Callable AI Privacy Policy

There are two very different ways your information can reach us, and the parts of this policy that matter to you depend on which one applies.

1.1 If you are a customer or a website visitor. You are dealing with us directly — you have visited callable.com.au, started a workspace, subscribed to the Services, or contacted us. We decide what happens to your information, and all of this policy applies to you.

1.2 If an AI teammate called you. The business that placed the call is our customer. That business chose to call you, decided what the call was about, supplied your contact details and is responsible under the Terms for having the authority and consents to contact and record you, and for telling you an AI voice agent is being used where the law requires it. We handle the call on that business’s behalf and under its instructions. That means the business — not Callable — holds the primary relationship with you and the primary obligations to you.

1.3 What to do if you were called. If you want a recording or transcript deleted, want to be added to a do-not-call or opt-out list, or want to know why you were contacted, the fastest and most complete route is to ask the business that called you. If you cannot identify or reach that business, contact us at privacy@callable.com.au and we will either help you directly or put your request to our customer. We will not ignore a request simply because it should have gone to someone else.

1.4 Where we act for a customer. When we process information on a customer’s behalf, we do so only to provide, secure and support the Services, and to meet our own legal obligations. We do not use it for our own separate purposes.

The kinds of personal information we collect and hold depend on your relationship with us.

2.1 From customers and prospective customers. Business contact details (name, business email address, phone number, employer and role), the description you give us of the AI teammate you want to build, information about your business such as industry, team size and intended use, account and login details, configuration and usage records, billing and payment details, and records of your correspondence with our support team.

2.2 Through the Services. When an AI teammate handles a call, we process the call audio and, where recording is enabled, the recording; the transcript; the summary, tags, dispositions, sentiment and analytics generated from it; and call metadata such as the numbers involved, the time, duration, direction and outcome of the call. Calls frequently contain personal information about the person on the line, and sometimes about third parties they mention.

2.3 From customer records and connected systems. Customers upload or connect contact lists, CRM records, scripts, prompts and other data for their AI teammates to use. Those records often contain personal information about the customer’s own contacts. We hold that information on the customer’s behalf under the terms of their agreement with us.

2.4 Automatically from our website. Standard technical information such as your IP address, browser and device type, referring page, the pages you view and how you move between them. This is collected through cookies and similar technologies — see section 13.

2.5 Sensitive information. We do not seek sensitive information (such as health, racial or ethnic origin, religious beliefs, criminal record or biometric information) and our Services are not designed to collect it. A caller may nonetheless volunteer it during a conversation, in which case it is captured in the recording and transcript in the same way as anything else that is said. Customers must not configure an AI teammate to solicit sensitive information without a lawful basis for doing so.

2.6 Voice. A call recording is a recording of a person’s voice. We do not use voice recordings to create voiceprints, and we do not use voice for biometric identification or verification of any individual.

2.7 Dealing with us anonymously. You can browse our website and read this policy without identifying yourself. We cannot provide the Services, respond to a support request or process a privacy request without enough information to identify who we are dealing with.

Wherever it is reasonable and practicable, we collect personal information directly from the individual it is about.

• Directly from you. When you complete the sign-up flow on our website, create or use an account, speak with an AI teammate, or email, call or otherwise contact us.
• From our customers. When a customer uploads a contact list, connects a CRM or other system, or configures a campaign, we receive whatever personal information those records contain. We collect that information from the customer rather than from you, because the customer is the one who holds the relationship with you.
• Automatically. Through cookies and analytics on our website, and through the logs our platform generates as it operates.

3.1 One thing worth knowing about our website. The answers you give in the sign-up flow on callable.com.au stay in your browser. Only the description of the teammate you want to build is carried across to the platform when your workspace is created; the rest is not sent to or stored by our marketing website.

3.2 Unsolicited information. If we receive personal information we did not ask for and could not have collected ourselves under the APPs, we will destroy or de-identify it if it is lawful and reasonable to do so.

We use personal information for the purposes it was collected for, for directly related purposes you would reasonably expect, and for any other purpose you consent to or the law requires or authorises. In practice, that means:

• Providing the Services. Placing and receiving calls, running the AI teammate, generating recordings, transcripts, summaries and analytics, and returning results to the customer.
• Running accounts. Creating and administering accounts, authenticating users, provisioning phone numbers, invoicing, collecting payment and handling billing enquiries.
• Support. Responding to questions, investigating faults and communicating with you about the Services, including service notices, outages and changes to this policy.
• Quality, safety and reliability. Monitoring and evaluating AI features for quality, safety, reliability and compliance, investigating suspected malfunctions, safety incidents and policy breaches, and performing quality assurance. This is expressly permitted by the AI Features Addendum to our Terms.
• Security and fraud prevention. Protecting our platform and our customers from misuse, abuse, fraud, and threats to network and information security.
• Improving the product. Understanding how the Services are used so we can make them better. Section 6 explains the limits we place on ourselves here — in particular, we do not use customer data or call outputs to train foundation models.
• Marketing. Telling customers and prospective customers about Callable, subject to section 12.
• Legal and compliance. Meeting our obligations under the law, responding to lawful requests from regulators, courts and law enforcement, and establishing, exercising or defending legal claims.

