Privacy Policy

We collect information you provide directly when creating an account and using our services:

Account Information — Your name, email address, business name, ABN, and contact details provided during registration and onboarding.

Call Data — Phone numbers of inbound callers, call recordings, transcriptions, and AI-generated summaries. Call recordings are processed in real-time and are not stored permanently unless you opt in.

Booking Data — Appointment details, customer names, phone numbers, and any notes captured during AI-assisted scheduling.

Payment Information — Billing details processed securely through Stripe. We do not store credit card numbers on our servers.

Usage Data — Log data, device information, IP addresses, and analytics related to how you interact with our platform.

Employee Data — Names, email addresses, and working hours of staff members you add to your account for call routing purposes.

We use collected information to:

- Provide our AI receptionist services — answering calls, booking appointments, and taking messages on behalf of your business.

• Process and manage your subscription and billing through Stripe.

• Improve our AI models — aggregated, anonymised data may be used to enhance voice recognition and natural language understanding. Your call data is never shared with other businesses.

• Send service notifications — appointment confirmations, call summaries, and account alerts via email (powered by Resend).

• Provide customer support and respond to your enquiries.

• Comply with legal obligations under Australian law.

Your data is protected with enterprise-grade security measures:

- Database — All data is stored in encrypted PostgreSQL databases hosted on secure, SOC 2 compliant infrastructure.

• Encryption — Data is encrypted in transit (TLS 1.3) and at rest (AES-256).

• Authentication — Accounts are protected with secure session-based authentication. OAuth 2.0 is used for Google Calendar integration.

• Access Control — Employee access is scoped by role. Only business owners can manage team members and billing.

• Payment Security — All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. We never store card details.

• AI Processing — Voice calls are processed via OpenAI's Realtime API. Audio is streamed in real-time and is subject to OpenAI's enterprise data processing agreements.

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the right to:

- Access your personal information held by us.

• Correct inaccurate or outdated personal information.

• Request deletion of your personal data (subject to legal retention requirements).

• Opt out of marketing communications at any time.

• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached.

To exercise any of these rights, contact us at privacy@grampians.ai.

We use the following third-party services to operate our platform:

| Service | Purpose | Data Shared | |---------|---------|-------------|
| OpenAI | AI voice processing | Call audio (streamed, not stored) |
| Twilio | Phone number provisioning & call routing | Caller phone numbers |
| Stripe | Payment processing | Billing details |
| Google Calendar | Appointment scheduling | Calendar events, availability |
| Resend | Transactional emails | Email addresses, notification content |

Each provider is bound by their own privacy policies and data processing agreements. We only share the minimum data necessary for each service to function.