Privacy Policy

1. Introduction

AIVOX PTY LTD ('AIVOX', 'we', 'us', or 'our') provides AI-powered voice agent and call automation services. We are committed to protecting your privacy and complying with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) and all applicable Australian privacy, telecommunications and consumer protection laws.

This Privacy Policy explains how we handle personal information collected from our customers (business users) and from end-users who interact with our AI voice agents.

2. Business Users and End Users

AIVOX serves two categories of people under this Privacy Policy:

• Business customers — businesses and individuals who register for and configure the AIVOX platform.
• End users — callers, customers, patients, leads, or other individuals who interact with an AI voice agent configured by a business customer.

For information collected from end users interacting with a business customer's AI voice agent:

• The business customer generally acts as the controller or responsible entity — determining why and how personal information is collected and processed through their configured workflows.
• AIVOX generally acts as a service provider, processing information on behalf of that business customer.

Requests relating to call content, bookings, transcripts, customer records, or information supplied to a specific business should generally be directed to the relevant business customer in the first instance.

Business User Responsibilities

Business users are responsible for:

• Providing any required privacy notices to callers
• Obtaining any legally required consents before recording or processing caller data
• Determining what information is collected through their configured workflows
• Ensuring compliance with applicable privacy, surveillance, healthcare, telecommunications, and consumer protection laws in their jurisdiction

3. Our AI Voice Agents

AIVOX deploys AI voice agents that interact directly with callers. We disclose the following:

• Callers who interact with an AIVOX-powered agent are speaking with an AI system, not a human. Business users are encouraged to include a clear disclosure in their agent's greeting.
• AI voice agents may use personal information (including voice, name, and intent data) to provide automated responses and to perform actions such as calendar bookings.
• Where our AI systems make or directly support automated decisions that may affect individuals, we will provide appropriate disclosures in accordance with applicable privacy laws.

Biometrics: AIVOX does not intentionally identify individuals using biometric voice identification technology unless explicitly enabled as part of a customer-specific solution and with appropriate consents in place.

4. Information We Collect

4.1 Information You Provide

• Account details (name, email, phone number, and business details)
• Billing and payment information
• Customer support communications and onboarding data

4.2 Information Processed via Voice Services

As a service provider, we process data on behalf of business customers when end users interact with an AI Voice Agent:

• Voice recordings and audio files
• Automatically generated text transcripts
• Metadata (call duration, timestamps, and caller ID)
• Extracted intent data (e.g., booking dates, names, or enquiries)

Sensitive information: Voice recordings may incidentally capture sensitive information (e.g., health details shared by a caller). We do not intentionally collect sensitive information and business users should configure their agents to avoid eliciting sensitive data unless strictly necessary and lawfully permitted.

4.3 AI Model Processing

When a caller interacts with an AIVOX-powered voice agent, audio, transcripts, caller inputs, and related metadata may be transmitted to third-party artificial intelligence, speech recognition, voice synthesis, telecommunications, and cloud infrastructure providers for the purpose of delivering the Service.

These providers may process information in Australia, the United States, or other jurisdictions where they operate. AIVOX takes reasonable steps to ensure service providers are subject to appropriate privacy, confidentiality, and security obligations.

4.4 Technical Data

• IP addresses, browser type, and device identifiers
• Usage analytics and system logs to ensure platform stability

4.5 Website Analytics

We may use analytics tools to understand website performance, improve services, and monitor system reliability. These tools may collect anonymised or aggregated usage data. Users may configure their browser to limit certain tracking technologies; however, some platform features may not function correctly as a result.

4.6 Cookies and Tracking Technologies

We may use cookies and similar technologies to improve system reliability, enhance user experience, and monitor platform performance. Users may configure their browser to decline cookies; however, some platform features may not function correctly as a result.

5. How We Use Your Information

We use the collected information to:

• Operate, maintain, and provide the AIVOX platform
• Improve speech recognition and platform functionality using de-identified data where possible
• Process transactions and manage subscriptions
• Send transactional notifications such as booking confirmations, reminders, or system alerts via SMS or other messaging channels when configured by business users
• Comply with legal obligations and enforce our terms

Automated processing: Our platform uses automated systems to process call data, generate transcripts, detect caller intent, and facilitate bookings. We will provide appropriate disclosures about automated decisions in accordance with applicable privacy laws.

We do not sell your personal information or your customers' data to third parties.