5.1 You are talking to an AI. Callable’s AI teammates are software. Our customers are required by our Terms to make the disclosures the law requires about the use of an AI voice agent, and we expect our customers to be upfront about it. If it was not clear to you on a call, we would like to know — tell us at privacy@callable.com.au.

5.2 Recording is controlled by the customer. Whether a call is recorded, and whether a transcript is kept, is a setting our customer controls. Australian law about recording conversations differs between states and territories and generally requires the knowledge or consent of the parties. Under our Terms, the customer must ensure it has the authority and any required consents to contact recipients, to process personal information and to record and transcribe calls.

5.3 What a recording contains. A recording captures everything said on the call by everyone on it. A transcript is a written version of the same thing, produced by speech recognition, and may contain errors. Summaries, tags, dispositions and sentiment scores are produced by AI from the transcript and are interpretations, not verbatim records.

5.4 Who can hear it. Recordings and transcripts are available to the customer whose AI teammate handled the call. Within Callable, access is limited to personnel who need it to run, support, secure or monitor the Services, as described in sections 4 and 7.

5.5 Asking for a recording to be deleted. See section 1.3. Ask the business that called you first, since it controls the record. If you cannot reach them, we will help.

Our product is built on artificial intelligence, so this section sets out plainly what that means for your information.

6.1 We do not train foundation models on your data. Callable does not use customer data or the outputs of AI features to train the foundation models behind those features. This is a commitment we make in the AI Features Addendum to our Terms, not just a statement of current practice.

6.2 What we do use to improve the Services. We use de-identified and aggregated telemetry — measurements about how the system performs, with individuals no longer identifiable — to improve reliability, safety and performance.

6.3 Third-party AI providers. Speech recognition, speech generation and language processing are provided in part by specialist third-party AI providers. They process call content only to deliver those functions to us, and to perform content moderation, security and reliability functions. Section 7 explains how we treat all of our providers.

6.4 AI output is probabilistic. AI features may produce inaccurate or unexpected results. Transcripts can mishear, summaries can misstate, and tags and sentiment scores can be wrong. Output should be treated as an aid to a human decision, not as an established fact about you. If you believe something recorded about you is wrong, section 11 explains how to have it corrected.

6.5 Automated decision-making. Callable does not make decisions about individuals that are both made solely by automated means and could reasonably be expected to significantly affect their rights or interests. Our AI features generate content and classifications — a summary, a tag, a disposition, a sentiment score — which our customers then use in their own systems and processes. A customer’s use of that output in its own decision-making is governed by that customer’s privacy policy, not this one.

6.6 Coming on 10 December 2026. New requirements under APP 1.7 to 1.9 commence on 10 December 2026, requiring privacy policies to disclose the kinds of personal information used in automated decision-making, the kinds of decisions made solely by automated means, and the kinds of decisions where automated processing substantially and directly relates to the decision. We will update this section before that date, and will do so whether or not our practices have changed by then.

We do not sell personal information. We do not disclose it for another organisation’s own marketing purposes. We disclose it in the following circumstances only.

• To our customer. If an AI teammate called you, the business that placed the call receives the record of it. That is the point of the Service.
• To service providers. We rely on providers for cloud hosting and storage, telecommunications and call carriage, speech and language AI, payment processing, error monitoring, product analytics and customer support tooling. They may access personal information only to perform those functions for us, under contracts that require them to protect it and prohibit them from using it for their own purposes.
• To professional advisers. Our lawyers, accountants, auditors and insurers, where they need it to advise us.
• Where the law requires it. To regulators, courts, law enforcement and other government agencies where we are required or authorised by law to disclose, or where disclosure is reasonably necessary to prevent a serious threat to life, health or safety.
• On a business sale. To an acquirer or its advisers if Callable or part of our business is sold, merged or restructured, in which case the information continues to be handled in accordance with this policy or a policy no less protective.
• With your consent. Anywhere else you have agreed to it.

7.1 Asking for the specifics. If you want to know which providers handle information relating to you or to your account, contact us at privacy@callable.com.au and we will tell you.

8.1 Some of our providers are overseas. The cloud infrastructure, telecommunications and AI providers we depend on operate internationally, and some of them store or process data outside Australia. Our Terms record that Callable may use suppliers and cloud infrastructure including where data is processed overseas, and that customers consent to overseas disclosure as required to provide the Services.

8.2 Which countries. The countries in which your information may be held depend on which parts of the Services are used and on our providers’ own infrastructure, and they change as providers change their regions. Rather than publish a list that may be out of date, we will tell you the countries relevant to you or to your account on request — email privacy@callable.com.au and we will respond.

