Privacy Policy

1. About This Policy

This Privacy Policy explains how Jortel Australia Pty Ltd (ABN 91 610 642 521), trading as Jortelligence ("we", "us", "our"), collects, uses, discloses, and protects personal information in connection with our website at jortelligence.ai and our products, including J-Voice Agent (collectively, the "Services").

We are committed to complying with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth), including the Notifiable Data Breaches (NDB) scheme under Part IIIC, and our obligations under the Cyber Security Act 2024 (Cth) regarding incident reporting and cyber security standards.

2. Information We Collect

We may collect the following types of personal information:

• Account information: name, email address, phone number, business name, ABN, and billing details when you create an account or subscribe to a plan.
• Call data: phone numbers of callers and recipients, call recordings, AI-generated transcripts, sentiment analysis scores, call duration, timestamps, and call metadata when using J-Voice Agent.
• Caller memory: for businesses that use it, notes from a caller's earlier calls with the same business — summaries, facts the caller shared, and follow-up items — so the business's AI agent can recognise returning callers and pick up where they left off.
• Voice data: audio captured during calls is processed in real time by our speech-to-text and text-to-speech AI systems. Recordings may be retained as described in Section 7.
• Biometric-adjacent data: voice characteristics (pitch, cadence, tone) are processed for the purpose of speech recognition and natural language understanding. These characteristics are not used for biometric identification or verification of any individual.
• Caller metadata: network information, device type, browser user agent, and connection quality metrics on WebRTC calls.
• Usage data: information about how you use our Services, including pages visited, features used, IP address, browser type, device information, and interactions with the platform.
• Contact lists: phone numbers, names, and other details you upload to our platform for use with outbound calling campaigns.
• Integration details: if you connect Google Calendar or Microsoft Outlook, the connected account's email address, the calendar's name and ID, and encrypted access tokens; and the phone numbers you enter to receive WhatsApp or SMS call summaries.
• Communications: information you provide when you contact us, submit forms, or communicate with our support team.

3. How We Use Your Information

We use personal information to:

• Provide, maintain, and improve our Services, including powering AI voice conversations
• Process voice data through AI models for real-time speech-to-text transcription, natural language understanding, and text-to-speech generation
• Generate call transcripts, sentiment analysis, and analytics dashboards for your account
• Process transactions and send billing notifications via Stripe
• Respond to enquiries and provide customer support
• Send service updates and product announcements (with your consent)
• Detect and prevent fraud, abuse, and security incidents
• Train internal models only on de-identified, aggregated data that cannot be used to identify any individual
• Comply with legal obligations, including ACMA and telecommunications regulatory obligations, and protect our rights

4. AI Processing and Automated Decision-Making

Our Services use artificial intelligence to process voice calls in real time. In accordance with APPs 1.7–1.9 regarding automated decision-making disclosure, we provide the following information about how AI is used in our Services.

Types of Personal Information Used in Automated Decisions

• Voice audio and derived transcripts
• Caller phone number and call history with the account
• Conversational context within the active call session
• Contact list metadata provided by the account holder

Nature of Automated Decisions

The following automated processes occur during calls and could reasonably affect individuals:

• Speech recognition: converting spoken words to text using Deepgram's speech-to-text API.
• Intent classification: interpreting caller intent to determine appropriate conversational responses.
• Response generation: producing contextual responses using OpenAI's language models based on the account holder's configured instructions.
• Sentiment scoring: automatically assessing caller sentiment for analytics and quality purposes.
• Appointment booking triggers: automatically initiating booking actions when caller intent matches configured criteria.
• Lead qualification: scoring or categorising callers based on conversational signals and account holder–defined criteria.
• Voice synthesis: converting AI-generated text responses to natural-sounding speech using ElevenLabs' text-to-speech API.

Scope and Safeguards

Account holders configure the scope and potential consequences of automated decisions through their agent setup (system prompts, actions, and business rules). No automated decision made by our Services produces legal effects or similarly significant effects on an individual without human review by the account holder.

AI outputs (such as appointment bookings, lead qualifications, or call dispositions) are tools provided to the account holder for their review and action. The account holder retains responsibility for decisions that materially affect individuals based on AI outputs.

Right to human review: If you believe an automated decision made during a call has significantly affected you, you may request human review by contacting the business that operates the voice agent, or by contacting us directly at privacy@jortelligence.ai and we will facilitate the request with the relevant account holder.

