Privacy Policy

Effective day 07.01.25

1. Introduction

Welcome to Operator. This Privacy Policy explains how Operator Platform Pty Ltd (ACN 686101440) ("Operator," "we," "us," or "our"), an Australian company, collects, uses, stores, shares, and protects personal information when you use our websites, applications, platform, AI voice answering service and related services (collectively, the "Service").

This Policy applies to the personal information we process related to our business customers ("Customers," "you," "your") who subscribe to our Service. It also describes how we process personal information about the individuals who call our Customers ("Callers") when we handle those calls on behalf of our Customers.

Our Terms of Service https://heyoperator.com/terms govern your use of the Service and are incorporated herein by reference. By using the Service, you agree to the collection, use, and disclosure of information in accordance with this Privacy Policy and our Terms of Service.

2. Information We Collect

We collect different types of information in connection with the Service:

a. Information Provided by Customers: When you register for an account, manage your profile, or communicate with us, we collect information such as:

Account Information: Full name, email address, password.

Business Information: Business name, business address, description of business services, opening hours, business phone number, business website.

Payment Information: While we use a third-party payment processor (Stripe), we may store billing addresses provided by you, the last four digits of your credit card number, and payment tokens provided by Stripe to facilitate billing. We do not store full credit card numbers.

Communications: Information you provide when you contact us for support or other inquiries.

Configuration Data: Information you provide to configure the Service, such as call handling instructions or integration details.

b. Information Processed on Behalf of Customers (Caller Data): When Operator answers calls for your business, we process information about the Caller on your behalf as a 'data processor' or 'service provider'. This includes:

Caller Phone Number: The phone number of the incoming call (Caller ID).

Call Audio Recordings: Recordings of the conversations between the Caller and the Operator AI agent.

Call Transcripts: Text transcriptions generated from the call audio recordings.

Call Summaries: AI-generated summaries of the call content.

Call Metadata: Associated information such as the call timestamp, duration, and AI-derived categorisations or tags related to the call's purpose (e.g., "booking inquiry," "sales lead").

Important Note on Caller Consent & Sensitive Data: As outlined in our Terms of Service (Section 5.2), you, the Customer, are solely responsible for complying with all applicable laws regarding call recording notifications and consents. Operator provides features like a default call announcement message to assist, but using these features does not guarantee your compliance. Furthermore, while our Service is not intended for processing highly sensitive data (as per ToS Section 5.3), Callers may incidentally disclose sensitive personal information (e.g., health or financial details) during a call. You are responsible for determining if the Service is appropriate for your business needs considering these factors. Operator processes such data solely on your behalf as part of the Service delivery. [Note to Operator: Ensure your Terms of Service (Sections 5.2 & 5.3) strongly reflect this customer responsibility.]

c. Information Collected Automatically (Usage Data): When you interact with our website or Service, we automatically collect certain information:

Log Data: IP address, browser type, operating system, device information, pages visited, features used, access times and dates, error logs.

Usage Analytics: Information about how you use the Service, such as call volume, feature adoption, and performance metrics.

d. Cookies and Tracking Technologies: We use cookies, pixels, and similar technologies to operate and improve the website and Service, analyse usage, and personalise content and advertising. See Section 10 ("Cookies and Tracking Technologies") for more details.

3. How We Use Information

We use the information we collect for various purposes:

To Provide and Maintain the Service: Delivering core functionality like answering calls, generating transcripts and summaries, managing your account, processing payments, and providing customer support.

To Improve and Develop the Service: Analysing usage patterns to understand user needs, troubleshoot issues, enhance existing features, and develop new products or services. This primarily involves using aggregated and anonymised data derived from User Content (as defined in the ToS). See Section 4 for details on AI processing.

To Communicate with You: Sending service-related announcements, updates, security alerts, administrative messages, and responding to your inquiries.

For Marketing and Advertising: Sending promotional communications about Operator's services (you can opt-out), and potentially personalising advertising content based on your interactions with our website or Service (subject to your choices). We do not use Caller Data for marketing or advertising purposes.

For Security and Fraud Prevention: Monitoring for suspicious activity, preventing violations of our Terms of Service, protecting the rights and safety of Operator, our Customers, Callers, and the public.

For Legal Compliance: Complying with applicable laws, regulations, legal processes, or governmental requests; enforcing our Terms of Service.

4. AI Processing and Service Improvement

Our Service utilises artificial intelligence (AI) to provide features like call transcription, summarisation, and categorisation. This processing is done to deliver the Service features you subscribe to.