8.3 What we do before we send it. Before disclosing personal information to an overseas recipient we take reasonable steps to ensure the recipient does not breach the APPs, including by putting contractual protections in place, unless an exception under APP 8.2 applies.

9.1 Safeguards. We maintain commercially reasonable administrative, technical and physical safeguards designed to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include access controls and authentication, encryption of data in transit, restricting internal access to personnel who need it, logging and monitoring, and contractual obligations on our providers.

9.2 No system is perfect. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, or you have found a security issue in our platform, tell us immediately at privacy@callable.com.au.

9.3 Data breaches. We have a data breach response plan. If we suspect an eligible data breach affecting a customer’s data, we will notify that customer within two Business Days of becoming aware of it, as our Terms require. Where the Notifiable Data Breaches scheme applies to us, we will assess the incident and, if it is likely to result in serious harm, notify the affected individuals and the Office of the Australian Information Commissioner as the Privacy Act requires.

10.1 The general rule. We keep personal information only for as long as we need it for the purposes set out in this policy, or for as long as the law requires us to keep it. When we no longer need it and are not required to retain it, we destroy it or de-identify it.

10.2 Call recordings and transcripts. Recordings, transcripts and the analytics derived from them are held in the customer’s workspace and are retained according to that customer’s configuration and instructions. A customer can delete them, and individual records can be deleted on request as described in section 1.3.

10.3 When an account ends. On termination we will provide a reasonable export of customer data available in the platform on request, and will delete or de-identify customer data within a reasonable period, subject to lawful retention obligations and standard backup retention. Backups are cycled on their own schedule, so deleted data can persist in backups for a period after it is removed from the live system.

10.4 Records we must keep. Some records are kept longer because the law requires it — financial and transaction records, for example, must be retained for seven years under the Corporations Act 2001 (Cth).

11.1 Your right to ask. You can ask us for access to the personal information we hold about you, and you can ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Email privacy@callable.com.au. We will need enough information to verify who you are before we can act, so that we do not disclose your information to someone else.

11.2 How long we take. We aim to respond to access and correction requests within 30 days. If a request is complex we will tell you and keep you informed. We do not charge for making a request; if there is a cost in providing access, we will tell you what it is before we incur it, and it will not be excessive.

11.3 When we can say no. There are limited grounds in the Privacy Act on which we may refuse access or decline to make a correction — for example where giving access would unreasonably affect another person’s privacy, or where we are prevented by law. If we refuse, we will tell you in writing why, and how to complain about it. If we decline to correct a record, you can ask us to attach a statement to it noting that you consider it inaccurate, and we will do so.

11.4 If your information is in a customer’s workspace. Where the information you are asking about was supplied by, or belongs to, one of our customers, we may need to refer your request to that customer, who is better placed to deal with it. We will tell you when we do that.

12.1 Our own marketing. We may send you information about Callable if you are a customer, or if you gave us your details because you were interested in the product. Every marketing email we send includes an unsubscribe link that works, as the Spam Act 2003 (Cth) requires. You can also ask us to stop at privacy@callable.com.au. We will still send you service messages you need — billing notices, security alerts and material changes to the Services.

12.2 Calls placed by our customers. If an AI teammate called you, that was our customer’s campaign, not ours. Our customers are required by our Terms to comply with marketing law, to maintain do-not-call lists and opt-out records, and not to contact people who have opted out or who are on do-not-call registers where contact is prohibited. Ask the calling business to add you to its suppression list, and consider registering on the Do Not Call Register at donotcall.gov.au. If a customer of ours ignores an opt-out, tell us — we can and do act on that.

13.1 What we use. Our website uses cookies and similar technologies. Some are necessary to make the site work. Others are analytics cookies, which we use through Google Tag Manager and Google Analytics to understand how people find and use our site so we can improve it — for example, which pages are read and where visitors drop off.

13.2 What that means for you. Analytics tools collect information such as your IP address, device and browser, and the pages you visit. Google processes this information on our behalf and may store it overseas. We do not use it to identify you personally, and we do not combine it with call content.

13.3 Turning it off. You can block or delete cookies through your browser settings, and you can install Google’s opt-out browser add-on. Blocking necessary cookies may stop parts of the site working properly.

14.1 Come to us first. If you think we have mishandled your personal information or breached the Australian Privacy Principles, email privacy@callable.com.au with the details. Tell us what happened and what you would like us to do about it.

14.2 What we will do. We will acknowledge your complaint within five business days, investigate it, and give you a written response within 30 days. If we need longer we will tell you why and when to expect an answer.

14.3 If you are not satisfied. You can take your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by writing to GPO Box 5218, Sydney NSW 2001. The OAIC will usually expect you to have raised the matter with us first.

15.1 We will keep this current. We update this policy as our practices, our providers or the law change. The version and date at the top of this page tell you which version you are reading.

15.2 Material changes. If we make a change that materially affects how we handle your personal information, we will take reasonable steps to tell customers directly rather than relying on you to notice the new version here.