Privacy Policy

This Privacy Policy explains how Halcyon Agency Pty Ltd (ABN 53 675 138 708, "Halcyon", "we", "us") collects, uses, shares, and protects personal information in connection with Sequence, including its web app, browser extension, integrations, support, and related services (the "Service").

Halcyon is generally the controller of account, billing, product analytics, and support data. For content, social account data, and other personal information that a customer submits for its own purposes, Halcyon may act as that customer's processor or service provider. The customer remains responsible for its instructions and legal basis.

1. Who we are

Halcyon Agency Pty Ltd is based in Sydney, Australia. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We also apply rights and safeguards required by other privacy laws where they apply to our processing.

Contact: hello@sequencesocial.com
Website: sequencesocial.com

2. Information we collect

2.1 Account and workspace information

• Name, email address, profile image, authentication method, role, invitations, and workspace membership.
• Preferences such as timezone, appearance, notification settings, and selected billing currency.
• Messages and information you provide to support or through product feedback.

2.2 Content and collaboration data

• Captions, scripts, plans, documents, comments, approvals, tasks, images, videos, thumbnails, schedules, and brand guidance.
• Collaboration presence, edits, mentions, assignments, review history, and audit events.
• AI prompts, selected context, files, generated output, and usage records when you choose an AI feature.

2.3 Connected platforms and integrations

When you connect a social network or another integration, we receive data within the permissions you approve. This may include OAuth access and refresh tokens, account identifiers, profile information, posts, media, publishing status, engagement and audience metrics, comments, mentions, and inbox conversations. Sequence does not receive your password for the connected service.

Where inbox features are enabled, Sequence may process private messages, replies, conversation metadata, response drafts, moderation state, and assignments. Workspace permissions control who can access those functions.

2.4 Billing data

We collect plan, quantity, subscription status, billing currency, transaction references, tax location information, and limited payment details returned by Stripe. Full card numbers are handled by Stripe and are not stored by Sequence.

2.5 Device, security, and usage data

• IP address, approximate country and region, browser, device, operating system, request timing, session and security events, and error diagnostics.
• Pages and features used, referring source, campaign attribution, button and workflow events, and real-user performance measurements such as page loading and responsiveness.
• Rate-limit, fraud prevention, and abuse signals.

2.6 Browser extension data

The Sequence Capture browser extension runs only on the social sites it supports: Instagram, TikTok, YouTube, LinkedIn, X, Threads, Facebook, and the Meta Ad Library. On those pages it reads the page only to find the post you choose to save, its public link and, for a Meta Ad Library ad, what the ad shows. It does not send posts you do not save, and it does not monitor other browsing.

• When you save a post: the post's public URL, the workspace and brand you chose, and limited page context (for a post opened on its own page, the page title and preview image).
• When you save an Instagram ad: ads in your feed have no public link, so the extension sends the ad's caption and the advertiser's handle. We use them to find the ad in the Meta Ad Library, a search run by our data provider Apify.
• When you save a Meta Ad Library ad: Meta shows some ads only to signed-in Facebook users, so the extension also sends what the ad shows on your screen: its text, the advertiser's name, and links to its video, cover image or images on Meta's servers. We copy that media to our storage so the ad stays in your library after Meta's links expire. Until our own lookup confirms the ad, it appears only in the libraries of the brands that saved it, not in Sequence's shared Explore catalogue.
• Stored in your browser: a Sequence sign-in token, your workspaces and brands with small copies of their logos, the brand you last used, and a list of up to 500 posts saved from that browser so they show as saved. Disconnect removes them.
• Stored by Sequence: a sign-in record for each browser (when it was created and last used, and the browser's user agent), so that browser can be signed out on our servers when you disconnect, and a record of each Instagram ad lookup while it runs.
• Diagnostics: if the extension cannot find posts or buttons on a supported site, or cannot read an ad's text or media, usually because the site changed, it sends a short report naming the problem, the site, and the extension version, at most once every six hours. Reports contain no post content, page addresses, or browsing history.

The extension does not collect connected-platform passwords, and we do not sell extension data or use it for advertising.

3. How we use information

• Provide authentication, workspaces, collaboration, planning, publishing, analytics, inbox, billing, support, and integrations.
• Process instructions, publish approved content, retrieve platform data, and keep integrations connected.
• Provide AI features you request and measure the associated allowance and cost.
• Secure the Service, prevent abuse, enforce permissions, investigate incidents, and comply with law.
• Measure reliability and performance by country, diagnose errors, and improve product usability.
• Send service, security, billing, onboarding, and marketing communications where permitted. You can opt out of non-essential marketing.
• Understand signup attribution and compensate approved referral partners.

Depending on the context and applicable law, we rely on performance of a contract, legitimate interests in operating and securing the Service, compliance with legal obligations, or consent. Where consent is required, you may withdraw it without affecting earlier lawful processing.

