This Privacy Policy outlines how Evolving Technologies Pty Ltd (ABN 72 654 819 128), trading as Valory AI ("we", "us", or "our"), collects, uses, discloses, stores, and protects personal information in connection with our AI voice agent platform and related services (collectively, the "Service").
We are committed to protecting your privacy and managing your personal information in an open and transparent manner, in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the Australian Privacy Principles (APPs).
This Policy applies to:
We will only collect, use, and disclose personal information in accordance with the APPs and for purposes that are directly related to our functions and activities. Where we use or disclose personal information for a secondary purpose, we will do so only where that secondary purpose is directly related to the primary purpose of collection and the individual would reasonably expect such use or disclosure, or where we have obtained consent or are otherwise authorised by law (APP 6).
When we process personal information about end-users (such as callers to your business), we generally do so on behalf of the business customer as a service provider (or "data processor"). The business customer is typically responsible for:
If you are an end-user with questions about how a particular business handles your personal information, we encourage you to contact that business directly or refer to their privacy policy.
We collect information that is reasonably necessary to provide, secure, and improve our Service (APP 3). We do not collect personal information unless it is reasonably necessary for, or directly related to, one or more of our functions or activities. The types of personal information we may collect include:
When you register for the Service, we collect information necessary to create and manage your account, including:
To process subscriptions and usage fees, we collect billing details such as billing address, billing contact name, and payment method type. Payment information is securely processed by our third-party payment processors (such as Stripe). We do not store your full credit card numbers, debit card numbers, or bank account numbers on our systems.
As the core of our Service, we process data generated from phone interactions ("Call Data"), including:
Call Data may contain personal information about end-users (callers) and, in some cases, may include Sensitive Information depending on the nature of the call and the business being contacted. Call Data applies to both inbound calls received by the Service and outbound calls or SMS messages initiated through the Service on your behalf.
Depending on how you use the Service, callers may share Sensitive Information (as defined in the Privacy Act), which includes (without limitation):
We do not intentionally solicit or request unnecessary Sensitive Information. However, we may collect and handle Sensitive Information where it is:
We handle Sensitive Information in accordance with this Policy and the Privacy Act. We will only collect, use, or disclose Sensitive Information where:
For training and service improvement purposes, we will only use Sensitive Information in de-identified or aggregated form, or where appropriate consent has been obtained in compliance with the Privacy Act. We will not use identifiable Sensitive Information for cross-customer training or improvement purposes.
Call recordings processed through the Service contain voice characteristics of callers. We acknowledge that voice recordings may contain characteristics that could constitute biometric information (as defined in the Privacy Act). We do not create, store, or process voiceprints, speaker identification templates, or other biometric templates derived from call recordings. Voice recordings are processed solely for the purposes of providing the Service (including transcription, AI response generation, and call analytics) and are retained and deleted in accordance with Section 6 of this Policy.
To connect Valory with your other business tools and systems, we may collect and store (in encrypted format):
These credentials are stored securely and are used solely to facilitate the integrations you have authorised.
We automatically collect information about how you and your end-users interact with the Service, including:
We use cookies and similar technologies (such as web beacons, pixels, and local storage) to operate, secure, and analyse our Service, authenticate users, remember your preferences, and improve user experience. You can control cookie settings through your browser.
We primarily use essential and functional cookies that are necessary for the operation of our Service. We may describe any additional analytics or advertising cookies in this Policy or in a separate cookies notice if and when such cookies are implemented.
We use the information we collect for the following purposes:
If you connect your Google account to use Google Calendar features, we access and process Google user data only as needed to provide and improve those user-facing features (for example, checking availability and creating or updating calendar bookings at your direction).
Valory's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
The AI training and model improvement language in this Policy does not apply to Google API Services user data.
We do not sell your personal information. We may share personal information under the following limited circumstances:
We engage third-party companies and service providers to perform functions on our behalf. These providers are contractually required to protect your data, maintain confidentiality, and are restricted to using personal information only for the purposes we specify and in accordance with our instructions. Categories of service providers include:
We maintain a list of our material sub-processors (third-party service providers who process personal information on our behalf) and will make this list available upon reasonable written request to legal@valory.com.au. We will provide reasonable prior notice before engaging any new sub-processor that will have access to Customer Data, as described in our Terms of Service.
