Privacy Policy

Effective date: August 6, 2026
Last updated: August 6, 2026

Sixth Media, LLC (“Sixth Media,” “we,” “us,” or “our”) is a Utah limited liability company providing digital marketing, analytics, data operations, and software development services. This Privacy Policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the choices you have.

This policy covers:

• sixthmedia.com — our public marketing website.
• Insight CRM (insight.sixthmedia.com) — our internally built customer relationship management and reporting platform, which we host in our own Google Cloud environment and use to manage our client relationships and to build advertising performance dashboards.
• Our advertising and analytics platform connections — the read-only integrations Insight CRM makes with Meta, Google Ads, Google Analytics 4, Google Search Console, and Google Sheets.
• Our internal agent tooling — the Model Context Protocol (“MCP”) connectors our team uses to operate client marketing accounts.

If you are a visitor to a website we build or manage for one of our clients, that website is governed by that client’s privacy policy, not this one. We act as a service provider to them.

1. A note on whose information this is

Most of the information we handle is business information about companies we work with, not consumer information. It is useful to keep three groups separate:

For the third group, we process data only to deliver the services our client has engaged us for. We do not use it for our own purposes, we do not sell it, and we do not add it to our own marketing lists. Requests to access or delete that data should go to the business you interacted with; we will assist them in responding.

2. Information we collect

2.1 Information you give us directly

• Contact and inquiry details — name, business name, email address, phone number, website, and anything else you choose to include when you complete a form on sixthmedia.com, email us, or call us.
• Meeting bookings — when you schedule time with us through our embedded Calendly scheduler, Calendly collects your name, email address, selected time, and any answers you give to its booking questions.
• Client relationship records — for clients and prospective clients, we maintain business account details (company name, industry, website, business phone, billing address), named points of contact (name, business email, business phone, job title, and occasionally a LinkedIn profile URL), deal and pipeline notes, service agreements, project records, and billing and revenue history.
• Meeting recordings and notes — with notice to participants, we may record and transcribe client calls to produce summaries and action items.

2.2 Information collected automatically on our website

When you visit sixthmedia.com, we and our analytics providers may collect:

• IP address, approximate location derived from it, browser type, device type, and operating system.
• Pages viewed, referring URL, time spent, and interactions such as clicks and form starts.
• Cookies and similar identifiers, including advertising click identifiers passed in the URL (for example gclid, fbclid, msclkid, wbraid, gbraid, ttclid, li_fat_id) and UTM campaign parameters.

Our website runs on WordPress and loads these technologies through Google Tag Manager (container GTM-TBG6RK6). We also use Google reCAPTCHA to protect our forms from automated abuse; reCAPTCHA collects hardware and software information and interaction data and sends it to Google for analysis. Your use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service.

If you arrive from an advertisement, we may store the associated click identifier against your inquiry so we can measure which campaigns generate business for us.

2.3 Information in Insight CRM

Insight CRM is our own application. It stores the client relationship records described above, along with:

• User accounts for our staff — name, work email address, role, permissions, and sign-in activity.
• Documents — HTML documents such as growth plans, proposals, and reports, attached to an account, deal, lead, or user. Some documents are deliberately shared through a public link so a client can view them without signing in; those links can optionally be password-protected.
• Marketing attribution fields — UTM parameters and advertising click identifiers associated with an account record.
• Revenue records — monthly recurring revenue snapshots, service lines, project revenue, and billing history imported from our payment processors.

2.4 Advertising and analytics data from connected platforms

Where a client authorizes it, Insight CRM connects to advertising and analytics platforms to build reporting dashboards. These connections are read-only. We request the minimum scope needed to read reporting data, and we do not request permission to create, edit, or delete anything in a connected account.

