Privacy policy

1. Who we are

Meson Agency is an onshore contact centre founded in Melbourne in 2019. We call, qualify and follow up leads for businesses, mostly in real estate, from our offices in South Yarra, Melbourne and Miami, Florida.

• Australia: The Virtual Sales Assistant Pty Ltd, ABN 40 632 481 102, trading as Meson Agency. 102/15 Claremont Street, South Yarra VIC 3141.
• United States: Meson Group LLC (“Meson USA”), 8 SW 7th St, Miami, FL 33130. Meson USA runs our US calling team. The Virtual Sales Assistant Pty Ltd is responsible for all personal information handled under this policy, including enquiries from the United States.

This policy covers this website (mesonagency.com), the enquiries and files you send us through it, and the personal information we handle when we make and take calls for our clients. It does not cover our clients’ own websites or privacy practices.

2. What we collect on this website

We collect only what the site needs to answer you and to understand how it is used.

Enquiry forms

When you send us an enquiry (contact us, book a call, the free database audit, the partner program or a job application) we collect what you type: your name, company or agency, work email, phone number, industry, your message and, for applications, the role you are applying for. We also record which page the form was sent from and whether it was our Australian or US site, so the right team replies.

Files you upload

The database audit form lets you upload a sample export of your contacts (CSV or XLSX, up to 20 MB). The careers form lets you upload a CV (PDF or DOCX). Section 4 explains how we handle these.

Cookies and similar technology

We use three kinds, explained in section 6: necessary (your cookie choice itself and spam protection on form pages), analytics (Google Analytics 4) and advertising (Google Ads and Meta Pixel). Analytics and advertising only run with your consent where the law requires it, and you can switch them off anywhere at any time.

Technical information

To stop abuse, our form handler rate-limits submissions using a one-way hash of your IP address; the address itself is not stored with your enquiry. Our hosting provider, Netlify, keeps standard server logs (IP address, browser type, pages requested, time) for a short period for security and operations, then deletes them.

We do not take payments or collect payment details through this website.

3. What happens to your enquiry

Your enquiry goes straight into our customer relationship management system (Ploutos, our own CRM) as a lead, and our sales team may follow it up by phone, SMS and email. That is the purpose of the form, and by sending it you should expect to hear from us.

• We send you an automatic acknowledgement email and an internal notification to our sales team (by email and in our Slack workspace) so someone can reply, normally within one business day.
• We use what you tell us to prepare for the call, to quote for work and, if you become a client, to set up and run your account.
• If you ask us not to contact you, or not to use a particular channel, we will stop. Every marketing email includes an unsubscribe link and every SMS tells you how to opt out.
• We do not sell, rent or trade personal information.

Job applications are handled by the people involved in hiring and are used to assess your application. If you are not successful, we may keep your application and CV on file for future roles. Ask us at any time and we will delete it.

4. Files you upload

A database audit sample usually contains other people’s personal information: the names, phone numbers and email addresses of your past enquiries and contacts. We treat it as information you hold and have asked us to look at on your behalf.

• What we do with it: we review the sample to tell you how many contacts are reachable and what a reactivation campaign could look like. We do not call, message or market to the people in the file unless you engage us to run that campaign under a signed agreement, and we do not add them to any list of our own.
• Where it goes: the file is uploaded directly to private storage and is never publicly accessible. The staff working on your audit may open it and work with it in the business systems we use for that work.
• How long we keep it: the uploaded file is deleted from our upload storage automatically 30 days after upload. Working copies and the audit findings are kept with your enquiry (section 9). If you want them removed sooner, tell us and we will delete them.
• Your responsibility: by uploading a file you confirm that you are entitled to share it with us for this purpose, including under any privacy notice you have given the people in it, and that it contains no more than we need (a sample, not your whole database). If the people in your file have opted out of contact, please leave them out.

5. Our calling services

Most of the personal information we handle belongs to our clients’ contacts: the people we call, text and email on a client’s behalf, for example new enquiries answered through Meson Rapid. In that work the client decides why and how the information is used; we act on their instructions and under a written agreement.

• Do Not Call Register: we call the contact lists our clients give us. Each client is responsible for washing its list against the Do Not Call Register, as the Do Not Call Register Act 2006 (Cth) requires, and for holding any consent its calls rely on, before the list reaches us.
• SMS and email: messages sent on a client’s behalf identify the sender and include a way to unsubscribe, as the Spam Act 2003 (Cth) requires.
• US calls: calls for US clients are made by our US team. As in Australia, each US client is responsible for scrubbing its list against the National Do Not Call Registry and for the consent its calls rely on under the Telephone Consumer Protection Act, before the list reaches us.
• Call recording and notes: we do not record every call. Calls are recorded and transcribed only where a client’s campaign needs it, for quality, training and to write the outcome back into the client’s CRM. Recordings and transcripts are kept until the client asks us to delete them.
• AI: where a client’s campaign uses call notes or our AI services, recordings may be transcribed and summarised by our providers, Gladia and Twilio. None of our call, SMS or transcription providers (Twilio, Telnyx and Gladia) use our data to train their models. A person makes the calls; AI handles the admin.
• If we call you on a client’s behalf and you want to know who provided your details, or want no further contact, tell the caller or contact us (section 14) and we will pass it on and suppress your number in that campaign.

