This Privacy Policy explains how Halcyon Agency Pty Ltd (ABN 53 675 138 708, "Halcyon", "we", "us") collects, uses, shares, and protects personal information in connection with Sequence, including its web app, browser extension, integrations, support, and related services (the "Service").
Halcyon is generally the controller of account, billing, product analytics, and support data. For content, social account data, and other personal information that a customer submits for its own purposes, Halcyon may act as that customer's processor or service provider. The customer remains responsible for its instructions and legal basis.
1. Who we are
Halcyon Agency Pty Ltd is based in Sydney, Australia. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We also apply rights and safeguards required by other privacy laws where they apply to our processing.
Contact: hello@sequencesocial.com
Website: sequencesocial.com
2. Information we collect
2.1 Account and workspace information
- Name, email address, profile image, authentication method, role, invitations, and workspace membership.
- Preferences such as timezone, appearance, notification settings, and selected billing currency.
- Messages and information you provide to support or through product feedback.
2.2 Content and collaboration data
- Captions, scripts, plans, documents, comments, approvals, tasks, images, videos, thumbnails, schedules, and brand guidance.
- Collaboration presence, edits, mentions, assignments, review history, and audit events.
- AI prompts, selected context, files, generated output, and usage records when you choose an AI feature.
2.3 Connected platforms and integrations
When you connect a social network or another integration, we receive data within the permissions you approve. This may include OAuth access and refresh tokens, account identifiers, profile information, posts, media, publishing status, engagement and audience metrics, comments, mentions, and inbox conversations. Sequence does not receive your password for the connected service.
Where inbox features are enabled, Sequence may process private messages, replies, conversation metadata, response drafts, moderation state, and assignments. Workspace permissions control who can access those functions.
2.4 Billing data
We collect plan, quantity, subscription status, billing currency, transaction references, tax location information, and limited payment details returned by Stripe. Full card numbers are handled by Stripe and are not stored by Sequence.
2.5 Device, security, and usage data
- IP address, approximate country and region, browser, device, operating system, request timing, session and security events, and error diagnostics.
- Pages and features used, referring source, campaign attribution, button and workflow events, and real-user performance measurements such as page loading and responsiveness.
- Rate-limit, fraud prevention, and abuse signals.
2.6 Browser extension data
When you choose to save a supported social post, the extension sends the selected public URL, destination workspace and brand, and limited page context needed to process the request. It stores a signed Sequence token and your recent destination selection locally. It does not collect connected-platform passwords or continuously monitor unrelated browsing activity.
3. How we use information
- Provide authentication, workspaces, collaboration, planning, publishing, analytics, inbox, billing, support, and integrations.
- Process instructions, publish approved content, retrieve platform data, and keep integrations connected.
- Provide AI features you request and measure the associated allowance and cost.
- Secure the Service, prevent abuse, enforce permissions, investigate incidents, and comply with law.
- Measure reliability and performance by country, diagnose errors, and improve product usability.
- Send service, security, billing, onboarding, and marketing communications where permitted. You can opt out of non-essential marketing.
- Understand signup attribution and compensate approved referral partners.
Depending on the context and applicable law, we rely on performance of a contract, legitimate interests in operating and securing the Service, compliance with legal obligations, or consent. Where consent is required, you may withdraw it without affecting earlier lawful processing.
4. Cookies and local storage
Sequence uses essential cookies and browser storage for sign-in, security, preferences, signup and checkout continuity, and integration state. We also use PostHog for product analytics and performance measurement and Dub for referral attribution. These services may use cookies or local storage. Where law requires consent for non-essential technologies, we will request it or apply an available consent signal before using them. Browser settings can remove stored data, but blocking essential storage may prevent the Service from working.
5. Service providers and recipients
We disclose data only as needed to operate the Service, follow your instructions, or comply with law. Our principal provider categories and current providers include:
- Hosting and database: Vercel and Supabase.
- File delivery, security, and storage: Cloudflare.
- Payments and tax calculation: Stripe.
- AI processing: Anthropic and OpenAI, only when the relevant feature is used.
- Collaboration: Liveblocks.
- Social connection, publishing, inbox, and analytics infrastructure: Zernio and the connected social platforms, including Meta, LinkedIn, Google/YouTube, TikTok, and Pinterest.
- Product analytics and attribution: PostHog and Dub.
- Error monitoring and rate limiting: Sentry and Upstash.
- Transactional, lifecycle, and campaign email: Resend.
- Shared support mailbox: Google Workspace, when you email or reply to Sequence support.
Providers may process account identifiers, content, technical data, or other information appropriate to their role. We require providers to protect data and use it only for contracted services. We may also disclose information to professional advisers, an acquirer in a business transaction, authorities where legally required, or another party with your direction or consent. We do not sell personal information or content.
Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
6. AI data handling
When you invoke an AI feature, we send only the prompt, selected workspace context, and files needed for that request to the configured AI provider. Do not include sensitive personal information unless necessary and authorized. We configure provider access and retention controls where available, but provider processing remains subject to its contractual terms and applicable law.
7. International transfers
Sequence's primary application and database infrastructure is in Sydney, Australia. Cloud storage and the providers listed above may process or support data in Australia, the United States, Europe, Asia, and other locations. This means your information may be subject to laws different from those in your country.
Where required, we use contractual protections and recognized transfer mechanisms, such as standard contractual clauses, and assess provider safeguards. We also take reasonable steps required by Australian privacy law for overseas disclosures. Contact us if you need more information about safeguards for a particular transfer.
8. Security
We use access controls, encrypted transport, encryption of sensitive OAuth token fields, role and permission checks, audit logging, monitoring, backups, and incident response measures. No internet service can guarantee absolute security. If a breach is likely to cause serious harm, we will notify affected people and regulators where required by law.
9. Retention and deletion
We retain information for as long as needed to provide the Service, meet legal and accounting duties, resolve disputes, enforce agreements, and maintain security. Retention depends on data type, sensitivity, workspace instructions, and plan status. When an account, workspace, or connection is deleted, data is removed or de-identified through our operational deletion process, while limited records may remain in security logs, financial records, legal holds, and rolling backups until their retention periods expire.
Disconnecting a social account stops new access through that connection and starts token revocation and deletion workflows. Workspace owners can request account or workspace deletion at hello@sequencesocial.com. Platform-specific deletion instructions are also available on our Data Deletion page.
10. Your choices and rights
Subject to applicable law, you may ask us to:
- access, correct, or delete your personal information;
- provide a portable copy of information you supplied;
- restrict or object to certain processing;
- withdraw consent where processing relies on consent; or
- explain or review a significant automated decision, if one applies.
Email hello@sequencesocial.com. We may verify your identity and, where we process data for a customer, refer the request to that customer. You may complain to the Office of the Australian Information Commissioner or, if applicable, your local data protection authority. You will not be discriminated against for exercising a privacy right.
11. Children
Sequence is for business users aged 18 or older and is not directed to children. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.
12. Changes and contact
We may update this Privacy Policy as our practices or legal obligations change. We will provide reasonable notice of material changes. The date above shows the latest revision.
Email: hello@sequencesocial.com
Post: Halcyon Agency Pty Ltd, Alexandria, NSW, Australia
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner or your local privacy regulator.