The data we retrieve is aggregate performance data, not personal data. A typical record is one row per day per campaign containing the campaign ID, campaign name, spend, impressions, clicks, conversion counts, and conversion values. We do not retrieve, and these permissions do not give us access to, individual user profiles, audience member lists, lead form submissions, private messages, or any data that identifies a specific person who saw or clicked an ad.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3. How we use information

We use the information described above to:

• Respond to inquiries, schedule meetings, and provide quotes and proposals.
• Deliver, operate, support, and improve our services.
• Build performance dashboards and reports for our clients.
• Manage our client relationships, contracts, billing, and collections.
• Measure the effectiveness of our own marketing and understand which channels bring us business.
• Secure our systems, prevent fraud and abuse, and debug problems.
• Comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We do not use advertising platform data — including any data obtained through the Meta Marketing API — to build profiles of individuals, to retarget individuals, to train machine learning models for resale, or for any purpose other than reporting to the client whose account the data came from.

Legal bases (for individuals in the EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: legitimate interests (operating and marketing our business, securing our systems); performance of a contract (delivering services to clients); consent (non-essential cookies and marketing email, which you may withdraw at any time); and legal obligation (tax and accounting records).

4. Meta Platform data

Because we operate a Meta app, we set out our handling of Meta Platform data separately and in plain terms.

What the app is. Insight CRM includes an integration, registered with Meta as the app “Insight,” that lets an authorized administrator of a Meta ad account connect that account to a reporting dashboard.

What we access. After a user completes Meta’s OAuth consent screen, we call only two Meta endpoints:

1. GET /me/adaccounts — to list the ad accounts the connecting user administers, returning each account’s name and ID, so the user can choose which one to connect.
2. GET /{ad-account-id}/insights at campaign level with a daily breakdown — returning campaign_id, campaign_name, spend, impressions, clicks, actions, action_values, and date_start.

What we do not access. We do not request or receive Lead Ads submissions, Custom Audience membership, ad creative assets, page or Instagram content, comments, messages, user profiles, friend lists, or any breakdown that identifies an individual person.

How it is stored. Access tokens are encrypted with AES-256-GCM before being written to our database, and the encryption key is held in Google Cloud Secret Manager. The metrics themselves are stored in a private Google BigQuery dataset in our Google Cloud project, accessible only to authorized Sixth Media personnel and to the client the data belongs to.

How long we keep it. Our sync refreshes a rolling 30-day window and overwrites prior values for that window. Historical metrics are retained for the life of the client relationship so year-over-year reporting remains possible, and are deleted on request or when the relationship ends.

How to disconnect. You can revoke our access at any time — see Deleting your data.

We comply with the Meta Platform Terms and Developer Policies, and we do not transfer Meta Platform data to any data broker, advertising network, or monetization service.

5. Cookies and tracking

We use cookies and similar technologies for three purposes:

• Strictly necessary — keeping you signed in to Insight CRM, maintaining session security, and protecting forms with reCAPTCHA. These cannot be switched off.
• Analytics — understanding how our website and application are used, primarily through Google Analytics 4 delivered via Google Tag Manager.
• Advertising measurement — attributing inquiries to the campaign that produced them.

You can control cookies through your browser settings, and you can opt out of Google Analytics using Google’s browser add-on. Blocking cookies may prevent parts of Insight CRM from working.

We currently do not respond to browser “Do Not Track” signals, as no common standard for them has been adopted. We do honor Global Privacy Control (GPC) signals where required by law.

6. How we share information

We do not sell personal information. We share it only in these circumstances:

6.1 Service providers

We use the following categories of vendors, each of which processes data on our behalf under contract:

6.2 With our clients

Reporting, deliverables, and account records relating to a client’s business are shared with that client and, where relevant, with partner agencies working on the same account.

6.3 Legal and business transfers

We may disclose information where required by law, subpoena, or valid governmental request; to protect our rights, safety, or property; or in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify affected clients.

7. Artificial intelligence and automated tooling

We use AI-assisted engineering and operations tooling, principally Cursor and connected MCP servers, to run our business and operate client marketing accounts. When our team uses these tools, the content of the task — which can include business records, campaign performance data, and documents drawn from the systems described above — is transmitted to the AI provider powering that tool for processing.