6. AI Training and Customer Data

AIVOX does not use Customer Content, voice recordings, call transcripts, knowledge bases, uploaded documents, or caller data to train public artificial intelligence models unless expressly authorised by the relevant customer.

Certain third-party service providers may temporarily process data to deliver AI functionality. AIVOX seeks to use providers that offer business-grade privacy controls and restrict use of customer data for model training where available.

7. Call Recording and Consent

AIVOX provides tools to notify callers that their interactions are being recorded and processed by AI in accordance with applicable privacy, telecommunications and surveillance laws.

Recording consent requirements vary by jurisdiction. In particular, businesses operating in Victoria, South Australia, Western Australia, and Tasmania must obtain all-party consent before recording a call. Business users must ensure their configured greeting includes an appropriate disclosure before recording begins.

8. SMS and Electronic Communications

Where AIVOX sends SMS messages on behalf of business users (e.g., booking confirmations, call summaries), we comply with applicable Australian privacy, telecommunications and consumer protection laws, including:

• Consent: SMS messages are sent only where the recipient has provided express or inferred consent as required by applicable law. Business users are responsible for obtaining and maintaining valid consent records.
• Sender identification: All SMS messages sent via AIVOX clearly identify the authorising business.
• Sender IDs: SMS functionality may use registered sender identifiers where required by applicable law.
• Opt-out / unsubscribe: Every SMS sent for marketing or non-strictly-transactional purposes includes a functional opt-out instruction. Opt-out requests are actioned promptly and suppression is maintained permanently.
• Transactional messages: Booking confirmations, reminders, and similar service-related messages triggered by a caller's own action are treated as transactional communications.

Business users who send marketing messages via the AIVOX platform are responsible for ensuring their own compliance with all applicable messaging, spam, and privacy laws.

9. Disclosure and International Data Transfers

We may disclose personal information to trusted third-party service providers necessary to deliver our services. AIVOX may engage third-party subprocessors to provide telephony, artificial intelligence, cloud hosting, messaging, analytics, payment processing, monitoring, and support services. These include providers such as voice and AI processing services, cloud infrastructure providers, and payment processors.

Some personal information may be stored or processed outside Australia, including in jurisdictions where our service providers operate. By using the Service, you acknowledge that overseas recipients may be subject to laws different from those in Australia.

AIVOX takes reasonable steps to ensure overseas service providers maintain appropriate privacy and security safeguards consistent with applicable Australian privacy laws. A current list of subprocessors is available on request.

10. Data Security and Retention

We implement reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, or destruction, including AES-256 encryption at rest and TLS encryption in transit. However, no method of transmission, storage, or processing can be guaranteed to be completely secure.

Retention periods may vary depending on customer configuration, subscription plan, legal requirements, operational requirements, and backup schedules. Business users may configure data retention settings from within the AIVOX dashboard where available.

Users may request deletion of call logs and recordings via the AIVOX dashboard where technically feasible.

Data breach notification: In the event of an eligible data breach under the Notifiable Data Breaches (NDB) scheme, AIVOX will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Privacy Act 1988 (Cth). We maintain an internal breach response plan and conduct periodic security assessments.

11. Direct Marketing and Messaging

AIVOX may enable messaging features such as SMS notifications when configured by business users.

Business users are responsible for ensuring that any outbound communications comply with all applicable privacy, telecommunications, spam, and consumer protection laws, including obligations relating to consent, sender identification, and opt-out mechanisms.

AIVOX does not send direct marketing messages to end-users (callers) on its own behalf. Any marketing-related messages delivered via the platform are initiated and controlled by the business user.

12. Children's Privacy

AIVOX services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If such information is identified, we will take reasonable steps to delete it promptly. We monitor developments in children's online privacy law and will update our practices accordingly.

13. Your Rights and Complaints

You have the right to access, correct, or request deletion of your personal information by contacting us using the details in Section 15. We will respond to requests within a reasonable timeframe and no later than 30 days.

Data portability: Business users may request an export of their call log data and recordings via the AIVOX dashboard.

If you have a complaint about how we handle your data, please contact us using the details in Section 15. We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in technology, legal requirements, or service functionality. Updated versions will be published on our website, and significant changes will be communicated where appropriate.

We will provide at least 14 days' notice of material changes to this policy via email to registered business users.

15. Contact Us

For privacy-specific enquiries or to exercise your rights under the Privacy Act, please mark your message 'Attention: Privacy Officer' and send to the email address below.