1. Who We Are And What This Policy Covers
Millennial Marketing Agency ("Millennial Marketing", "MMA", "we", "us" or "our") is a digital marketing agency based in Toronto, Ontario, and registered in Canada. We work with businesses and individuals in Canada, the United States, Europe and around the world.
This Privacy Policy explains how we collect, use, share and protect personal information when you:
- visit our websites, including millennialmarketing.agency, getstef.com, mktgclub.com and learn.mktgclub.com (the "Sites");
- book a call, fill in a form, chat with our AI assistant (p.ai) or contact us;
- join MKTG Club or buy one of our programs; or
- become a client or work with us in any other way.
We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). Where they apply to you, we also respect other privacy laws, such as the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws.
Questions? Contact our Privacy Officer at [email protected] (see section 12).
2. Information We Collect
Information You Give Us
- Booking and contact forms: name, email, phone number, company name, website, the services you're interested in, your social media status and profile links, and any notes you share.
- Calls and meetings: information you share during discovery calls and client meetings (for example on Zoom). We only record a call with your knowledge, and we tell you before recording starts.
- Accounts and purchases: when you join MKTG Club or buy a program, your name, email, login details and purchase history. Payments are handled by Stripe. We never see or store your full card number.
- Chats with p.ai: the messages you send to our AI assistant on our Sites.
- Client work: logins, brand assets, customer lists, ad account access and other material you give us so we can deliver our services.
- Messages: what you send us by email, SMS, social media direct messages or other channels.
Information We Collect Automatically
- Device and usage data, such as IP address, browser type, pages viewed, referring site, and time and date of visits.
- Data from cookies, pixels and similar tools (see section 5).
- Email and SMS engagement, such as whether a message was delivered or opened, or a link was clicked.
Information From Others
- Referral partners or clients who introduce you to us.
- Public profiles and social media accounts you link to, when we review your marketing presence before a call.
- Advertising and analytics platforms (for example Meta and Google), which give us mostly aggregated reports.
We do not knowingly collect sensitive information (such as health, financial account or government ID details) through our Sites. Please don't send it to us.
3. How We Use Your Information, And Our Legal Bases
We use personal information to:
- respond to inquiries and schedule, run and follow up on discovery calls;
- send booking confirmations, reminders and other service messages;
- provide, manage and improve our marketing services, programs and MKTG Club;
- process payments and keep business and tax records;
- run p.ai and improve the answers it gives;
- send marketing emails and texts, where you have agreed (see section 6);
- measure and improve our Sites and advertising;
- protect our Sites, prevent fraud and enforce our terms; and
- meet legal, accounting and regulatory obligations.
Consent (Canada): under PIPEDA, we rely on your consent, either express or implied depending on how sensitive the information is and what you would reasonably expect. You can withdraw consent at any time, subject to legal or contractual limits. We will tell you what withdrawing may mean for our ability to serve you.
Legal bases (EU, UK and similar laws): where GDPR or UK GDPR applies, we rely on:
- contract: to provide services you've asked for, or take steps before entering a contract (such as booking a call);
- legitimate interests: to run, secure and grow our business in ways you would expect, balanced against your rights;
- consent: for marketing messages and non-essential cookies; and
- legal obligation: where the law requires us to keep or disclose information.
We do not sell your personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Sharing, Service Providers, AI And International Transfers
We share personal information only as needed to run our business, with:
- Service providers that work on our behalf, including HighLevel (LeadConnector) for our website, CRM, forms, calendars, email and SMS; Stripe for payments; Zoom for video calls; Microsoft and Google for email, calendars and documents; Meta and Google for advertising and analytics; and AI providers that power p.ai and help us produce content.
- Team members and contractors who need it to deliver your project, under confidentiality obligations.
- Professional advisers, such as accountants and lawyers.
- Authorities, where the law requires it or to protect rights, property or safety.
- A buyer or successor, if our business is sold, merged or restructured. Your information would stay protected under this policy.
