Privacy Policy

Who we are

AfterToneAi designs, builds, hosts and manages websites for Australian local businesses, and runs SMS automation behind each site: a dedicated business number, missed-call text-back, AI-assisted replies, lead capture and Google review requests. This policy explains how we handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

We handle personal information in two different roles:

• As a business in our own right, when we collect information about people who enquire about our services and the businesses we work with; and
• On behalf of our clients, when we handle information about our clients' own customers through the websites and SMS automations we run for them.

Part A: Enquiries and clients

This part covers people who request a strategy call, our clients and their staff.

What we collect

• Strategy call requests: when you use our booking form, we collect your name, business name, email address, phone number, industry, location, current website (if any), your main priority and any notes you choose to add.
• Client details: the contact details of the people we deal with, business details such as your ABN, services, service areas, opening hours and branding, and anything you give us to build your website.
• Client portal login: the email address used to sign in to the client portal and basic login records.
• Billing records: invoices and payment records under your written agreement. For existing self-serve subscriptions, payments are handled by Stripe and we store only a customer reference and subscription status, never your full card number.
• Communications: emails, messages and notes from calls with us.
• Technical data: basic logs needed to run and secure our website and portal, such as timestamps, IP addresses and error logs.

We collect this information directly from you. We do not use third-party advertising or analytics trackers on our own website. You can contact us with a general question without identifying yourself, but we need your contact details to book a strategy call or work with you.

How we use it

We use this information to respond to your enquiry and arrange your strategy call, prepare a proposal, deliver and manage our services, manage your portal access, invoice you, keep our systems secure and meet our legal obligations. When you submit the booking form, your details are sent by email (through Resend) to our team's inbox, and you receive a confirmation email.

We may occasionally email enquirers and clients about our own services. Every such email lets you opt out, and you can also ask us to stop at any time. We never sell personal information.

How long we keep it

If you request a strategy call but don't become a client, we delete your enquiry within 12 months, or sooner if you ask. Client information is kept while you are a client. After the engagement ends, we delete it from active systems within 90 days, except records we must keep by law, such as tax and financial records, which we keep for the period Australian law requires (generally five years).

Part B: Our clients' customers

This part covers people who call, text or enquire with a business that uses AfterToneAi.

Our role

When you contact a business that uses AfterToneAi, that business is responsible for your personal information. We handle it on their behalf as their service provider, only to run the services they have engaged us for, and not for our own purposes. We don't use it to market our services to you and we never sell it. If you have a question about how a business uses your information, please contact that business directly. If you contact us instead, we will pass your request on and help them respond.

What we handle for our clients

• Call details: the phone number you called from, and the time and outcome of calls to the business's number.
• SMS conversations: the text messages exchanged between you and the business's automated replies.
• Lead details: details you provide by SMS or through an enquiry form on the business's website, such as your name, the job or service you need, your suburb or address and your preferred time.
• Review requests: records of review request messages sent to you on the business's behalf and whether you opted out.
• Website logs: basic technical logs from visits to the business's website, such as IP addresses and timestamps.

We use this information to reply to you, pass your enquiry to the business through their client portal, send review requests the business has asked us to send and keep the service working. You can stop receiving messages at any time by replying STOP.

How long we keep it

We keep this information while the business is our client so they can see their leads and conversations. When the engagement ends, we provide an export to the business on request and then delete the information from our active systems within 90 days. A business can also ask us to delete particular records sooner.

Service providers

We use the following providers to run our services. Each handles personal information only as needed to provide its service to us:

• Twilio: business phone numbers, call handling and SMS delivery.
• OpenAI: understanding incoming SMS messages and drafting replies.
• Supabase: database storage and client portal login.
• Vercel: hosting for our website, client websites and the client portal.
• Resend: email delivery, including booking form submissions and confirmations.
• Google: our team's email inbox, and Google Business Profile links used in review requests.
• Stripe: payment processing for existing self-serve subscriptions.

AI processing. When an SMS is interpreted by OpenAI, the message content is sent to OpenAI's API. OpenAI does not use data submitted through its API to train its models by default, and may keep it for a limited period for abuse monitoring. We send only what is needed to understand the enquiry and reply.

Overseas disclosure

Several of these providers store or process information outside Australia, mainly in the United States and, for some providers, in other countries where they operate data centres. Before using a provider we take reasonable steps to make sure it handles personal information consistently with the APPs, including by relying on its published data protection and security commitments.

Security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include encrypted connections, access controls so each client can only see their own data in the client portal, and limiting staff access to what is needed. When we no longer need personal information, we delete or de-identify it.

Access, correction and complaints

You can ask to access or correct the personal information we hold about you by emailing us. We will respond within 30 days. If your request relates to information we hold for one of our clients, we will work with that business to respond.

If you believe we have mishandled your personal information, please contact us first so we can investigate and respond within 30 days. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

If you live outside Australia, you may have additional rights under the laws where you live. Contact us and we will help.

Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme. Where the breach involves information we hold for a client, we will also tell that client promptly so they can meet their own obligations.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

Contact

Questions or privacy requests? Email aftertoneai@gmail.com.