Privacy Policy

Last updated: 1 July 2026

Operator (“Operator”, “we”, “us”) provides an AI receptionist that answers phone calls and website chats on behalf of service businesses (our “Customers”), qualifying enquiries and booking appointments. This policy explains what information we collect, how we use it, and the choices you have.

We act as a data processor on behalf of our Customers for the calls and chats handled through their account, and as a data controller for our own account and operational data.

1. Information we collect

From businesses that use Operator

• Account details: name, email, phone, business name, and login credentials.
• Business configuration: services, hours, FAQs, phone numbers, and notification preferences.

From callers and website visitors

• Call audio and recordings, and AI-generated transcripts of phone calls.
• Chat messages exchanged with the AI on a Customer's website.
• Contact and enquiry details you provide — such as your name, phone number, email, location, the service you need, and the urgency of your request.
• Appointment details where a booking is made.

Technical data

• Standard log data such as IP address, device/browser type, and timestamps, used for security and reliability.

2. How we use information

• To answer calls and chats, understand requests, qualify leads, and book appointments.
• To notify the Customer about new leads and bookings (email and SMS).
• To create calendar events when an appointment is agreed.
• To operate, secure, support, and improve the service.

3. Call recording

Calls handled by Operator may be recorded and transcribed so that the AI can take accurate details and so the Customer has a record of the enquiry. Our Customers are responsible for ensuring callers are appropriately notified of recording where required by law. Recordings and transcripts are stored securely and made available to the Customer whose number was called.

4. Google user data

When a Customer connects their Google Calendar, Operator requests access to their calendar in order to check availability and create appointment events. Operator's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We access Google Calendar data only to read availability and create/update appointment events that the Customer's AI receptionist books.
• We do not use Google user data for advertising, and we do not sell it.
• We do not transfer Google user data to third parties except as necessary to provide the service, comply with law, or as part of a merger or acquisition.
• We do not use Google user data to train generalised AI/ML models.
• A Customer can disconnect their Google Calendar at any time, which revokes our access; stored tokens are then deleted.

5. Service providers

We use trusted third parties to deliver the service. They process data only on our instructions:

• Anthropic — AI language model that understands calls/chats and generates responses.
• Twilio — telephony, call handling, recording, and SMS.
• ElevenLabs — text-to-speech for the AI voice.
• Google / Microsoft — calendar integration (where connected).
• Resend — transactional email notifications.
• Vercel, Railway, Supabase — hosting and database infrastructure.

6. How we share information

We do not sell personal information. We share it with the Customer whose line or website you contacted, with the service providers listed above, and where required by law. We may also share information in connection with a business transfer (e.g. merger or acquisition).

7. Overseas disclosure

Some of the service providers listed in section 5 are located, or store and process data, outside Australia — principally in the United States (including Anthropic, Twilio, ElevenLabs, Resend, and our hosting providers Vercel and Railway; Supabase data is hosted in a region we configure). By using Operator, personal information may be transferred to, and processed in, these countries. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles (APPs), including relying on our providers' own security and privacy commitments.

8. Data retention

We keep personal information for as long as needed to provide the service and meet legal obligations. Customers can request deletion of their account data, and callers/visitors can request deletion of their personal information by contacting us or the relevant Customer.

9. Security and data breaches

We use industry-standard measures to protect information, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your information. If a data breach occurs that is likely to result in serious harm, we will assess and respond in line with the Notifiable Data Breaches scheme under the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

10. Your rights and how to complain

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Depending on your location, you may have rights to access, correct, or delete your personal information, or to object to or restrict certain processing. To exercise these rights or make a complaint, contact us using the details below. If your information was collected on behalf of a Customer, we may direct your request to that Customer. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

11. Children

Operator is not intended for children and we do not knowingly collect information from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “last updated” date.

13. Contact us

Questions about this policy or your information? Contact us at hello@operator.net.au.