Privacy Policy

Last updated: 21 September 2026

1. Who we are

Results Media CRM (“the Service”) is operated by Results Media (“we”, “us”), an Australian business based in Victoria. We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Questions and requests under this policy go to contact@resultsmedia.au.

2. The two kinds of information we hold

The Service is hosted software: we run it, and businesses (“Clients”) use it to manage their own customers and leads. That means we hold two distinct kinds of personal information, and our role is different for each.

Account information is what we collect from Clients and their team members directly: name, email address, phone number, login credentials and two-factor authentication details, billing contact and payment details (handled by our payment processor), support correspondence, and usage and access logs. For this information, we are the entity that decides how it is used.

Client data is everything a Client and their team put into their account: contact and lead records, notes, tasks, pipeline activity, messages sent and received through the Service (email, SMS, chat), form submissions from the Client’s own website, and, where the Client enables it, call recordings and transcripts. The Client controls this information and decides why it is collected and how it is used. We process it only to provide the Service to that Client, on their instructions, and we do not use it for our own purposes.

If you are a customer or lead of one of our Clients and have a question about how they handle your information, please contact that business directly. If you cannot reach them, contact us and we will help you do so.

3. How we use account information

To create and secure your account, provide the Service and support, process payments, send service and security notices (including two-factor login codes), detect and prevent misuse, and meet our legal obligations. We do not sell personal information. We do not use account information or Client data to build advertising profiles, and we do not run third-party advertising or analytics trackers inside the logged-in Service.

4. Where your data is stored

Client data and account records are stored in Google Cloud’s australia-southeast1 region (Sydney, Australia). The application itself runs in Sydney. Data is encrypted in transit using TLS and encrypted at rest by Google Cloud.

Login identity records (email address and password hash) are managed by Google’s identity service, which may store that information outside Australia. No Client contact data is held there.

5. Service providers and overseas disclosure

We use a small number of specialist providers to run the Service. Each receives only what it needs to perform its function, and each is bound by contractual and privacy obligations. Some are located outside Australia, principally in the United States, and where they are, information sent to them is an overseas disclosure under APP 8.

• Google Cloud / Firebase — database and identity (Sydney; identity service as noted above).
• Vercel — application hosting (Sydney compute; United States company).
• Twilio — SMS and phone calls (United States). Used only when a Client uses those channels.
• Vapi and OpenAI — AI-assisted calling, transcription and summarisation (United States). Used only when a Client turns those features on. Data sent to AI providers is not used to train their models.
• Resend — transactional email such as login codes and notifications (United States).
• Stripe — payments and billing (United States / Ireland). We never see full card numbers.
• Upstash — background job scheduling (United States).
• Meta and Google — only where a Client connects their own ad account or calendar; we act on their authorisation.

We do not send Client data to providers in jurisdictions without comparable privacy protections. If we add or change a provider that handles Client data, we will update this list before doing so.

6. Security

Every login to the Service requires a password and a second factor. Sessions time out after an hour of inactivity. Each Client’s data is isolated from every other Client’s at the database level, and access is recorded in an audit log. The database is backed up daily with point-in-time recovery, and the Service undergoes periodic independent security review. No system is perfectly secure; we take reasonable steps in line with APP 11 and will keep improving them.

7. Data breaches

If we become aware of a data breach that is likely to result in serious harm to individuals, we will assess it promptly, notify affected Clients without undue delay so they can meet their own obligations, and notify the Office of the Australian Information Commissioner and affected individuals where the Notifiable Data Breaches scheme requires it.

8. Retention and deletion

Client data is retained for as long as the Client’s account is active. Clients can delete individual records at any time. When an account is closed, we delete or de-identify its Client data within 90 days, except where we are required by law to keep it or it is held in backups, which expire on a rolling schedule. Account and billing records are kept for as long as needed to provide support and to meet legal and tax obligations.

9. Access, correction and complaints

You may ask to access or correct the personal information we hold about you by emailing contact@resultsmedia.au. We will respond within 30 days. If you are a customer of one of our Clients, we will pass your request to them where the information is in their account, since they control it.

If you believe we have mishandled your personal information, contact us first and we will investigate and respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Marketing messages sent through the Service

Clients who send email or SMS through the Service are responsible for having consent to do so under the Spam Act 2003. Every marketing message sent through the Service carries an unsubscribe mechanism, and opt-outs are honoured automatically across the Client’s account.

11. Changes to this policy

We will post any changes here with a new “Last updated” date, and will tell Clients directly about changes that affect how their Client data is handled.

12. Contact

Results Media — contact@resultsmedia.au