Currently, Operator does not use personal information contained within Customer Data or Caller Data (such as call audio or transcripts) to train our general AI models used across customers. We may use aggregated, de-identified, or statistical data derived from service usage to analyse, maintain, improve, and develop our AI models and overall Service performance.

If we intend to use personal information (especially Caller Data) for AI model training or improvement purposes in the future, we will update this Privacy Policy, provide clear notice, and implement appropriate mechanisms for user control (such as opt-out options or obtaining explicit consent where required by applicable law).

5. Data Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

With Subprocessors: We use third-party service providers (subprocessors) to help us operate the Service. Key categories include:

Cloud Hosting Providers

Telephony and Communication Service Providers

AI and Speech-to-Text Service Providers

Payment Processors (e.g., Stripe)

Analytics Service Providers (e.g., Google Analytics, PostHog)

These providers process personal data on our behalf based on our instructions. We ensure our subprocessors are subject to appropriate contractual obligations regarding data protection and confidentiality. A list of our key subprocessors is available here: [Link to Subprocessor List - To Be Added]. [Note to Operator: Ensure this list is created, maintained, and linked, and that appropriate contracts are executed.]

For Legal Reasons: We may disclose information if required by law, regulation, subpoena, legal process, or governmental request, or if we believe disclosure is necessary to protect the rights, property, or safety of Operator, our users, or the public.

Business Transfers: If Operator is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality arrangements.

With Your Consent: We may share information for other purposes with your explicit consent.

6. International Data Transfers

Operator is based in Australia. We primarily store and process data in secure data centres located in Australia, the United States, and Singapore. Your personal information may be transferred to and processed in countries other than your own, where data protection laws may differ.

When we transfer personal information internationally, we take steps to ensure your information is treated securely and in accordance with this Privacy Policy and applicable laws, such as the Australian Privacy Principles. This may include implementing appropriate contractual clauses or verifying the recipient adheres to recognised data protection standards.

7. Data Security

We implement appropriate technical and organisational security measures designed to protect the personal information we process against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures include encryption in transit (TLS/SSL), encryption at rest, access controls based on role and necessity, security monitoring, vulnerability testing, employee training, and multi-factor authentication where appropriate. However, no internet transmission or electronic storage is 100% secure, so we cannot guarantee absolute security.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include:

Customer Account Information: Retained while your account is active and for up to 180 days after closure necessary for purposes such as billing resolution, legal or regulatory compliance (e.g., financial record-keeping), and facilitating potential account reactivation.

Caller Data (Audio, Transcripts, Metadata): Retained while your customer account is active to provide you with access to call history and details through the Service. This data is deleted upon (or shortly after) the closure of your account, unless required to be retained longer for specific legal hold or dispute resolution purposes. [Note to Operator: Be mindful of data minimisation principles; retaining all call data for the entire active account lifecycle carries some risk compared to shorter, fixed retention periods.]

System Backups: Retained according to our backup cycle schedule and are protected from unauthorised access or operational use. Data within backups is deleted as the backups expire.

9. Your Privacy Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information:

Customer Rights: As a Customer, you generally have the right to:

Access the personal information we hold about you.

Correct inaccurate personal information.

Request deletion of your personal information, subject to certain exceptions.

Lodge a complaint with a relevant privacy authority (like the Office of the Australian Information Commissioner).

You can typically exercise some of these rights through your account settings. For other requests, please contact us using the details below.

Caller Rights: If you are a Caller whose call was handled by Operator on behalf of one of our Customers, Operator processes your information as a service provider for that Customer. You should direct any requests to exercise your privacy rights (e.g., access, correction, deletion) directly to the business (our Customer) that you initially contacted. Operator will assist our Customers in responding to Caller rights requests as required by law and our contractual agreements.

10. Cookies and Tracking Technologies

We use cookies (small text files placed on your device) and similar technologies (like web beacons or pixels) on our website and Service. These are used for various purposes:

Essential Operations: Necessary for the website and Service to function (e.g., login sessions, security).

Performance and Analytics: To understand how users interact with our services, measure performance, and identify areas for improvement (e.g., Google Analytics, PostHog).

Functionality: To remember your preferences and settings.

Marketing and Advertising: To personalise content and advertising, measure ad effectiveness, and enable targeted advertising (e.g., Meta Pixel).

You can typically manage cookie preferences through your browser settings, which allow you to refuse or delete cookies. However, disabling certain cookies may affect Service functionality.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected such information, we will take steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will notify you (e.g., via email or a notice on the Service) prior to the change becoming effective, as outlined in our Terms of Service (Section 17). We encourage you to periodically review this page for the latest information on our privacy practices.