Privacy Policy

Understory Agency LLC (“Understory,” “we,” “us”) is a B2B marketing agency based in Miami, Florida, providing paid media, GTM engineering, outbound, RevOps and content services. This Privacy Policy explains how we collect, use and protect personal information when you visit our website, contact us, or interact with us as a client, prospect, partner or vendor.

This policy does not cover data we process on behalf of our clients under a services agreement. That data is governed by our client contracts and the client's own privacy policy (see Section 4).

By using our website or services, you agree to this policy. If you do not agree, please do not use our website or services.

We collect business contact and usage information, mostly from people acting in a professional capacity.

Information you give us

• Contact details: name, job title, company, business email, phone number.
• Communications: emails, form submissions, meeting notes and call recordings (with notice), and messages in shared channels such as Slack.
• Client onboarding details: billing contacts, platform access, brand assets and campaign inputs.
• Job applicant information: resume, work history and references, if you apply to work with us.

Information we collect automatically

• Device and usage data: IP address, browser type, pages viewed, referring URL and time on site.
• Cookie and pixel data from analytics and advertising tools (see Section 5).

Information from third parties

• Business contact data from enrichment and prospecting providers, public professional profiles (such as LinkedIn) and company websites.
• Lead and engagement data from ad platforms, event partners and referral partners.

We use personal information to run our business and deliver our services. Specifically, we use it to:

• Respond to inquiries, send proposals and manage client relationships.
• Deliver, report on and improve our services.
• Send B2B marketing and sales outreach, including email, LinkedIn and targeted ads. You can opt out at any time.
• Analyze website traffic and the performance of our own marketing.
• Invoice, collect payment and manage vendor relationships.
• Evaluate job and contractor applicants.
• Use AI and automation tools to summarize meetings, draft content and analyze performance, subject to the safeguards in Section 7.
• Protect our business, prevent fraud and comply with legal obligations.

Where GDPR or similar laws apply, our legal bases are: performing a contract, our legitimate interests in operating and marketing a B2B business, your consent (for example, certain cookies), and legal obligations.

We do not sell personal information for money. We do not use client data to train AI models without the client's written permission.

When we run campaigns or build GTM systems for a client, we act as a service provider (or “processor”) on that client's behalf. The client remains responsible for the data and its lawful collection.

Client data may include CRM records, audience and contact lists, ad account data, conversion and analytics data, and enrichment results. We access it only to perform the services, under the client's instructions and our services agreement.

We will not use client data for our own marketing, combine it across clients, or disclose it except as the client directs or the law requires. A Data Processing Agreement is available on request.

If you are a client's customer or prospect and want to exercise privacy rights, please contact that client directly. We will support them in responding.

Our website uses cookies, pixels and similar tools to understand traffic and measure our own marketing.

You can block or delete cookies in your browser settings, and opt out of interest-based ads through each platform's ad settings or aboutads.info. Where required by law, we ask for consent before setting non-essential cookies. We honor Global Privacy Control signals where required.

We share personal information only as needed to run our business:

• Service providers that host, process or support our work, such as CRM, project management, email, meeting transcription, data enrichment, cloud storage, AI and payment tools. They may use the data only to serve us.
• Advertising and social platforms (such as LinkedIn, Google, Meta and Reddit) when we run campaigns or measure our own marketing.
• Team members and contractors in the US, Latin America and Europe who need the data to do their work and are bound by confidentiality obligations.
• Professional advisors such as lawyers, accountants and auditors.
• Business transfers, if we are involved in a merger, acquisition or sale of assets.
• Legal and safety reasons, to comply with law, respond to lawful requests or protect rights and safety.
• With your consent or at your direction.

We keep personal information only as long as needed for the purposes above, our contracts and legal requirements. Client data is returned or deleted within 90 days after an engagement ends, unless the client asks otherwise or the law requires us to keep it.

We protect information with reasonable administrative, technical and physical safeguards. These include role-based access, multi-factor authentication, encrypted storage and transfer where available, vetted vendors and confidentiality agreements with our team.

When we use AI tools, we use business-grade services that do not train on our inputs by default. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We will notify affected parties of a data breach as required by law.

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and get a copy.
• Correct inaccurate information.
• Delete your information.
• Opt out of marketing, targeted advertising, profiling, or the "sale" or "sharing" of personal information as defined by law.
• Restrict or object to certain processing, and withdraw consent.
• Port your data to another provider.
• Appeal our decision on your request, and complain to your local data protection authority.

US residents. Residents of California, Virginia, Colorado, Connecticut, Texas, Oregon and other states with consumer privacy laws can exercise these rights as their state law allows. Some of our ad and analytics tools may count as “sharing” or “targeted advertising” under these laws. You can opt out by emailing us or using a Global Privacy Control signal. We will not discriminate against you for exercising your rights.

EU, UK and Swiss residents. You have the rights listed above under the GDPR and UK GDPR.

Marketing emails. Every marketing email includes an unsubscribe link. You can also email us to be removed from outreach.

To make a request, email ali@understoryagency.com. We will verify your identity and respond within the time the law requires, usually 30 to 45 days. An authorized agent may submit a request for you with proof of authority.

We are based in the United States, and our team and vendors work in several countries. Your information may be processed outside the country where you live. When we transfer data from the EU, UK or Switzerland, we use safeguards such as the European Commission's Standard Contractual Clauses.

Our website and services are for businesses and are not directed at children under 16. We do not knowingly collect their personal information. If you believe we have, contact us and we will delete it.

We may update this policy from time to time. We will post the new version here with a new effective date, and notify clients of material changes.

Understory Agency LLC
Email: ali@understoryagency.com

Effective date: October 13, 2026