Privacy Policy

Pebble Creative Privacy Policy

8 Oct 2026 · @Brydie Bullard

Last updated: 8 October 2026

1. About this policy

Pebble Creative respects your privacy. This policy explains, in plain language, what personal information we collect, why we collect it, how we look after it and what choices you have.

In this policy, "Pebble Creative", "we", "us" and "our" means Brydie Bullard trading as Pebble Creative, ABN 98 835 022 003, a digital marketing agency based on the Mornington Peninsula, Victoria, Australia.

This policy applies when you visit our website, contact us, enquire about our services, subscribe to our updates, apply to work with us or become a client.

We aim to handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and to follow the Spam Act 2003 (Cth) for all marketing messages.

By using our website or giving us your personal information, you acknowledge the practices described in this policy.

2. Information we collect

We only collect information that is reasonably necessary for our work with you. Depending on how you deal with us, this may include:

Contact details: your name, business name, email address, phone number and business address or location

Business information: details about your business, goals, target audience and the services you're interested in

Client information: contracts, invoices, payment records, project notes and approvals

Communications: emails, messages, call notes and form submissions

Marketing preferences: whether you've agreed to hear from us and how you'd like us to contact you

Website and technical information: your IP address, browser and device type, pages visited, time on site, how you found us and how you interact with forms and links

Images and recordings: photos, video or audio captured during content shoots (see section 8)

Job applications: your CV, work history and referee details if you apply to work with us

Sensitive information. We don't ask for sensitive information, such as health details, religious beliefs or political opinions. If we ever need it for a specific project, we'll only collect it with your consent and only use it for that purpose. If you send us sensitive information we didn't ask for, we'll delete it or de-identify it where it's lawful and reasonable to do so.

3. How we collect it

We mostly collect information directly from you, for example when you:

Fill in a form on our website or book a strategy call

Email, call, message or DM us

Become a client or sign an agreement with us

Subscribe to our emails or SMS updates

Take part in a content shoot

Apply for a role with us

We also collect some information automatically when you use our website, through cookies and similar tools (see section 6).

Sometimes we receive information from other people, such as a client who gives us access to their business accounts, a referral partner who introduces you, or public sources like your website, Google Business Profile or social media pages. If we collect information about you from someone else, we'll take reasonable steps to let you know.

Staying anonymous. You're welcome to browse our website or ask a general question without telling us who you are, or by using a different name. We will need your real details to give you a quote, send an agreement or provide our services.

4. How we use it

We use personal information to:

Respond to your enquiry and book consultations or strategy calls

Prepare quotes, proposals, agreements and invoices

Deliver our services, including social media, advertising, SEO, email marketing and content shoots

Manage our relationship with you and keep you updated on your project

Process payments and keep business, tax and accounting records

Understand how people use our website and improve our services

Send marketing messages, but only where you've agreed to receive them

Assess job applications

Protect our business, systems and clients from misuse or fraud

Meet our legal obligations

We won't use your information for an unrelated purpose unless you'd reasonably expect it, you've agreed to it, or the law allows or requires it.

We do not sell your personal information.

5. Marketing emails and SMS

We'll only send you marketing emails or SMS if you've agreed to receive them, or if the law otherwise allows it (for example, where you're an existing client and the message relates to our services).

Every marketing message we send will clearly identify Pebble Creative and include an easy way to opt out:

Email: click the unsubscribe link at the bottom of any email

SMS: reply STOP

Anytime: email us at [email protected] and we'll remove you

We'll action your request within 5 working days. We keep a record of your consent and any opt-out so we can respect your choice.

Opting out of marketing won't affect messages we need to send you about an active project, agreement or invoice.

6. Cookies, pixels and analytics

Our website uses cookies and similar tools to understand how visitors use the site, measure our advertising and show relevant ads to people who've visited us. These tools may record pages visited, time on site, device and browser type, general location, how you arrived and how you interact with forms and links.

The tools we use include:

Google Analytics: to understand website traffic and behaviour

Google Ads: to measure and target our Google advertising

Meta Pixel and Conversions API: to measure and target our Facebook and Instagram advertising

GoHighLevel: to track form submissions and bookings

You're in control:

Block or delete cookies in your browser settings (some parts of the site may not work as well)

Opt out of Google Analytics with the Google Analytics opt-out add-on

Manage Google ads in My Ad Centre

Manage Facebook and Instagram ads in your Meta ad preferences

7. Client accounts and customer data

To do our job, clients often give us access to their social media, advertising, website, email and CRM accounts. Those accounts may hold personal information about our clients' own customers, such as names, emails, messages, comments and enquiry details.

When we handle this information, we act on our client's behalf and follow their instructions. We will:

Only access what we need to deliver the agreed services

Use partner or role-based access where the platform offers it, rather than shared logins

Only upload customer lists (for example, to build advertising audiences) when the client confirms they have the right to use them that way, and use the platform's secure matching tools to do it

Never use a client's customer data for our own marketing or for any other client

Keep access limited to Pebble Creative and our contracted team members, who are bound by confidentiality

Remove our access and return or delete client data when our work together ends, unless the law requires us to keep it

If you're a customer of one of our clients and have a question about your information, please contact that business directly. We're also happy to help where we can.

