Privacy policy

1. Who we are

Novara Tech Pty Ltd ("Novara Tech", "we", "us", "our") builds and operates AI receptionist, voice agent and workflow automation services for Australian businesses. We are based in Melbourne, Victoria. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains what we collect, why, who we share it with, how long we keep it, and how to have it deleted.

2. What we collect

Information you give us directly

• Name, email address, phone number and business name when you submit a contact or demo form.
• Your industry and any message content you type into a form.
• Business description text you provide when configuring a demo call.

Call audio and transcripts

When an AI agent answers or places a call, the call audio is recorded and a written transcript is generated. The transcript and audio are stored so the client business can review what was said, follow up on enquiries, and verify service quality. Callers are told the call may be recorded at the start of each call.

Call metadata

• Phone numbers of callers and recipients.
• Call times, durations, and outcomes (for example, booking made or message taken).
• For demo calls: a one-way cryptographic hash (SHA-256) of the phone number used for rate limiting. We cannot recover the number from the hash.

Website and device information

• IP address (used for rate limiting and abuse prevention), browser type, and pages visited.
• Marketing analytics via cookies and the Meta pixel, described in section 9.

3. How we use it

We use personal information to:

• Answer, make and manage calls on behalf of client businesses, including taking messages and making bookings.
• Provide clients with access to their call transcripts, recordings and call logs.
• Respond to enquiries and provide support to our clients.
• Operate, secure and rate-limit our website and demo systems.
• Bill clients and keep business records.

We do not use client call audio or transcripts to train third-party AI models. We do not sell personal information.

4. Calls we make on behalf of clients

If you call or receive a call from an AI agent operated by Novara Tech on behalf of a client business, that client business is the recipient of your information. We act as the operator of the platform; the client decides how the call content is used in their business. You can ask the client business for details of what was recorded, or contact us and we will pass the request through.

5. Subprocessors

We use the following subprocessors to deliver the service. This list matches the table on our security page:

• OpenAI - language model. Processes transcript text. United States.
• ElevenLabs - speech synthesis. Processes response text. United States.
• Crazytel - Australian telephony carriage. Processes phone numbers and call metadata. Australia.
• Twilio - legacy telephony carriage. Processes phone numbers and call metadata. United States.
• Supabase - application database and logs. Stores contact details and call logs. Australia (ap-southeast-2, Sydney).
• Oracle Cloud - workflow execution. Processes data that varies by client integration. Australia (ap-sydney-1).

Systems we connect to at a client's direction, such as their booking system, CRM or e-commerce platform, remain under that client's control and are not our subprocessors.

6. Australian Privacy Principles

We take steps consistent with the APPs, including:

• Collecting personal information only where reasonably necessary for our functions (APP 3).
• Notifying individuals of collection and its purpose, including through this policy and recorded call openings (APP 5).
• Not using or disclosing personal information for purposes beyond what a reasonable person would expect, without consent (APP 6).
• Taking reasonable steps to protect information from misuse, interference, loss and unauthorised access (APP 11).
• Allowing access to, and correction of, personal information on request (APP 12 and 13).

7. Cross-border disclosure

Most records - contact submissions, call logs, and client account data - are stored in Australia. Personal information may be disclosed to service providers located in the United States, which is currently the only overseas country involved: OpenAI, ElevenLabs and Twilio process call content or call metadata on United States infrastructure. Where personal information is disclosed to an overseas recipient, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the APPs, including through the provider's contractual data processing terms.

8. Retention

Retention periods are set per client at deployment and can be shortened on request. Our defaults, which are identical to the figures on our security page, are:

• Call audio: 90 days.
• Transcripts: 12 months.
• Call metadata and logs: 24 months.
• Contact form submissions: 24 months.
• Demo call logs on this website: call metadata and phone number hashes are purged automatically after 30 days.
• Billing records: retained as required by Australian tax law.

9. Cookies and the Meta pixel

Our website uses cookies that are necessary for the site to work. With your consent, we also use the Meta pixel to measure whether advertising on Facebook and Instagram leads to enquiries: when a visitor submits a booking form and reaches the thank-you page, a "Lead" event is sent to Meta. The event does not include the content of your enquiry.

The pixel does not load until you accept in the consent banner shown on your first visit. You can decline, and every part of the site including the contact forms continues to work. Your choice is stored in your browser and can be reset by clearing your browser storage for this site. You can also block or delete cookies through your browser settings, and opt out of Meta's use of cookies through Meta's own ad preference settings.

10. Access, correction and deletion

You can ask us what personal information we hold about you, ask for corrections, or ask for deletion. Email us and we will respond within a reasonable time, typically within one business day. Deletion requests are actioned from the live systems and confirmed in writing once complete. There is no charge for a reasonable access or deletion request.

11. Changes to this policy

We may update this policy as the service changes. The current version is always published on this page with the date of the last update.

12. Contact for privacy enquiries