When you connect a third-party service (e.g. a calendar, booking platform, practice management system, or CRM) to your Valory account, we will share information with that service as directed by you and as necessary to facilitate the integration and provide the features you have enabled.
We may disclose personal information to our professional advisers (including lawyers, accountants, auditors, and insurers) where reasonably necessary for the purposes of obtaining professional advice, managing legal proceedings, or administering insurance claims. Such disclosures are made under obligations of professional confidence.
We may disclose your personal information if required to do so by law or in response to a valid legal process, such as a court order, subpoena, warrant, or government or regulatory investigation (including by the OAIC, ACMA, ACCC, or other regulatory body). We may also disclose information where we believe in good faith that disclosure is necessary to:
In the event of a merger, acquisition, sale of assets, corporate restructuring, financing, change of control, or insolvency event, your personal information may be transferred as part of that transaction. We will take reasonable steps to ensure that any recipient continues to handle your personal information in accordance with this Policy and applicable law, and we will provide notice of any such transaction where required by law.
We implement reasonable technical and organisational measures designed to protect the personal information we process against unauthorised access, modification, disclosure, destruction, or loss (APP 11). These measures include:
While we take security seriously and strive to use commercially reasonable means to protect personal information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, and we cannot warrant that the Service will be immune from security vulnerabilities, cyberattacks, or data breaches.
In the event of a data breach involving personal information, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). This means:
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, to provide the Service, to comply with our legal obligations, resolve disputes, and enforce our agreements (APP 11.2). Our general retention practices are as follows:
Where we refer to "de-identified" information in this Policy, we mean information from which we have removed or altered personal identifiers such that a reasonable person in our position would not be able to re-identify the individual to whom the information relates, having regard to all reasonably available means and the information available to us. Our de-identification processes may include removing names, phone numbers, email addresses, and other direct identifiers; generalising or aggregating data; and applying technical measures to reduce re-identification risk. We periodically review our de-identification practices in light of technological developments and emerging guidance from the OAIC.
We take reasonable steps to delete or de-identify Call Data after the applicable retention period. In practice, this may include deleting call recordings (where stored), deleting transcripts and call-linked execution logs, and scrubbing personal identifiers (such as phone numbers) from call records, while retaining minimal metadata needed for billing, security, and legal compliance.
We may retain aggregated or de-identified information (which does not identify you or any individual) indefinitely for analytics, research, benchmarking, and service improvement purposes.
For clarity, this retention statement does not expand how we use Google API Services user data, which remains subject to Section 3.1 and applicable law.
Following termination of your account, we will take reasonable steps to delete or de-identify your personal information within a reasonable timeframe (subject to any applicable retention period you have configured), except where we are required or permitted to retain it for:
You may request the deletion of your account and associated personal information by contacting us at legal@valory.com.au. We will process such requests in accordance with our obligations under the Privacy Act. For information about exporting your data before or after account termination, please refer to our Terms of Service.
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have certain rights regarding your personal information. These rights apply to both customers and individuals (including end-users) whose personal information we may hold.
You may request access to the personal information we hold about you (APP 12). We will respond to access requests within a reasonable period (usually within 30 days) and will provide access to the information in the manner you request, if it is reasonable and practicable to do so. We may charge a reasonable fee for providing access in certain circumstances. We may refuse access in limited circumstances permitted by law, in which case we will provide you with written reasons for the refusal and information about how to make a complaint.
You may request correction of any personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13). We will take reasonable steps to correct the information if we are satisfied that the information is inaccurate, out of date, incomplete, irrelevant, or misleading, having regard to the purpose for which it is held. If we refuse to correct the information, we will provide you with written reasons and information about how to make a complaint.
Where we hold personal information about you that is no longer needed for any purpose for which it may be used or disclosed under the APPs, and we are not required by law to retain it, we will take reasonable steps to destroy or de-identify that information (APP 11.2). You may request that we delete your personal information by contacting us at legal@valory.com.au. We will assess each request on its merits and inform you of the outcome.
