This policy explains how Call Sure handles personal information. Call Sure is an AI phone receptionist for Australian businesses, at callsure.com.au ("we", "us"). Call Sure is run by Business API Pty Ltd (ABN 62 651 575 843) of Southport, Queensland, trading as Call Sure. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).
There are two groups of people this policy covers: our clients (the businesses that use Call Sure, and their staff who sign in), and callers (people who ring a client's phone number and speak with the assistant).
Who is responsible for callers' information
When you call a business that uses Call Sure, the assistant answers on that business's behalf. We handle callers' information on behalf of the business they called, so we can provide the service to that business. We follow the business's reasonable instructions, help them respond to callers' requests to access or correct their information, and delete it when they ask. The business decides how it uses your message and details afterwards, under its own privacy policy. If you have a question or request about your information, please contact the business you called first. You can also contact us.
Enterprise clients can request a data processing agreement.
What we collect
From our clients
- Account details: your name, email address, password (stored scrambled, never readable) and two-factor sign-in settings.
- Business details: business name, phone numbers, business hours, time zone, team members' names, departments and phone numbers you add for transfers, and the instructions you give the assistant.
- Billing details: your plan, invoices and payment status. Card details are handled by our payment provider and are never stored on our systems.
- Technical details: sign-in times, IP address and browser information, used to keep accounts secure.
- Problem reports: if you report a problem with a call, your reason and note are emailed to our team, and we look at that call (including its transcript) to fix it.
- Demos: if we give you a demo, we keep your name, contact details and the phone numbers you will call from. You get a temporary account, and the calls and details in it stay until the next demo starts, then are deleted.
From callers
- The phone number you call from (if it isn't withheld) and the time and length of the call.
- What you tell the assistant, such as your name, your company, why you are calling, your message and the best number to call you back on.
- A written transcript of the conversation with the assistant, and a short summary written by AI after the call.
- An AI assessment of the call's overall tone (positive, neutral or negative) and its topic, picked from a fixed list (such as a sales enquiry or a callback request), used for the business's call statistics.
- An audio recording of the call, only if the business has turned recording on. The assistant tells you the call is recorded before recording starts.
- If you are put through to someone, who was tried and whether they took the call.
You don't have to identify yourself. You can withhold your number or decline to give your name. The assistant can still take a message, although the business may not be able to call you back or help as fully.
Callers may include children. The assistant only collects what a caller chooses to share for their message, and we don't knowingly collect more.
Talking to an AI assistant
The receptionist that answers is a virtual (AI) assistant, not a person. It will tell you so if you ask, and many businesses have it say so when it answers. At the start of the call the assistant normally says the call may be recorded: what you say is always transcribed, and the call is also recorded if the business has turned that on. Speech is turned into text and back into speech automatically, and an AI model decides what the assistant says. You can ask to leave a message or to be put through to a person at any time. When a business's staff are available, the assistant can transfer you to them.
Why we collect it
- To answer calls for our clients, take messages and put callers through to the right person.
- To show clients a log of their calls, messages, transcripts and (if turned on) recordings.
- To bill clients and keep accurate business and tax records.
- To keep the service secure, fix problems and improve how the assistant handles calls for that client.
- To contact clients about their account and the service.
- To email clients about Call Sure features and offers, if we send such emails (see below).
We do not sell personal information, and we do not use callers' information for marketing. We do not use one client's calls to answer another client's calls.
Marketing emails
We may email clients about Call Sure features and offers. You can unsubscribe at any time, using the link in the email or by emailing [email protected]. Account, billing and call alert emails continue while you have an account, because they are part of the service.
No training of AI models
We do not use callers' or clients' information to train AI models. We have also switched off model training with our AI service providers for the information we send them through Call Sure, so they do not use it to train their models either. They may keep it briefly for security and abuse monitoring.
The only exception is our enterprise custom AI service: if an enterprise client instructs us in writing, we use that client's own business information to train an AI model used only for that client. It is never shared with or used for anyone else, and the client can ask us to delete it at any time.
Automated decisions
Our systems make some decisions automatically using account, phone number and call details: whether a free trial is available, pausing a service for non-payment, whether a call is put through to a business's team or a number is accepted, and a call's tone and topic. You can ask us and a person will review any of them. To ask, email [email protected] and tell us which decision you would like reviewed.
How long we keep it
- Call recordings are deleted automatically after 90 days.
- Caller details (phone number, callback number, name, company, reason for calling, message, transcript and summary) are removed automatically after 12 months by default, or after the period agreed with us by the business. Some businesses may agree a longer period with us.
