against client-provided conversion data.
To handle billing, support and service communication.
If — and only if — you ticked the optional box when requesting a Growth Blueprint, to email you about new Mmedia services and occasional promotions. That box is never ticked for you, and requesting a Blueprint does not require it. We record what you agreed to, when, and the wording shown to you at the time. To withdraw at any point, email hello@mmedia.biz — we stop, and we keep your address on a do-not-contact list so it is not used again.

Third-party processing

We share data with third parties only as follows, and we do not sell personal information:

Advertising platforms you have authorized (such as Google and Meta), to run your campaigns.
AI model providers and keyword and market-data services, which receive advertising-related business data — website content, product information, industry, target markets, keywords and performance data — to produce campaign strategy, keyword research and ad copy. This processing is a necessary part of the services. For this campaign work we do not send your email address, phone number or other contact details to these providers. The one exception is the Mia assistant described above: there, the text you type is passed on as you wrote it, so anything you put in the chat goes with it. Requests to these providers are routed through our own API gateway at api.boostrail.com, operated by a company related to Mmedia.
Service infrastructure: Stripe for payments, Cloudflare and our own servers for hosting, email delivery providers for reports and notices, and DingTalk (operated from China) which delivers internal notifications of website enquiries, Blueprint requests and Partner applications to our team.

International transfers

Some of the providers above process data outside New Zealand, including in the United States and, for internal notifications, in China. We use providers that are subject to appropriate safeguards, consistent with the New Zealand Privacy Act 2020. If you would prefer your enquiry not to be routed through an overseas notification service, email privacy@mmedia.biz instead of using the website forms.

Google API Services

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Security and retention

API credentials are stored encrypted and used only for the authorized purpose. Campaign and performance data is retained for the duration of the client engagement and deleted on request, except for records we must keep by law (such as billing records).

Your rights

You may request access to, or correction of, personal information we hold about you by emailing privacy@mmedia.biz. We will respond within 20 working days, as the Privacy Act 2020 requires. You may also ask us to delete information we no longer need to keep.

If we have a privacy breach that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as soon as practicable after we become aware of it.

If you have a privacy concern we cannot resolve, you may complain to the Office of the Privacy Commissioner.

Changes

We may update this policy from time to time; each version carries its own number and effective date. Material changes will be notified by email.

Contact

Privacy questions: privacy@mmedia.biz