Privacy Policy

Escher Reporting is an internal marketing analytics and reporting platform operated by Escher Group Pty Ltd, ABN 56 638 285 784 (“Escher Group”, “we”, “us”), a marketing agency based in Australia.

We use the platform to produce the monthly performance reports we provide to the clients whose marketing we manage. It is not a public product, it is not sold or licensed to third parties, and it is not available for sign-up.

For any privacy question, or to exercise any of the rights described below, contact us at info@eschergroup.com.au.

This policy explains what data Escher Reporting accesses, why, how it is stored and protected, and who it is shared with. It covers data retrieved from connected marketing platforms on behalf of our clients, and the limited personal information of Escher Group staff who sign in to use the platform.

With the authorisation of the account holder, we retrieve aggregated marketing performance statistics from the platforms our clients use. Specifically:

• —Google Analytics 4 — sessions, users, page views, bounce and engagement rates, traffic sources and channels, country- and city-level location totals, and counts of configured conversion events.
• —Google Search Console — search impressions, clicks, click-through rate, average position, and the search queries, landing pages and countries these relate to.
• —Meta (Facebook and Instagram) — page and profile followers, impressions, reach, engagement totals, and performance figures for individual published posts.
• —LinkedIn — page followers, impressions, engagement totals, and performance figures for individual published posts.
• —Klaviyo — aggregate email campaign statistics: sends, deliveries, opens, clicks, bounces, unsubscribes and total subscriber counts.
• —Advertising platforms (Google Ads, Meta Ads, LinkedIn Ads, TikTok) — spend, impressions, clicks, click-through rate, cost per click and conversion totals.
• —Monday.com — Escher Group’s own internal task and content records, used to summarise the work carried out during a reporting period.

We also store the name and email address of Escher Group staff who sign in to the platform, and the access credentials issued when a platform account is connected.

We do not retrieve, store or process:

• —Individual website visitors’ identities, profiles or browsing histories
• —Email addresses, names or contact details of your subscribers or customers
• —Message content, private messages or direct messages
• —Payment details, billing information or card data
• —Any data from accounts that have not been explicitly connected and authorised

The figures we retrieve are statistical totals. They describe how a website or profile performed, not who visited it.

In particular, data obtained through Google APIs is:

• —Used only to display analytics and produce reports for the client that authorised the connection
• —Never sold, rented or transferred for advertising, marketing or any other purpose
• —Never used to build advertising profiles or to train generalised artificial intelligence models
• —Never read by a human except where necessary for security, to resolve a support issue, to comply with the law, or where the client has given explicit permission

We request read-only access. Escher Reporting cannot change settings, alter data, or take any action within a connected Google account.

• —To display dashboards to Escher Group staff
• —To generate the monthly performance reports we provide to clients, as PDF documents or shared dashboard links
• —To detect notable changes in performance — for example an unusual spike in traffic — and draft written commentary explaining them
• —To keep a historical record so that performance can be compared across periods

We do not use the data for advertising, we do not combine data across unrelated clients, and we do not sell it under any circumstances.

Escher Reporting uses an artificial intelligence service (the Anthropic Claude API) to help draft the written commentary sections of client reports.

Only aggregated statistics already computed by the platform are sent for this purpose — for example, “sessions rose 12% to 426”. No personal information, no raw platform data, and no client credentials are sent. Anthropic does not use data submitted through its API to train its models.

All generated text is a draft. It is reviewed and approved by an Escher Group staff member before it appears in any report shared with a client.

Data is stored in a PostgreSQL database hosted in Sydney, Australia (AWS ap-southeast-2).

• —Access credentials for connected platforms are encrypted at rest and are never displayed in the interface or included in reports
• —All data is transmitted over encrypted connections (TLS)
• —Access to the platform is restricted to authorised Escher Group staff, authenticated through Google sign-in and limited to our company domain
• —Client-facing report links, where used, are read-only and cannot be used to change anything

No system is perfectly secure. We take reasonable steps appropriate to the sensitivity of the data, which is predominantly aggregated and non-personal.

We rely on the following providers to operate the platform. Each is bound by its own obligations regarding data protection.

• —Neon — database hosting (Sydney, Australia)
• —Vercel — application hosting (United States)
• —Anthropic — AI drafting of report commentary (United States); receives aggregated statistics only
• —Cloudflare — PDF document generation
• —Google — staff authentication

Some of these providers are located outside Australia, which means aggregated statistics may be processed overseas. We do not share data with anyone else, and we do not sell data to any party.

Performance data is retained for as long as we provide reporting services to the client it relates to, so that year-on-year comparisons remain possible, and for a reasonable period afterwards to meet our record-keeping obligations.

When a platform connection is removed, the stored access credentials are deleted immediately. On written request from a client we will delete that client’s historical data. Clients may also revoke our access at any time from within their own Google, Meta or LinkedIn account settings, which stops all further collection.

Escher Group handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the General Data Protection Regulation applies, we act as a processor on behalf of our clients, who remain the data controllers for their own analytics.

You may ask us to:

• —Tell you what data we hold that relates to you or your organisation
• —Correct anything that is inaccurate
• —Delete data we hold about your organisation
• —Explain how a particular figure in a report was produced

Write to info@eschergroup.com.au and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Escher Reporting uses a single essential cookie to keep authorised staff signed in. We do not use advertising cookies, tracking pixels, or third-party analytics within the platform itself.

We may update this policy as the platform develops. The date at the top of this page shows when it was last revised. Material changes affecting how client data is handled will be communicated directly to affected clients.

Escher Group Pty Ltd
ABN 56 638 285 784
Perth and Melbourne, Australia
info@eschergroup.com.au