Our service providers may only use your information to provide services to us, and must protect it.
AI tools (p.ai). When you chat with p.ai, your messages are processed by third-party AI providers to generate replies. Please don't share sensitive personal information in chat. p.ai's answers are general information, not professional advice.
International transfers. We are based in Canada, and many of our providers are in the United States or other countries. Your information may therefore be stored and processed outside your home country, where it may be accessible to courts, law enforcement and national security authorities under local law. Where GDPR or UK GDPR applies, we rely on adequacy decisions (Canada has one for commercial organizations under PIPEDA) and, where needed, standard contractual clauses or equivalent safeguards.
5. Cookies, Pixels And Tracking
Our Sites use cookies, pixels and similar technologies to:
- make the Sites work, for example keeping you logged in to MKTG Club, remembering form progress and loading the booking calendar (essential);
- understand how the Sites are used, such as which pages are visited and where visitors come from (analytics); and
- measure and improve our ads, including the Meta Pixel and Google tags, which help us show relevant ads and see whether they work (advertising).
You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the Sites from working. You can also manage ad preferences through your Meta and Google account settings, or through industry opt-out tools such as the Digital Advertising Alliance of Canada (youradchoices.ca) and, in the EU, youronlinechoices.eu.
Where the law requires consent for non-essential cookies (for example in the EU and UK), we will ask for it first.
6. Marketing Emails And Text Messages
We follow Canada's Anti-Spam Legislation (CASL) and similar laws elsewhere. We send marketing emails or texts only when you have agreed to receive them, or when the law allows it based on an existing business relationship or inquiry.
Every marketing email includes an unsubscribe link, and you can reply STOP to any marketing text. You can also email [email protected] at any time. We act on unsubscribe requests within 10 business days. Even after you opt out, we may still send messages about your bookings, purchases or account.
7. How Long We Keep Information
We keep personal information only as long as we need it for the purposes in this policy, then delete or anonymize it. As a guide:
- Leads and inquiries: up to 3 years after our last contact with you.
- Client records and contracts: for the length of the relationship, plus up to 7 years for legal and tax purposes.
- Payment and accounting records: as long as Canadian tax law requires (generally 6 years).
- Call recordings: up to 12 months, unless we agree otherwise.
We may keep information longer if the law requires it or to resolve disputes.
8. How We Protect Information
We use reasonable administrative, technical and physical safeguards, suited to how sensitive the information is. These include access controls, two-factor authentication on key accounts, encrypted connections (HTTPS) and reputable providers with strong security practices. We give team members access only to what they need.
No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify you and the relevant authorities as the law requires.
9. Your Rights And Choices
Depending on where you live, you may have the right to:
- ask whether we hold personal information about you and get a copy of it;
- correct inaccurate or incomplete information;
- withdraw consent, or opt out of marketing;
- ask us to delete your information;
- object to or restrict certain processing, or ask to move your data to another provider (EU and UK); and
- opt out of targeted advertising, or the "sale" or "sharing" of personal information as defined in some US state laws. We do not sell personal information.
To make a request, email [email protected]. We may need to verify your identity first. We will respond within 30 days, or within the time the law that applies to you allows. We will not treat you differently for using your rights.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to the data protection authority where you live.
10. Children
Our Sites and services are for businesses and adults. They are not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
11. Information We Handle For Our Clients
When we run marketing for a client, we may handle personal information about that client's own customers or audience (for example ad audiences, email lists or CRM contacts). In that case we act on the client's behalf and follow their instructions and our agreement with them. The client is responsible for its own privacy notices and for collecting any consents needed. If you are a customer of one of our clients, please contact that business directly about your information.
12. Contact Us And Our Privacy Officer
Our Privacy Officer is responsible for our compliance with this policy.
13. Changes To This Policy
We may update this policy from time to time. We will post the new version on our Sites with a new effective date. If we make significant changes, we will give you notice, for example by email or a notice on our Sites.
Effective date: October 8, 2026