- Call records without caller details (date, length, outcome, whether a transfer happened and its cost) are kept while needed for billing, tax and the client's call log. When the phone number is removed, we keep only the kind of number it was (such as mobile, landline or withheld), and the call's tone and topic, for statistics. These no longer identify the caller.
- Client account and billing records are kept while the account is open, and afterwards for as long as the law requires (for example, tax records for at least 5 years).
- Copies in backups and system logs expire on their own schedules. For example, database backups are replaced within about 14 days, and system logs (kept on our own systems in Australia, and never including callers' phone numbers) within 14 days.
- Call alerts already emailed to a business stay in the recipients' inboxes. We can't delete them, and the business manages them under its own policies.
- Closed accounts: when a client's account closes, its content is deleted or de-identified within 90 days, or sooner if the client asks, except records the law requires us to keep. After an account closes we keep the phone numbers and a coded version of the email address used for a free trial, so the same business can't start another free trial, and the business name and Australian Business Number used to register a phone number, as telecommunications rules require.
Who we share it with
We use trusted service providers to run Call Sure. They only use the information to provide their service to us, although they may keep it briefly for security and abuse monitoring. They include providers of:
- telephony (connecting and transferring phone calls, and recording them when turned on);
- speech-to-text and text-to-speech (turning speech into text and back);
- AI language models (deciding what the assistant says, and writing call summaries);
- hosting, storage and backups;
- email alerts to clients;
- payments, and accounting and bookkeeping;
- website analytics and advertising (see Cookies and analytics below).
We also run our own error-tracking system, hosted in Australia, to find and fix faults. It records technical details of an error. Caller phone numbers, what callers say and sign-in details are filtered out of the request details it keeps, although an error message can occasionally include other information.
Our authorised staff can also access calls, including transcripts and recordings, when needed to support a client, fix a problem or operate the service. We may also share information when the law requires it, or to protect someone's safety.
Information sent overseas
Call records and recordings are stored in Australia. Our telephony provider also keeps call logs (such as numbers and times), and our email provider keeps copies of the emails we send, in the United States. To handle a call, what callers say is processed in real time by telephony, speech and AI providers in the United States, and call alerts are sent by email through a provider in the United States. Our payment and accounting providers store clients' billing details in the United States. Google, in the United States, receives website usage data from the analytics and advertising tags described under Cookies and analytics below. For enterprise clients who choose our private AI option, the AI model runs on our own infrastructure in Australia and conversation text is not sent to an overseas AI provider. Call audio is still converted to and from speech by our telephony provider.
A list of our key service providers and the countries they process information in is available on request. We'll email clients before adding a provider that changes where information is processed.
How we protect it
- Information is encrypted when it travels over the internet. Call recordings and backups are also encrypted where they are stored.
- Recordings are kept in private storage. They can be played by signed-in users of the business they belong to, and by our authorised staff for support.
- Every client account requires two-factor sign-in. Each business can only ever see its own calls.
- Only a small number of our own staff can access client data, and only to run and support the service.
If we become aware of a security incident affecting a client's content, we'll tell the client without undue delay and work with them on any notices. If we have a data breach that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme.
Accessing and correcting your information
You can ask for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing [email protected]. Clients can see and update most of their own details after signing in. If you are a caller, it helps to tell us which business you called, when, and from which number. We will respond within 30 days. We may need to confirm who you are first, and sometimes the law lets us refuse (we will tell you why).
Cookies and analytics
We use cookies that are needed to sign in and keep your session secure. On our website and in client accounts, we also use Google Tag Manager to run Google Analytics and Google Ads tags, which measure visits to our website and how well our ads work.
These tags set cookies and process limited usage data: pages viewed, device and browser, approximate location, ad clicks, and conversions such as sign-ups, free trials and purchases. Google processes this data in the United States. When you sign up or pay, we send Google a hashed (scrambled) copy of your email address so it can match the conversion to an ad you clicked. Google can't read the original address from it.
We may also use this data to show Call Sure ads to people who have visited our website, on Google and its partner sites, and Google may link it with information from your Google account if you've allowed that in your Google settings.
Callers' information, call content and transcripts are never sent to these tools. We don't use them when our own staff are signed in, or for demo visitors.
You can opt out at any time: block or delete cookies in your browser settings, turn off personalised ads in your Google ad settings, or install Google's browser add-on that opts you out of Google Analytics. Google explains how it uses this data at policies.google.com/technologies/partner-sites.
Complaints
If you have a concern about how we have handled your personal information, please email us at [email protected]. We will look into it and reply within 30 days. If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
Changes to this policy
We may update this policy from time to time. The latest version is always on this page, with the date it was last updated. We will tell clients by email about any significant change.
Contact us
Business API Pty Ltd, Southport, Queensland
Email: [email protected]