4. Cookies and local storage

Sequence uses essential cookies and browser storage for sign-in, security, preferences, signup and checkout continuity, and integration state. We also use PostHog for product analytics and performance measurement and Dub for referral attribution. These services may use cookies or local storage. Where law requires consent for non-essential technologies, we will request it or apply an available consent signal before using them. Browser settings can remove stored data, but blocking essential storage may prevent the Service from working.

5. Service providers and recipients

We disclose data only as needed to operate the Service, follow your instructions, or comply with law. Our principal provider categories and current providers include:

• Hosting and database: Vercel and Supabase.
• Public social content retrieval: Apify, when you save a public post or ad to an Inspiration library.
• File delivery, security, and storage: Cloudflare.
• Payments and tax calculation: Stripe.
• AI processing: Anthropic and OpenAI, only when the relevant feature is used.
• Collaboration: Liveblocks.
• Social connection, publishing, inbox, and analytics infrastructure: Zernio and the connected social platforms, including Meta, LinkedIn, Google/YouTube, TikTok, and Pinterest.
• Product analytics and attribution: PostHog and Dub.
• Error monitoring and rate limiting: Sentry and Upstash.
• Transactional, lifecycle, and campaign email: Resend.
• Shared support mailbox: Google Workspace, when you email or reply to Sequence support.

Providers may process account identifiers, content, technical data, or other information appropriate to their role. We require providers to protect data and use it only for contracted services. We may also disclose information to professional advisers, an acquirer in a business transaction, authorities where legally required, or another party with your direction or consent. We do not sell personal information or content.

Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

6. AI data handling

When you invoke an AI feature, we send only the prompt, selected workspace context, and files needed for that request to the configured AI provider. Do not include sensitive personal information unless necessary and authorized. We configure provider access and retention controls where available, but provider processing remains subject to its contractual terms and applicable law.

When you talk with Skye, Sequence's AI assistant, by voice, your browser sends microphone audio to OpenAI only while you are speaking so it can be transcribed, and the text of Skye's replies is sent to OpenAI to be spoken. The voice you hear is AI-generated. Sequence does not store the audio; the transcribed words are kept in the chat like typed messages.

When Skye researches the web for you, Anthropic runs the search and reads the pages, so our servers never fetch them. Skye is instructed not to put your brand data or private information into searches, and the links it used are saved with the chat.

7. International transfers

Sequence's primary application and database infrastructure is in Sydney, Australia. Cloud storage and the providers listed above may process or support data in Australia, the United States, Europe, Asia, and other locations. This means your information may be subject to laws different from those in your country.

Where required, we use contractual protections and recognized transfer mechanisms, such as standard contractual clauses, and assess provider safeguards. We also take reasonable steps required by Australian privacy law for overseas disclosures. Contact us if you need more information about safeguards for a particular transfer.

8. Security

We use access controls, encrypted transport, encryption of sensitive OAuth token fields, role and permission checks, audit logging, monitoring, backups, and incident response measures. No internet service can guarantee absolute security. If a breach is likely to cause serious harm, we will notify affected people and regulators where required by law.

9. Retention and deletion

We retain information for as long as needed to provide the Service, meet legal and accounting duties, resolve disputes, enforce agreements, and maintain security. Retention depends on data type, sensitivity, workspace instructions, and plan status. When an account, workspace, or connection is deleted, data is removed or de-identified through our operational deletion process, while limited records may remain in security logs, financial records, legal holds, and rolling backups until their retention periods expire.

Disconnecting a social account stops new access through that connection and starts token revocation and deletion workflows. Browser extension sign-in records are deleted 30 days after they expire or are disconnected, and Instagram ad lookup records are deleted after 30 days. Workspace owners can request account or workspace deletion at hello@sequencesocial.com. Platform-specific deletion instructions are also available on our Data Deletion page.

10. Your choices and rights

Subject to applicable law, you may ask us to:

• access, correct, or delete your personal information;
• provide a portable copy of information you supplied;
• restrict or object to certain processing;
• withdraw consent where processing relies on consent; or
• explain or review a significant automated decision, if one applies.

Email hello@sequencesocial.com. We may verify your identity and, where we process data for a customer, refer the request to that customer. You may complain to the Office of the Australian Information Commissioner or, if applicable, your local data protection authority. You will not be discriminated against for exercising a privacy right.

11. Children

Sequence is for business users aged 18 or older and is not directed to children. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.

12. Changes and contact

We may update this Privacy Policy as our practices or legal obligations change. We will provide reasonable notice of material changes. The date above shows the latest revision.

Email: hello@sequencesocial.com
Post: Halcyon Agency Pty Ltd, Alexandria, NSW, Australia

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner or your local privacy regulator.