Legal / Privacy policy
Draft for legal review. Replace the bracketed details and have an Australian lawyer check it before relying on it.

Privacy policy

Last updated [date]. This policy explains how [Your company name], ABN [ABN] handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Who this covers

  • Our customers' staff who use the dashboard: name, email, password (hashed), and activity logs.
  • People our customers' agents call or who call them: name, phone, email, company, call audio (converted to text as it happens), transcripts, summaries, answers given on calls, recordings if the customer turns recording on, meetings and texts. Our customer decides why and when these people are contacted; we handle their information on our customer's behalf.

How we use it

To run calls and texts, write summaries, book meetings, send results to our customers' systems, keep the service secure, and meet legal obligations. We do not sell personal information or use it to advertise.

Who we share it with

Service providers who process it for us: Twilio (calls and texts), Deepgram (speech recognition), Fish Audio (voices), Google and Anthropic (AI models), Resend (email), Fly.io and Tigris (hosting and backups), and the apps our customers connect. Some of these process data outside Australia, including in the United States. [List each provider's regions.]

Sensitive information

Health information is only collected by agents set up for health insurance, with the person's agreement, and only what's needed.

AI and automated decisions

See AI and automated decisions.

Keeping and deleting

Recordings are kept for the period each customer sets (90 days by default). Other data is kept until the customer deletes it or leaves. Do-not-call entries are kept so opted-out people stay opted out.

Your choices

  • Ask not to be called or texted again (say so on a call, or reply STOP to a text).
  • Ask for access to, correction of, or deletion of your information: contact the business that called you, or us at [privacy@yourdomain.com.au]. We respond within 30 days.
  • Complain to us first; if unresolved, to the Office of the Australian Information Commissioner (oaic.gov.au).

Security

Encryption in transit and at rest, two-step sign-in, role-based access, activity logs and separated workspaces. See our security overview for details.