We manage this deliberately:

• Our internal rules prohibit pulling row-level personal data belonging to our clients’ customers into general working files. Call recordings, transcripts, lead lists, and CRM contact exports are kept in access-controlled, non-version-controlled storage.
• We prefer aggregate data over row-level data for any analysis.
• We do not knowingly submit special categories of personal data to these tools.
• We do not use client data to train publicly available AI models, and we select tooling configured so that our content is not used for model training by the provider.

If you are a client and would prefer that we exclude your account from AI-assisted workflows, contact us and we will accommodate the request.

8. Data retention

We delete or anonymize information once it is no longer needed for the purpose it was collected for, subject to legal retention requirements.

9. Deleting your data

You can ask us to delete your information at any time, and you can revoke platform access yourself.

To disconnect a Meta ad account or other connected platform:

1. Sign in to Insight CRM, open the account’s Connectors panel, and remove the connection. This deletes the stored access and refresh tokens immediately.
2. You may additionally revoke access on Meta’s side at Facebook → Settings & Privacy → Settings → Business Integrations, or in Meta Business Suite → Business Settings → Integrations → Connected Apps, by removing the Insight app.
3. For Google connections, revoke access at myaccount.google.com/permissions.

To request deletion of stored data: Email privacy@sixthmedia.com with the subject line “Data Deletion Request” and tell us which account, ad account, or email address the request relates to. We will confirm receipt within 5 business days and complete verified deletion requests within 30 days. If we are acting as a processor for one of our clients, we will forward your request to them and support their response.

Some information may be retained where we have a legal obligation to keep it, or where it exists in encrypted backups; backup copies are purged on our standard backup rotation.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Know and access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information.
• Obtain a portable copy of information you provided to us.
• Opt out of sale or sharing of personal information, and of targeted advertising and certain profiling. (We do not sell or share personal information as those terms are defined under U.S. state privacy laws.)
• Withdraw consent where we rely on it.
• Appeal a decision we make about your request.
• Not be discriminated against for exercising any of these rights.

These rights arise under laws including the Utah Consumer Privacy Act, the California Consumer Privacy Act as amended by the CPRA, comparable laws in other U.S. states, and the GDPR and UK GDPR.

To exercise any right, email privacy@sixthmedia.com. We will verify your identity before acting, typically by confirming control of the email address on file. You may use an authorized agent, subject to proof of authorization. We do not charge a fee for reasonable requests.

If you are in the EEA or UK and believe we have not resolved your concern, you have the right to complain to your local supervisory authority.

11. Security

We protect information with measures including: encryption in transit using TLS; encryption at rest for the database and for stored platform access tokens (AES-256-GCM); secret storage in Google Cloud Secret Manager rather than in code; role-based access control with module-level permissions in Insight CRM; multi-factor authentication on administrative accounts; audit logging of API token use; and least-privilege service accounts in our cloud environment. We maintain a documented threat model for Insight CRM and review it as the application changes.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulators as required by law.

12. International transfers

We are based in the United States and our infrastructure runs in Google Cloud’s us-central1 region, with BigQuery in the US multi-region. If you access our services from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country. Where we transfer personal data out of the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.

13. Children’s privacy

Our website and services are directed to businesses and are not intended for children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

14. Third-party links

Our website and our reports link to third-party sites and platforms we do not control. This policy does not apply to them, and we are not responsible for their practices. Review their privacy policies before providing information.

15. Changes to this policy

We may update this policy as our services, technology, or legal obligations change. We will revise the “Last updated” date above, and for material changes we will provide prominent notice on our website and, where we have an ongoing relationship with you, by email. Continued use of our services after an update constitutes acceptance of the revised policy.

16. Contact us

Sixth Media, LLC
Lehi, Utah 84043, United States

Privacy inquiries: privacy@sixthmedia.com
General: team@sixthmedia.com
Phone: (435) 500-2198
Web: sixthmedia.com

For our service terms, see our Terms of Service.