Privacy Policy
Last Updated: September 8, 2026 • Version 3.0
This policy explains what data Make Accuracy Agency Infrastructure Systems handles when we audit, build, and operate automation infrastructure for your business — how we protect it, how long we keep it, who else touches it, and what you can ask us to do with it. It applies to our website, our booking and contact flows, and every workflow, agent, or integration we deploy on your behalf.
1. Commitment to Security & Confidentiality
Make Accuracy Agency Infrastructure Systems ("Make Accuracy", "we", "our") is dedicated to protecting client, agency, and operational telemetry data. We implement enterprise-grade encryption standard protocols (AES-256 at rest, TLS 1.3 in transit) across all n8n workflows, CRM hooks, and AI agent execution layers.
Security is treated as a delivery requirement, not an afterthought. Every engagement is scoped with a least-privilege access plan, a named owner for each credential, and a documented decommissioning path so that access ends when the engagement does.
Where we process personal data on your behalf — for example, leads flowing through a workflow we built — we act as a data processor and you remain the data controller. Where we process data for our own purposes, such as our website and sales enquiries, we act as the controller. A Data Processing Addendum (DPA) is available on request and is incorporated into every Statement of Work that touches personal data.
2. Data We Collect
We collect the minimum data required to audit, deploy, and maintain custom agency infrastructure:
- Contact Information: Name, professional email, company name, phone number where you provide one, and strategy booking preferences.
- Operational Metadata: API connection keys (stored in encrypted vault infrastructure), workflow logs, execution status metrics, and error traces.
- Technical Telemetry: Anonymised browser metadata, IP address logs for DDoS prevention and abuse detection, and application performance metrics.
- Engagement Records: Statements of Work, meeting notes, architecture diagrams, invoices, and support correspondence.
- Client End-User Data (processor role): Records that pass through the systems we build for you — typically lead names, contact details, enquiry text, and booking timestamps. We do not choose what this contains; your configuration does.
We do not intentionally collect special-category data (health, biometric, financial account numbers, government identifiers, or similar). If your use case requires processing that kind of data, it must be scoped explicitly in a Statement of Work with additional controls agreed in writing beforehand.
3. How We Use Data & Legal Bases
We use data only for the purposes below, each with a stated lawful basis under GDPR Article 6:
- Delivering the engagement — building, testing, and operating your automation systems. Basis: performance of a contract.
- Support and incident resolution — reading logs and traces to diagnose failures. Basis: performance of a contract.
- Security and abuse prevention — rate limiting, audit logging, and intrusion detection. Basis: legitimate interests.
- Service improvement — aggregated, de-identified performance metrics. Basis: legitimate interests.
- Billing and legal compliance — invoicing, tax, and statutory record-keeping. Basis: legal obligation.
- Sales and marketing communication — replying to enquiries and sending material you asked for. Basis: consent, withdrawable at any time.
We do not sell personal data, we do not share it with data brokers, and we do not use client operational data to build lookalike audiences or advertising profiles.
4. Credential & Secrets Handling
Deploying automation requires access to your systems. We handle that access under strict rules:
- Never in plain text. Credentials are never accepted or stored in email, chat, tickets, spreadsheets, or source code. If one is sent to us insecurely, we ask you to rotate it immediately.
- Vault storage only. Secrets live in encrypted vault infrastructure with access scoped to the named engineers on your engagement.
- Least privilege. We request the narrowest scope that will do the job — a dedicated integration user rather than an administrator seat, read-only where writes are not required.
- Prefer delegated auth. Where a provider supports OAuth or scoped service accounts, we use those instead of shared passwords. We never ask for your personal account password, and we will never ask for multi-factor codes outside a live, scheduled session you initiated.
- Rotation and revocation. Credentials are rotated on personnel change and revoked at engagement close, with written confirmation of decommissioning.
- Auditability. Access to production secrets is logged, and those logs are retained for the period in section 9.
5. AI Model & Automation Data Handling
Our systems call third-party AI models. How your data reaches those models matters, so we are explicit about it:
- No training on your data. We use enterprise or API tiers configured so that prompts and completions are not used to train third-party foundation models, and we do not use client data to train models of our own.
- Minimised prompts. Agents are designed to send the fields a task actually needs, rather than whole records, and to redact identifiers where the task does not require them.
- Provider disclosure. The model providers used in your build are named in your Statement of Work and listed in section 6. We tell you before we introduce a new one.
- Human review boundaries. Engineers may read execution traces to debug a failure. Where those traces contain personal data, access is limited to the assigned engineers and is logged.
- Output limitations. AI-generated output can be wrong. Systems we deploy that affect customers are built with review steps, confidence thresholds, or fallback paths appropriate to the risk, as agreed in scoping.
6. Sub-Processors & Third Parties
We rely on a small set of infrastructure providers to deliver the service. Each is bound by a written agreement with confidentiality and security obligations no weaker than those in this policy.
- Cloud hosting and compute — running workflow engines, agent runtimes, and application infrastructure.
- Workflow automation platform — n8n instances, self-hosted or managed depending on your deployment model.
- AI model providers — for agent reasoning and language tasks, on non-training tiers.
- Communications infrastructure — transactional email, SMS, and voice routing where your build uses them.
- Business operations — scheduling, invoicing, error monitoring, and product analytics.
