Privacy Policy

Last updated: 16 October 2026

Who We Are

Ecom Republic Pty Ltd (ABN 90 684 488 337), Surry Hills NSW, collects and handles personal information for our own enquiries, calls and client work. Privacy questions, access, correction and complaints: josh@ecomrepublic.com.

What We Collect

When you use a form, book a call, speak with us or browse the site, we may collect:

• Form details you type, such as name, email, phone, business model, website, challenges, niche and how you heard about us.
• Optional answers you choose to give, such as a monthly revenue band, an ad spend band, a main goal and a Shopify URL. Every extra question can be skipped.
• Attribution from the address you landed on: campaign parameters, click identifiers and the referring page. These are stored with the enquiry. A visitor ID that lasts across visits is used only where analytics and advertising tags are allowed.
• Pages and case studies you view in the same visit, stored with the enquiry without a long-lived identifier. Where analytics is allowed, pages from an earlier visit can be added. A page is kept once.
• Session recordings and heatmaps through Microsoft Clarity. Form fields are masked in those recordings. Visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland, and anyone whose country we cannot tell, are recorded only after they allow analytics. Other visitors are recorded unless they opt out or send a Global Privacy Control signal.
• Advertising measurement through the Meta pixel, Google tags (loaded through Google Tag Manager), Ryze and the Meta Conversions API. The same visitors must allow marketing before those tags or server events run. For everyone else they run unless you opt out or send a Global Privacy Control signal. A server event can include a hashed email and phone, and, where allowed, browser and click cookies.
• Cookieless page measurement through Vercel Analytics, which does not use an advertising cookie and runs whether or not you opt out.
• Booking, attendance and outcome details that iClosed sends to our systems.
• Call audio. Sales and client calls made through Aircall may be recorded, including a transcript of that call. We use a recording to keep a record of what was discussed and to improve how the team handles calls.

Why We Collect It

We use this information to answer your enquiry, decide whether a call is a fit, prepare for that call, provide services, keep records, and measure which pages and campaigns lead to enquiries and bookings. We do not sell personal information. Marketing email is separate from saving an unfinished form, and we do not email you just because a form was started.

Who We Share It With

We share personal information with service providers that host the site, store leads, send email, connect advertising accounts, book and record calls, and measure advertising. Staff who work the enquiry can see it inside ER OS, our customer system.

• Vercel, website hosting and cookieless analytics, United States.
• Convex, lead and client records, United States.
• Resend, email delivery, United States.
• Aircall, phone calls and call recordings, United States. Recordings for an Australian number may be stored in Australia.
• iClosed, call booking, United States, with booking records hosted in the European Union.
• Leadsie, advertising account connections, United Kingdom.
• Google Tag Manager, including Google advertising tags, United States.
• Ryze, on-site measurement, United States.
• Meta, advertising measurement, United States.
• Microsoft Clarity, session recordings, United States.

Overseas Disclosure

Several of those providers store or process information outside Australia. The countries are named above. Most of that processing is in the United States. Before we disclose personal information overseas we take reasonable steps to confirm the recipient will handle it in a way that is consistent with the Australian Privacy Principles. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, or if we cannot tell your country, analytics and marketing tags stay off until you accept them.

How Long We Keep It

• Page and case study views: 90 days, then removed.
• Enquiries that do not become a client: 24 months, then deleted or de-identified.
• Client records: 7 years, to meet company and tax record-keeping duties.
• Aircall call recordings: 12 months, then deleted.

Your cookie choice is stored in your browser until you change it or it expires.

Marketing Messages

Under Australian Privacy Principle 7 and the Spam Act 2003 (Cth), we send marketing email only with your consent, or where that Act otherwise allows it. Each marketing email identifies Ecom Republic Pty Ltd as the sender and includes an unsubscribe link. We action an unsubscribe within 5 business days. You can also withdraw consent by emailing josh@ecomrepublic.com.

Access And Correction

You can ask for a copy of the personal information we hold about you, and you can ask us to correct it. Email josh@ecomrepublic.com. We may need to confirm you are the person the record is about. If we refuse a request we will tell you why, where the law lets us.

Complaints

If you have a privacy complaint, email josh@ecomrepublic.com. We will respond within 30 days. If you are not satisfied with that response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Automated Decisions

From December 2026, Australian privacy law expects a clear statement when a computer program makes a decision that could significantly affect you. Our qualification rules can decide whether we offer a call, using the business model and revenue band you submit. A person can still review that outcome. Ask us and we will explain the information that was used.

Cookies And Consent

Visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland see a banner with Accept, Reject and Manage. If we cannot tell the country, we show the same banner. Analytics (including Google measurement, Microsoft Clarity and Ryze) and marketing (including the Meta pixel and Google Ads tags) stay off until you accept. Google Consent Mode starts as denied, and a rejection is passed through to Google and to Clarity.

Everyone else does not see a banner. Those same analytics and advertising tags run, and Google Consent Mode starts as granted, unless you have opted out or your browser sends Global Privacy Control. Each form ends with one line, "By continuing you agree to our Privacy Policy", and that link points here.

You can opt out at any time, wherever you are. Use Cookie Settings in the footer, or the control below. Opting out stops the Meta pixel, Clarity, Google tags and Ryze in this browser, and it stops later advertising events from this browser, including a booked call or a closed deal. The record of a form you submit, and cookieless Vercel Analytics, still run. Essential storage needed to remember this choice still runs.

To opt back in, use the same control, Cookie Settings, or clear this site's stored data in your browser. You can also email josh@ecomrepublic.com and ask us not to use your enquiry for advertising measurement.

European Union, United Kingdom And Switzerland

If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, we rely on these lawful bases:

• Consent, for analytics and advertising tags, and for marketing messages that need consent. You can withdraw consent at any time. Withdrawal does not affect processing that has already happened.
• Steps you ask us to take before a contract, when we answer an enquiry or book a call.
• Contract, when we provide services to you as a client.
• Legitimate interests, in keeping the site secure and understanding which pages lead to enquiries, where those interests do not override your rights.
• Legal obligation, for tax and company records we must keep.

You can ask for access, correction, deletion, restriction, or a copy of information you provided, and you can object to processing based on legitimate interests. Email josh@ecomrepublic.com.

You can complain to a regulator. In the United Kingdom that is the Information Commissioner's Office. In the European Union or the European Economic Area it is the supervisory authority in your country. In Switzerland it is the Federal Data Protection and Information Commissioner.

Where a provider in the United States receives this information, we use the EU-US Data Privacy Framework, the United Kingdom extension to that framework, or the Swiss-US Data Privacy Framework where the provider is certified. Otherwise we use Standard Contractual Clauses.

United States And California

We do not sell personal information. We do not share it for cross-context behavioural advertising except through the advertising tags described above. You can opt out of that sharing with Cookie Settings, the control on this page, or Global Privacy Control. A Global Privacy Control signal is treated as Reject for those tags and for advertising cookies. An explicit Accept after that signal is a fresh choice.

Security And Breaches

We limit access to lead records and protect them with the access controls of the systems that store them. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Contact

Privacy questions, access requests, correction requests and complaints: josh@ecomrepublic.com. Ecom Republic Pty Ltd, ABN 90 684 488 337, Surry Hills NSW.