5. Sharing of Information and Sub-Processors

We do not sell your personal information. We share personal information with the following sub-processors, each of which processes data under contractual obligations:

We may also share information with:

• Related entities: other companies in the Jortel Group for operational purposes.
• Legal requirements: when required by law, regulation, court order, or legal process, or to protect the safety, rights, or property of Jortel Australia Pty Ltd, our users, or the public.

Sub-Processor Change Notification

We maintain a current list of sub-processors. We will notify you by email at least 30 days before engaging a new sub-processor that processes Customer call data. If you have a reasonable objection to a new sub-processor on data protection grounds, you must notify us in writing within 14 days of our notification. We will work in good faith to address your concerns, including offering an alternative solution where commercially reasonable. If the concern cannot be resolved within 30 days, you may terminate the affected Services without penalty by providing written notice.

Google and Microsoft calendar data

If you connect Google Calendar or Microsoft Outlook, we use that connection only to check your free and busy times and to add bookings to your calendar. We store encrypted access tokens, the connected account's email address and the calendar's name and ID — not your existing appointments. Bookings we add include the caller's name, the reason for the appointment, their phone number and, if they gave it, their email address. You can disconnect at any time; see our Data Deletion page.

Jortelligence's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell calendar data, use it for advertising or use it to train AI models.

6. Cross-Border Data Transfers (APP 8)

Personal information is transferred to the United States for processing by our AI sub-processors (OpenAI, ElevenLabs, Deepgram) and infrastructure providers (Railway, Vercel, Stripe, PostHog, Sentry). Our primary database (Supabase) is hosted in the Sydney region but is operated by a United States–based entity.

We implement the following contractual and technical safeguards for cross-border transfers:

• Data Processing Agreements (DPAs) with all sub-processors requiring compliance with obligations substantially similar to the APPs
• Standard contractual clauses where available
• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Sub-processors contractually prohibited from using Customer data for their own model training or any purpose beyond providing the contracted service
• We remain accountable under APP 8.1 for the handling of personal information by overseas recipients as if the act had not been breached

Voice data and text sent to AI providers for real-time processing are transmitted over encrypted connections. These providers may keep request data for a limited period under their own terms — for example, to monitor for abuse — before deleting it. We cannot delete their copies directly.

7. Data Retention

We retain personal information as follows:

• Account information: for as long as your account is open, and up to 30 days after it is closed.
• Call recordings: for as long as your account is open, unless you ask us to delete them sooner.
• Call transcripts, summaries and call details: for as long as your account is open, unless you ask us to delete them sooner.
• Contacts and caller memory: for as long as your account is open. Caller memory is cleared automatically when a caller hasn't called for 12 months, unless the business added them as a contact itself.
• Do-not-call entries: for as long as your account is open, so that opt-outs keep being honoured, even if the rest of that person's information is deleted.
• Calendar connections: until you disconnect the calendar or close your account.
• Billing records: 7 years after the transaction, as required by Australian tax and company law.
• Usage and security logs: up to 12 months, for security and debugging purposes.
• Backups: deleted data may remain in encrypted backups for up to 30 days until they are overwritten.
• Records of privacy requests: 2 years.
• Records needed for a complaint, dispute, legal claim or regulator's inquiry, or to prevent fraud: as described on our Data Deletion page.
• Aggregated analytics: retained indefinitely. This data is de-identified and cannot be used to identify any individual.

You can ask us to delete your data sooner. Our Data Deletion page explains how, and what we have to keep.

8. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our security measures include:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Role-based access controls and authentication via JWT
• Multi-factor authentication available for all accounts
• Regular security audits and vulnerability assessments
• Penetration testing conducted annually by independent assessors
• SOC 2 Type II certification in progress
• Enterprise-grade infrastructure with automated backups
• Input validation and rate limiting to prevent abuse
• Incident response plan maintained and tested quarterly

9. Data Breach Notification

In the event of an eligible data breach as defined under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988, we will:

• Complete an assessment within 30 days of becoming aware of a suspected breach to determine whether it is an eligible data breach
• Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable and no later than 30 days after completing our assessment
• Notify affected account holders within 72 hours of confirming a breach that involves their data or their customers' data
• Comply with ransomware and cyber extortion payment reporting obligations under the Cyber Security Act 2024 (Cth), including the 72-hour reporting requirement to the Australian Signals Directorate

We maintain an internal data breach response plan that is tested regularly. Breach notifications will include: the nature of the breach, the types of personal information involved, what we have done in response, and recommended steps for affected individuals to minimise potential harm.

10. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or outdated information
• Ask us to delete your personal information — see our Data Deletion page. Australian privacy law doesn't give a general right to deletion, but we will delete your information on request, except where we need to keep it (for example, billing records or a do-not-call request).
• Opt out of marketing communications at any time
• Request information about cross-border disclosures of your data
• Download your call recordings from Call Logs in your dashboard, and ask us for a copy of your transcripts and other data
• Request human review of an automated decision that significantly affects you (see Section 4)
• Object to new sub-processors processing your data (see Section 5)
• Receive a copy of your data in a portable format (CSV or JSON) on request

We will respond to access, correction and deletion requests within 30 days. To exercise these rights, email privacy@jortelligence.ai or use the form on our Data Deletion page. If you called a business that uses Jortelligence, you can ask that business or us.

11. Call Recording and Consent

J-Voice Agent facilitates AI-powered telephone conversations. Recording and interception of these calls is governed by the following legislation:

• Federal: The Telecommunications (Interception and Access) Act 1979 (Cth) permits one-party consent to recording. As the AI agent is a party to the conversation on behalf of the account holder, this threshold is satisfied at the federal level.
• State and Territory variations: NSW (Surveillance Devices Act 2007), WA (Surveillance Devices Act 1998), SA (Surveillance Devices Act 2016), TAS (Listening Devices Act 1991), and ACT (Listening Devices Act 1992) require all-party consent or notification before recording.

Our default configuration: The AI agent's greeting includes a recording disclosure statement (e.g., "This call may be recorded for quality and training purposes"). Continuation of the call after this disclosure constitutes implied consent under applicable state and territory laws.

Customer obligations: Account holders must not disable the recording disclosure. Account holders are responsible for ensuring compliance with state-specific consent requirements for their jurisdiction of operation. We provide configurable disclosure wording but cannot provide legal advice on jurisdiction-specific requirements.

12. Cookies and Analytics

Our website uses cookies and similar technologies to improve your experience, analyse usage patterns, and measure the effectiveness of our content. We use:

• Essential cookies: required for authentication, security, and core platform functionality.
• Analytics cookies: used to understand how visitors interact with our website (e.g., PostHog).

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Services.

13. Children's Privacy

Our Services are designed for use by businesses and are not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete that information promptly.

14. Data Portability and Export

Account holders can download call recordings from Call Logs in the dashboard at any time. For a full copy of your data — call transcripts and call logs, contacts and your do-not-call list — contact us and we will send it in a portable format (CSV or JSON) within 10 business days.

When your account is closed, we keep your data for 30 days so you can ask for a copy, and then permanently delete it, except for the records we must keep (see Section 7 and our Data Deletion page). Cancelling a paid plan does not close your account; your account moves to the Free plan.

15. Aggregated and De-identified Data

We may generate aggregated, anonymised statistical data from Service usage. Such data cannot identify any individual or business and is not considered personal information under the Privacy Act 1988.

Aggregated data may be used for benchmarking, service improvement, and industry research. This data is owned by Jortel Australia Pty Ltd and may be used without restriction, as it cannot be re-identified.

16. International Users

Our Services are designed for the Australian market. If you access our Services from outside Australia, you do so at your own initiative and are responsible for compliance with local laws in your jurisdiction.

We do not specifically target residents of the European Union or United Kingdom. If you are subject to the General Data Protection Regulation (GDPR) or UK GDPR and wish to use our Services, please contact us at dpa@jortelligence.ai to request our Data Processing Addendum.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a prominent notice on our website at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of our Services after changes constitutes acceptance of the updated policy.

Material changes will be highlighted in a summary at the top of this page for 30 days following the update, describing what changed and why.

18. Contact Us and Complaints

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

Complaints Process

• Step 1: Contact us at privacy@jortelligence.ai with details of your complaint.
• Step 2: We will acknowledge your complaint within 5 business days and provide a substantive response within 30 days.
• Step 3: If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.

For data processing enquiries or to request our Data Processing Addendum, contact dpa@jortelligence.ai.