A current, named sub-processor list is maintained and provided on request to privacy@makeaccuracy.agency. Clients under an active DPA are notified before a new sub-processor with access to their data is added, and may object on reasonable security grounds.
7. Our Security Program
We operate a defence-in-depth program built around SOC 2 Trust Services criteria. Controls are grouped below.
Technical controls
- AES-256 encryption at rest and TLS 1.3 in transit across all managed infrastructure.
- Secrets held in a dedicated encrypted vault, never in repositories or configuration files.
- Environment isolation — development, staging, and production are separated, and production data is never copied into lower environments.
- Mandatory multi-factor authentication and SSO on all internal accounts and provider consoles.
- Automated dependency and vulnerability scanning on our codebases, with a defined remediation window by severity.
- Centralised audit logging for access to production systems and client credentials.
- Encrypted, access-controlled backups with periodic restore testing.
Organisational controls
- Role-based access on a least-privilege, need-to-know basis, reviewed on a recurring schedule.
- Structured onboarding, signed confidentiality agreements, and same-day offboarding revocation.
- Peer review required on changes to production automation, with change history retained.
- Documented incident response, business continuity, and disaster recovery procedures.
- Annual security training for all personnel with production access.
- Vendor security review before any new sub-processor is granted client data access.
Responsible disclosure. If you believe you have found a vulnerability in our website or in infrastructure we operate, email security@makeaccuracy.agency. Please include reproduction steps and avoid accessing or modifying data that is not yours. We acknowledge reports within two business days and will not pursue action against good-faith research that follows this guidance.
No system is perfectly secure. These measures reduce risk; they are not a guarantee against every possible compromise, and this section describes our practices rather than offering a warranty.
8. Incident Response & Breach Notification
We maintain a written incident response plan covering detection, containment, eradication, recovery, and post-incident review.
- Triage. Suspected incidents are assigned a severity and an owner on detection, with containment prioritised over investigation.
- Client notification. Where a confirmed breach affects your data, we notify you without undue delay and in any case within 72 hours of confirmation, with what we know at the time.
- Content of notice. Nature of the incident, categories and approximate volume of data affected, likely consequences, measures taken, and a point of contact.
- Regulatory support. As processor, we assist you with your own notification obligations to supervisory authorities and affected individuals.
- Post-incident review. Every significant incident produces a written root-cause analysis and corrective actions, shared with affected clients on request.
9. Data Retention & Deletion
We keep data only as long as it serves the purpose it was collected for:
- Sales enquiries that do not convert — up to 24 months, then deleted.
- Client operational data in systems we host — for the life of the engagement, then deleted or exported to you within 30 days of termination.
- Workflow execution logs — 90 days by default, configurable per engagement.
- Security and access audit logs — 12 months, to support investigation.
- Contracts, invoices, and tax records — as required by applicable law, typically 7 years.
- Backups — deleted data persists in encrypted backups until they rotate out, normally within 35 days.
On written request we will delete your data ahead of these schedules, except where we are legally required to retain it. Deletion is confirmed in writing.
10. International Data Transfers
Our infrastructure and sub-processors may be located outside your country. Where personal data is transferred out of the UK, EEA, or another jurisdiction with transfer restrictions, we rely on an approved mechanism — an adequacy decision, or Standard Contractual Clauses with a transfer risk assessment — and apply encryption in transit and at rest throughout.
If your engagement requires data residency in a specific region, tell us during scoping. We can typically pin hosting and model routing to a nominated region, subject to provider availability, and will record that commitment in your Statement of Work.
11. Data Ownership & Non-Disclosure
You retain 100% ownership of all proprietary code, database schema, client lists, and AI prompt architecture created during your engagement. Make Accuracy never sells, licenses, or exposes agency client data to third-party model providers for model training purposes.
We treat your commercial information as confidential indefinitely, subject only to disclosure required by law. We will not name you as a client, publish metrics from your engagement, or use your logo in marketing without your prior written consent.
12. Your Rights & Data Requests
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. California residents additionally have the right to know what is collected, to delete, to correct, and to opt out of sale or sharing — we do not sell or share personal data as those terms are defined under the CCPA/CPRA.
- How to ask. Email privacy@makeaccuracy.agency from the address on file, or use the details in section 15.
- Verification. We verify identity before acting, proportionate to the sensitivity of the request.
- Timing. We respond within 30 days, extendable once by a further 30 days for complex requests, and we tell you if we need the extension.
- Cost. Free, unless a request is manifestly unfounded or excessive.
- Processor requests. If your data reached us through a client of ours, we route your request to that client as controller and support them in answering it.
- No retaliation. Exercising these rights will never affect the service or pricing you receive.
If you are unhappy with our response, you may lodge a complaint with your local supervisory authority. We would appreciate the chance to resolve it with you first.
14. Changes to This Policy
We update this policy as our infrastructure and obligations change. The version number and last-updated date at the top of this page always reflect the current revision. For material changes that affect how we handle client data, we notify active clients by email at least 30 days before the change takes effect, and prior versions are available on request.
15. Contact & Data Protection Enquiries
For privacy questions, data requests, DPA copies, or the current sub-processor list, contact privacy@makeaccuracy.agency. For vulnerability reports and security matters, contact security@makeaccuracy.agency. For anything else, our general address is hello@makeaccuracy.agency.
Related: see our Terms of Service for the commercial terms, SLAs, and security obligations governing engagements.