8. Content shoots, photos and testimonials

We film and photograph at clients' workplaces, job sites and in the studio. Where people can be identified, we:

Ask our client to let staff and customers know a shoot is happening

Get consent from anyone who is the clear focus of a photo or video before it's published

Never knowingly feature children without a parent or guardian's consent

We may show client work, names, logos and testimonials on our website and social media, but only with the client's permission.

If you appear in content we've created and would like it removed, contact us and we'll do our best to take it down from the channels we manage, or work with our client to do so.

9. AI tools and automation

We use artificial intelligence (AI) tools to help with tasks like drafting captions and copy, research, planning, summarising notes and analysing campaign results. We also use automation in our CRM, for example to send booking confirmations and follow-up emails.

When we use AI:

A real person reviews everything before it's published or sent

We're careful about what we enter into AI tools, avoid entering personal information wherever we can, and only use reputable providers

We don't use AI or automation to make decisions about you that significantly affect your rights or interests

If that last point ever changes, we'll update this policy to explain what decisions are made and how.

10. Who we share information with

We only share personal information when it's needed to run our business or deliver our services. This includes:

Our contracted team members, including virtual assistants, who are bound by confidentiality

The software and platforms we use (listed below)

Our accountant, bookkeeper, insurer and other professional advisers

Government agencies or regulators, where the law requires it

Anyone else, with your consent

What we use it for

Provider

CRM, forms, bookings, email and SMS

GoHighLevel

Email, documents and file storage

Google Workspace

Project and task management

ClickUp

Accounting and invoicing

Xero

Online payments

Stripe

Social media and advertising

Meta (Facebook and Instagram), Google Ads

Website analytics

Google Analytics

Website hosting

GoHighLevel

AI writing and research tools

Reputable AI providers

These providers handle information under their own privacy policies and security practices. We choose reputable providers and only give them what they need.

Payments. Card payments are processed securely by Stripe. We don't store full card details on our own systems.

11. Information stored overseas

Many of the platforms we use are based overseas, so your information is likely to be stored or accessed outside Australia. This is mainly in the United States, where providers such as Google, Meta, Stripe, Xero and GoHighLevel store data. Some providers may also use data centres in other countries, including Ireland, Singapore and the European Union.

We also work with contracted virtual assistants and freelancers who may access information from overseas. They are currently or may be based in countries including the Philippines, Kenya, Thailand, India, Indonesia, Vietnam, South Africa and New Zealand. They only access what they need for their work and are bound by confidentiality.

We take reasonable steps to make sure overseas providers protect your information, such as choosing established providers with strong security and confidentiality commitments.

12. Keeping your information safe

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include:

Strong, unique passwords and two-factor authentication on our accounts

Limiting access to the people who need it

Removing team members' access when they no longer need it

Using reputable, secure software providers

No online system is completely secure, so we can't guarantee the security of information sent to us over the internet.

If something goes wrong. If we become aware of a data breach involving your information, we'll act quickly to contain it and assess the risk. If it's likely to cause you serious harm, we'll let you know as soon as practicable, explain what happened and suggest steps you can take. We'll also notify the Office of the Australian Information Commissioner (OAIC) where required.

13. How long we keep it

We keep personal information only as long as we need it. As a guide:

Enquiries that don't go ahead: up to 2 years, so we have context if you get back in touch

Client records, invoices and agreements: at least 5 years after our work ends, as required for tax and business records

Marketing lists: until you unsubscribe, then only a record of your opt-out

Job applications: up to 12 months, unless you ask us to delete it sooner

When we no longer need information, we securely delete it or remove anything that identifies you.

14. Your rights and choices

You can ask us at any time to:

Tell you what personal information we hold about you and give you a copy

Correct information that's out of date, incorrect or incomplete

Stop sending you marketing messages

Delete your information, where we're not required to keep it

Just email us at [email protected]. We may need to confirm your identity before we act on your request. We'll respond within 30 days and won't charge you for making a request.

If we can't do what you've asked, for example because the law requires us to keep certain records, we'll explain why in writing.

15. Complaints

If you're unhappy with how we've handled your personal information, please tell us first so we can put it right. Email [email protected] with as much detail as you can, including dates and any relevant messages.

We'll acknowledge your complaint within 5 working days and aim to resolve it within 30 days.

If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

16. Other things to know

Other websites. Our website and content may link to other websites and social media platforms. We're not responsible for their privacy practices, so please check their policies before sharing your information.

Children. Our services are for businesses and adults. We don't knowingly collect personal information from anyone under 18 for marketing. If you think a child has given us their details, let us know and we'll delete them.

Changes to this policy. We may update this policy as our business, tools or the law change. The latest version will always be on our website, with the date it was last updated at the top. If we make a significant change, we'll let our clients know.

17. Contact us

For any privacy question, to access or correct your information, to opt out of marketing or to make a complaint, contact our privacy contact:

Brydie Bullard, Pebble Creative

ABN: 98 835 022 003

Location: Mornington Peninsula, Victoria, Australia

Email: [email protected]

Phone: 0421 923 912

Website: www.pebblecreative.com.au