You have the right to opt out of receiving direct marketing communications from us at any time (APP 7.6). You can do so by: (a) following the "unsubscribe" link in any marketing email; (b) contacting us at legal@valory.com.au; or (c) updating your communication preferences in your account settings. We will process your opt-out request as soon as practicable and will not charge you for making such a request. You may also request that we provide you with the source of the information used for direct marketing purposes (APP 7.6(c)).
Where practicable, you have the option of not identifying yourself or using a pseudonym when dealing with us (APP 2). However, given the nature of the Service (which requires account registration, payment processing, and business identification), it is generally not practicable for customers to use the Service anonymously or under a pseudonym. End-users who call your business may choose not to identify themselves during a call, but this may affect the service they receive from your business.
If you believe we have breached the Australian Privacy Principles or mishandled your personal information, you may make a complaint by contacting us at legal@valory.com.au with the details of your complaint. We will investigate your complaint and respond within a reasonable time (usually within 30 days).
If you are not satisfied with our response or how we have handled your complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
To exercise any of the above rights, please contact us at legal@valory.com.au. We may need to verify your identity before processing your request to protect the security of personal information. We will not charge you for making a request (except where a reasonable fee for access is permitted under APP 12.8).
Note for End-Users: If you are an end-user (e.g. a caller) whose personal information has been collected by a business using our Service, you should first contact that business directly to exercise your privacy rights. We will assist businesses in responding to legitimate privacy requests from their end-users as required.
Our Service is primarily hosted and operated in Australia. However, in providing the Service, we use third-party service providers (as described in Section 4.1) that may be located in or process personal information from data centres located outside Australia.
These providers may be based in or process data from countries including the United States (e.g. Stripe, Twilio, OpenAI, ElevenLabs, Vercel, AWS, Sentry) and the European Union, among others. The specific countries may change from time to time as we engage new providers; our current sub-processor list (available upon request) identifies the countries in which each material sub-processor operates.
When we transfer personal information internationally, we take reasonable steps to ensure that overseas recipients do not breach the Australian Privacy Principles (APPs) in relation to such personal information, in accordance with APP 8. These steps may include:
We only transfer personal information overseas where it is necessary for the purposes described in this Policy, where we have taken appropriate safeguards, or where we are required to do so by law.
Important: Where we disclose personal information to an overseas recipient and we have taken reasonable steps under APP 8.1 to ensure the recipient does not breach the APPs, we remain accountable under the Privacy Act if the overseas recipient handles the information in a way that breaches the APPs. By using our Service, you acknowledge the transfer of personal information to locations outside Australia as described in this Section, subject to the safeguards described above and in accordance with the Privacy Act.
The Service uses artificial intelligence and automated processing to handle calls, generate responses, create bookings, and perform other actions. In the interests of transparency, we provide the following information about how AI processing relates to your personal information:
Our Service is designed for use by businesses and is not intended for, or directed at, individuals under the age of 18. We do not knowingly collect personal information directly from children.
If you are a business customer whose end-users may include minors (for example, a medical practice where parents call to book appointments for their children), you are responsible for ensuring that you have obtained appropriate parental or guardian consent for the collection of any personal information about minors and for providing appropriate privacy notices.
If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will take reasonable steps to delete such information as soon as practicable. If you believe we have collected personal information about a child inappropriately, please contact us at legal@valory.com.au.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational or business reasons. When we make material changes to this Policy, we will notify you by:
We will endeavour to provide at least thirty (30) days' notice of material changes where practicable. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.
The updated Policy will take effect from the date it is posted (as indicated by the "Last Updated" date), unless otherwise stated. If you do not agree to a material change, you may terminate your use of the Service by providing written notice to us before the updated Policy takes effect. Your continued use of the Service after the updated Policy takes effect constitutes your acknowledgement of the updated Policy and your agreement to be bound by its terms.
If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise any of your privacy rights, please contact us:
We will endeavour to respond to your enquiry as soon as reasonably practicable and within any timeframes required by law.
Questions about this policy? Contact us at legal@valory.com.au