Privacy Policy

About this policy

Arcane Solutions (ABN 86 906 679 905), referred to as "we", "us" or "our", is an AI consulting, automation and web design business based in Brisbane, Queensland.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, where it is kept and the choices you have.

Who this policy covers

• Clients: businesses and the people who work with us directly.
• Enquirers: people who contact us through our website, email or phone.
• Our clients' customers: people who call, message or enquire with a business that uses a system we run, such as an AI receptionist or instant reply system.

Information we collect

From clients and enquirers

• Name, business name, role, email address and phone number.
• Business details needed to build a system, such as services, prices, opening hours and common customer questions.
• Billing details. Card payments are processed by our payment provider. We do not see or store full card numbers.

Through systems we run for clients

• Caller or enquirer name and phone number, and email address if given.
• What the enquiry is about, such as the service or treatment of interest.
• Call transcripts and summaries, message history and booking details.
• Call recordings, only where the client has asked for recording to be switched on.

Our role when we run a system for a client

When we run an AI receptionist or similar system for a business, we handle their customers' information on that business's behalf and under their instructions. The business decides what the system says, what it collects and how long information is kept.

We do not use that information for our own purposes, contact those customers ourselves, or combine it with data from other clients.

How we use information

• To design, build, run, test and improve the services a client has engaged us for.
• To answer enquiries, take bookings and pass messages to the client.
• To send clients call summaries, lead alerts and reports.
• To invoice, provide support and meet our legal obligations.
• To reply to people who contact us, and occasionally send updates about our services. You can opt out of updates at any time.

We do not sell, rent or trade personal information.

Health and sensitive information

Some clients, such as clinics, receive calls where people mention personal or health details. We keep this to a minimum:

• Assistants are set up so they do not ask about medical history or health conditions. They ask only what is needed to help, such as the service of interest and contact details.
• Assistants do not give medical, legal or financial advice. Those questions are passed to the client.
• If a caller volunteers sensitive details, they are handled with the same protections and deleted on the same schedule as other call data.

AI disclosure and call recording

Every AI assistant we deploy tells callers at the start of the conversation that they are speaking with an automated assistant.

Call recording is off by default. If a client asks for it to be switched on, the assistant tells callers the call may be recorded before the conversation continues.

Service providers and overseas storage

We use trusted third party providers to deliver our services. Depending on the service, these include:

• Telephony and SMS (for example, Twilio).
• AI voice and language processing (for example, Retell AI and OpenAI).
• Calendars and booking tools, email, website hosting, website forms and payment processing.

Some of these providers store or process data in the United States. Before using a provider we check that it encrypts data, limits access and does not use customer data to train its models. We will tell any client which providers their system uses on request.

AI model training

We do not use client data, caller data, transcripts or recordings to train AI models, and we do not allow our providers to do so under the terms we use them on.

Security and retention

• Data is encrypted in transit and at rest by our providers.
• Access is limited to the client and Arcane Solutions, protected by strong passwords and two factor authentication where available.
• Call transcripts and summaries are deleted after 30 days by default. Clients can choose a shorter or longer period.
• When a client stops using a service, or asks us to, we delete all stored call data for that client and confirm it in writing within 7 days.
• Business and billing records are kept for as long as Australian tax law requires.

Access, correction and deletion

You can ask to see the personal information we hold about you, have it corrected, or have it deleted. Email us and we will respond within 30 days.

If your information was collected through a business that uses one of our systems, you can contact that business directly or contact us and we will work with them to respond.

Our website

Our website collects the details you enter into our contact form so we can reply. We may use basic analytics to understand how the site is used. These do not identify you personally.

Data breaches

If a breach is likely to cause serious harm, we will notify affected clients promptly and help them meet their obligations under the Notifiable Data Breaches scheme, including notifying the Office of the Australian Information Commissioner (OAIC) where required.

Complaints

If you have a concern about how we have handled your information, contact us first and we will respond within 30 days. If you are not satisfied with our response, you can contact the OAIC at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. The latest version will be available on request and on our website, with the effective date shown at the top.