6. Cookies, analytics and advertising

We use cookies to see how our site is used and to measure our advertising. You choose which optional ones we may use, and you can change your mind at any time using “Cookie preferences” in the footer of every page.

• Necessary. Needed for the site to work, including spam protection on our forms. Always on. This is your cookie choice itself (stored in your browser, see below) and Cloudflare Turnstile, which runs only on pages with a form.
• Analytics. Helps us see which pages are useful and where people drop off. Google Analytics 4 sets cookies and sends us aggregated reports on page views, sources and journeys. IP addresses are not logged or stored by Google Analytics 4.
• Advertising. Lets us measure our ads and show them to people who have visited us. The Google Ads tag and the Meta Pixel set cookies so Google and Meta can tell us when an ad led to a visit or an enquiry, and can show our ads to people who have been to this site.

You can also block or delete cookies in your browser settings. The site works without optional cookies; only our reporting is affected. For how Google and Meta use information from sites that use their services, see Google’s explanation and Meta’s privacy policy.

7. Who we share information with

We share personal information only with the providers that run this website and our business, with our own staff, and where the law requires it. Each provider is bound by its own privacy terms and only receives what it needs for the job in the table.

Our calling services also run on our own calling platform, Nexus.

We may also disclose personal information to our professional advisers, to a buyer if our business is sold, and to courts, regulators and law enforcement where required by law.

8. Where your information is stored and overseas disclosure

Some of your information is stored or processed outside Australia. Under Australian Privacy Principle 8 we tell you where, and we take reasonable steps to make sure overseas providers handle it in a way consistent with the Australian Privacy Principles.

• Enquiries and uploaded files: our CRM database and file storage run on Supabase in the Tokyo region, Japan.
• This website and its form handler: Netlify, a United States company, with copies served from its worldwide edge network.
• Email and internal notifications: Google Workspace and Slack, United States and worldwide.
• Analytics and advertising: Google and Meta, United States and worldwide, only with the consent described in section 6.
• Calls and SMS: Twilio and Telnyx, United States. Call transcription by Gladia may be processed outside Australia.
• US enquiries: handled by our US team in Miami, and by US-based callers for US clients.

In short, the personal information we hold is stored in Japan, Australia and the United States.

9. How long we keep it

• Uploaded files (database audit samples, CVs): deleted from our upload storage automatically 30 days after upload. Any copy we keep is covered below.
• Enquiries and leads in our CRM, including audit working copies: kept on an ongoing basis so we can follow up and keep our records complete. Ask us at any time and we will delete them or stop contacting you.
• Job applications and CVs: kept on file for future roles until you ask us to delete them.
• Client records: kept for the life of the client relationship and for 7 years afterwards where Australian tax and corporations law require it.
• Analytics data: kept by Google Analytics for the retention period set in our account; aggregated reports may be kept longer.
• Your cookie choice: 12 months in your browser, then you are asked again.
• Call recordings and transcripts: kept until the client they were made for asks us to delete them.

10. How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

• Everything you send us travels over an encrypted connection (HTTPS), and this site sends strict security headers to browsers.
• Form submissions are checked server-side (spam protection, rate limits and validation) before they reach our CRM; the browser never talks to our database directly.
• Uploaded files go into private storage that has no public access; staff open them with time-limited links.
• Access to the CRM is limited to staff who need it, with individual logins and two-factor authentication where the service offers it.
• If we become aware of a data breach that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

11. Access, correction and your other rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or ask us to stop contacting you. Email us at the address in section 14. We may need to confirm your identity first. We aim to respond within 30 days and we do not charge for a reasonable request.

• Marketing: use the unsubscribe link in any email, reply STOP to any SMS, or tell the caller. We keep a record of your opt-out so we do not contact you again.
• Cookies: use “Cookie preferences” in the footer at any time.
• Information we hold for a client: if we hold your details because a client asked us to contact you, we will pass your request to that client and act on their instructions, and we will suppress your number in the meantime.

If we refuse a request we will tell you why in writing and how to complain.

12. Complaints

If you think we have mishandled your personal information, please contact us first (section 14). We will acknowledge your complaint within 7 days, investigate it, and give you a written answer within 30 days.

If you are not satisfied with our response, or you would rather not raise it with us, you can complain to the Office of the Australian Information Commissioner (OAIC):

13. Changes to this policy

We may update this policy from time to time. The date and version at the top tell you which one you are reading. If a change affects the cookies we use or who we share information with, the cookie banner will ask for your choice again. The latest version is always at mesonagency.com/privacy.

This policy is not directed at children. We do not knowingly collect personal information from anyone under 18.

14. How to contact us

For privacy questions, requests and complaints, contact our privacy contact: