Privacy Policy

CXUP Pty Ltd ("CXUP", "we", "us", "our") provides AI-powered voice receptionist services to small businesses. This Privacy Policy explains how we collect, use, store, and disclose personal information, and applies to:

• visitors to our website,
• prospective and current business clients ("Clients"), and
• members of the public who call a Client's business and whose call is answered by our AI Agent ("Callers").

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

If you are a Client, this Privacy Policy sits alongside, and does not replace, the data handling terms in your AI Receptionist Services Agreement with CXUP, which sets out in more detail how Caller Data is collected and used in the course of the Services.

Where we process a Caller's personal information, we generally do so on behalf of the Client as a service provider. The Client is responsible for determining what information is collected from its Callers, giving Callers appropriate privacy notices, and obtaining any consents needed for call recording — CXUP's role is to process that information to deliver the Services, not to decide why it's collected in the first place.

Depending on how you interact with us, we may collect:

• the details you enter in our enquiry form: your name, business name, email address and phone number, plus your answers about your business, how it handles calls and what you're looking for (for example your opening hours, the number your customers call, and any website address you give us)
• anything you write in the message box
• a record of your consent to be contacted: the wording you agreed to, its version, and the time
• technical details that help us keep the website safe from spam and abuse: a one-way, keyed hash of your IP address (we do not store the address itself), your browser type, and the page you sent the form from
• general website usage information (such as pages viewed and general location inferred from IP address) via standard analytics tools, if we use them

• business name, ABN, contact name, email, phone number, and address
• billing and payment details (processed by our payment processor — see section 5 below; we do not directly store full card details)
• account and configuration information relating to the AI Agent set up for the Client's business

• name, phone number, and any other contact details provided during a call
• the substance of the enquiry, including appointment or booking details
• audio recordings and text transcripts of the call
• call metadata (time, date, duration, and caller number)

We only collect Caller information that a Caller volunteers during a call, or that is generated by the call itself (such as recordings, transcripts, and metadata). We do not intentionally seek out sensitive information (such as health information) from Callers; where a Caller volunteers it as part of their enquiry, it is handled under the same protections as any other personal information in this Policy, and the Client is responsible for ensuring it has a proper basis to collect it.

We collect personal information directly from you when you contact us, sign up as a Client, or call a Client's business number that is answered by our AI Agent. We may also collect information automatically through standard website analytics when you browse our website.

We collect and use personal information to:

• respond to enquiries and provide information about our services
• keep a record of your enquiry and of the consent you gave, so we can follow up and show what was agreed
• protect our website and forms from spam and abuse
• set up, configure, and deliver the AI receptionist service to Clients
• answer calls, capture enquiries, and complete bookings on behalf of Clients, in accordance with each Client's instructions
• process payments and manage billing
• maintain records required for compliance purposes, including records of the call disclosure given to Callers
• monitor and improve the quality and accuracy of our AI Agent, on a de-identified or aggregated basis where reasonably practicable
• send you information about our services and offers, where you have agreed or the law otherwise allows (see section 9)
• comply with our legal obligations

We do not sell personal information to third parties, and we do not use Caller Data to train third-party foundation models beyond what our sub-processors' standard terms permit (see section 5).

To deliver our services, we rely on a number of trusted third-party service providers ("sub-processors"). Personal information may be disclosed to, or processed by, the following:

• Twilio: telephony and call carriage (Australia region)
• Retell AI: AI voice orchestration (United States)
• OpenAI: AI language processing (GPT-4o) (United States)
• ElevenLabs: voice synthesis (United States)
• Stripe: payment processing for Client billing (United States, with local data handling arrangements)
• Vercel: website and client portal hosting
• Supabase: database and application infrastructure, including where website enquiries are stored
• Cal.com: appointment scheduling and booking integration, where used as part of a Client's configuration
• Resend: email delivery, used to notify our team about your enquiry and to send you a confirmation
• Google Workspace: our business email and internal file storage
• Google Fonts: the typefaces used on our website, which load from Google's servers (Google can see your IP address when a page loads)

Some of these providers store or process information outside Australia, including in the United States — see section 8 below for how we handle this. On request, we will provide a Client with a current list of sub-processors that handle their Caller Data.

We do not otherwise share personal information with third parties except: where required by law; to protect our rights or the safety of others; with our professional advisers (such as our accountant, lawyer, or insurer) where reasonably necessary to obtain their advice; or in connection with a sale, merger, or restructure of our business (in which case this Privacy Policy would continue to apply to your information under the new ownership).

Our website may use cookies and similar technologies to understand how visitors use the site and to improve its performance. You can control or disable cookies through your browser settings; doing so may affect some website functionality.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure, consistent with the security standards of our sub-processors, including encryption in transit and, where supported, encryption at rest, and restricting access to personnel and systems that reasonably need it.

If we become aware of a data breach that is likely to result in serious harm to any individual, we will assess it in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). Where the breach affects a Client's Caller Data, we will notify the Client without undue delay so they can meet their own notification obligations, consistent with the AI Receptionist Services Agreement.

Several of the sub-processors listed in section 5 are based in, or process information in, the United States. Before sharing personal information with an overseas provider, we take reasonable steps to ensure it will be handled consistently with the Australian Privacy Principles, including relying on the provider's own security certifications, data handling terms, and — where relevant — contractual protections. By using our website or the Services, you acknowledge that personal information may be transferred to, and processed in, countries outside Australia as described in this section.

We use the details you give us in an enquiry to respond to that enquiry. We will only send you marketing messages where you have agreed to receive them or the law otherwise allows, and every marketing message will include a way to unsubscribe. You can also opt out at any time by contacting us using the details in section 16. We do not use Caller personal information for direct marketing purposes.

Our AI Agent uses artificial intelligence to answer calls, understand what a Caller needs, and take actions such as logging an enquiry or booking an appointment, based on each Client's configuration. AI outputs are generated automatically and may occasionally be inaccurate or incomplete — the AI Agent does not make decisions with a significant legal or similarly significant effect on a Caller without a human involved, and Clients remain responsible for reviewing and acting on what the AI Agent captures. We only process the personal information reasonably necessary to deliver the call, and do not retain raw audio beyond what's needed to produce the recording and transcript a Client has configured.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, or as required by law. Call recordings and transcripts are generally retained for shorter periods than compliance records (such as records evidencing that a Caller was given the required call disclosure), which we retain for up to six years, consistent with the limitation period for contract claims under the Limitation Act 2005 (WA). Once information is no longer required, we take reasonable steps to delete or de-identify it. We may retain aggregated or de-identified information indefinitely, since it no longer identifies you or any individual.

Website enquiries are kept only for as long as we need them to respond to you, follow up, and keep a record of the consent you gave. We then delete or de-identify them.

You may:

• request access to personal information we hold about you
• request correction of personal information that is inaccurate, out of date, or incomplete
• request deletion of personal information we no longer need for the purpose it was collected, where we're not required to keep it by law
• opt out of direct marketing communications at any time (section 9)
• withdraw your consent to be contacted about an enquiry, at any time

If you are a Caller, please contact the business you called directly in the first instance, as that business is generally the primary collector of your information; we will assist that business to respond to your request where needed.

To exercise any of these rights, contact us using the details in section 16. We will respond within a reasonable time, and won't charge you for making a request.

If you wish to make a complaint about how we have handled your personal information, please contact us using the details below. We will investigate and respond within a reasonable time. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Our services are directed at businesses, not children. We do not knowingly collect personal information directly from children through our website. If a Caller is a child (for example, where a parent calls a Client's business on their behalf), the Client remains responsible for ensuring it has an appropriate basis to handle that information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated version will be posted on our website with a revised "last updated" date.

If you have questions about this Privacy Policy or how we handle personal information, please contact us using the details below.