Join the waitlist

Privacy Policy

Version 1.0 · Effective September 2026 · Hello Harper

1. About this Privacy Policy

1.1 This Privacy Policy explains how Hello Harper collects, holds, uses and discloses personal information. Our privacy program is designed to meet the Australian Privacy Principles (the APPs) under the Privacy Act 1988 (Cth) (the Privacy Act), and we comply with the Privacy Act where it applies to us. Because we record calls and use call recordings, transcripts and sometimes sensitive information for our own business purposes, we hold ourselves to these standards and do not treat being a small business as a reason to apply a lower one.

1.1A Who this policy is for. This policy is for:

  • Customers — businesses that subscribe to the Service;
  • Callers — people who phone, message or otherwise interact with a Customer’s business through the Service;
  • people we call — businesses and individuals we contact on our own outbound AI sales or demonstration calls; and
  • website visitors and people who contact us — anyone who uses our website or gets in touch.

Where a section applies only to one of these groups, it says so.

1.2 Key terms:

  • “personal information” — information about an identified or reasonably identifiable individual; it includes voice recordings, transcripts, and information we infer about a person.
  • “sensitive information” — a protected category of personal information (for example, health or biometric information). Some voice data can be sensitive information — see section 5.
  • “the Service” — the Hello Harper platform of AI business tools we provide to business customers on subscription. At launch it is the AI voice receptionist, which answers a Customer’s inbound calls, greets callers, handles routine enquiries, takes messages and details, sends SMS, gives quotes using only the information the Customer provides (it does not invent prices), and — where the Customer connects its Google Calendar — checks availability and books appointments on the Customer’s behalf. Separately, Hello Harper runs its own outbound AI sales and demonstration calls. A Customer running its own outbound calling or SMS campaigns is a possible future feature, not offered at launch.
  • “Customer” — a business that subscribes to the Service.
  • “Caller” — a person who interacts with the Service when it operates for a Customer (for example, someone phoning a business that uses Hello Harper).
  • “Caller information” / “Caller personal information” — the personal information about a Customer’s Callers that the Service collects or handles on the Customer’s behalf (for example, call audio, transcripts, phone numbers, SMS content, call/message metadata, and derived or inferred data). This is the same information as “Caller Data” as defined in the Terms; this policy uses the plainer “Caller information” / “Caller personal information”, and the Terms use the defined term “Caller Data”. The two mean the same thing.

1.3 Where Hello Harper is responsible for a collection notice, we give one at or before the time of collection (or as soon as practicable afterwards), covering the matters the APPs require. Where the Service handles Caller information for a Customer, the Service includes built-in in-call disclosures, and the Customer remains responsible for the notices and consents required for its use of the Service (see sections 2 and 10). This policy is not, by itself, consent to recording or to collecting sensitive information; where consent is needed, we seek it separately.

1.4 Dealing with us anonymously or by pseudonym. You can deal with us anonymously or by a pseudonym for things like a general enquiry or browsing our website. We will need enough information to identify you for accounts, billing, taking a message or returning a call, and responding to an access or correction request — so anonymity will not be practicable in those cases.

1.5 This policy does not form part of any contract. Where Hello Harper acts as a Customer’s service provider (Processor) (see section 2), the handling of Caller personal information is also governed by our agreement with that Customer, including its data-processing terms (Section 20). Any rights, obligations and limitations of liability between Hello Harper and a Customer are set out in that agreement (the Terms of Service), not in this policy.

2. Our two roles: acting for ourselves, or as a Customer’s service provider

How the Privacy Act applies to your information depends on which of two roles Hello Harper is performing. In plain English, we are either acting for ourselves, or acting as a Customer’s service provider. For readers who know the data-protection labels, those two roles are also called Controller and Processor respectively. We use those labels in brackets for clarity; the binding allocation is set out in the Terms (Section 20). The labels are a convenient shorthand and do not, by themselves, decide either party’s obligations under the Privacy Act — the Act determines those. (The Privacy Act itself does not use these labels.) Where laws other than Australian privacy law apply to a Customer or its Callers, additional terms may be required.

Acting for ourselves (Controller).

We decide why and how personal information is handled for: our own outbound calls; our website, enquiries and marketing; and creating and managing Customer accounts and billing. For these, Hello Harper is the entity responsible under the APPs, and this policy governs how we handle the information.

Acting as a Customer’s service provider (Processor).

When the Service answers a Customer’s inbound calls, Hello Harper handles the Customer’s Callers’ information on the Customer’s behalf and on its instructions. As between us and the Customer, the Customer is responsible for its relationship with, and the notices and consents owed to, its Callers. Our handling is governed by the Terms.

Where the data is stored and processed.

Hello Harper runs the core AI components that handle a call in the AWS Sydney region (ap-southeast-2): it self-hosts the speech-to-text engine and the text-to-speech engine on its own AWS infrastructure, and runs the language model on AWS Bedrock in the Sydney region (a managed AWS service). So the primary processing of the call data we create (call recordings, transcripts, messages and the caller details captured on a call), and our primary, Hello Harper-controlled storage of it, are in Australia.

This is the confirmed primary position. It is not a blanket onshore claim, and we do not warrant that all processing happens only in Australia: some limited processing or transmission may occur overseas, including in the United States — in particular through our telephony/SMS carrier and incidental routing, and our payment provider processes a Customer’s billing data (not call data) overseas under its own terms (see sections 11 and 12). For any overseas disclosure we take the reasonable steps required by APP 8.1 and remain accountable under section 16C of the Privacy Act.

A Customer’s own separate business records and systems (its own customer database, files and accounts) stay in the Customer’s systems; we do not ingest them.

3. The two roles explained

3.1 When Hello Harper is acting for itself (Controller)

When we run our own outbound calls, operate our website, market the Service, or manage Customer accounts and billing, we handle personal information for our own purposes and are accountable for it under the APPs. The rest of this policy explains how.

3.2 When Hello Harper is acting as a Customer’s service provider (Processor)

When a Customer subscribes and the Service answers that Customer’s inbound calls:

  • Callers are dealing with the Customer’s business; the Customer has the primary relationship with, and is primarily responsible to, those Callers.
  • Hello Harper handles Caller information (call audio, transcripts, messages, derived data) on the Customer’s behalf and on its instructions, and stores it in our systems to provide the Service.
  • The Customer is responsible for the notices and consents its Callers are owed (see section 10 and the Terms).
  • If you are a Caller wanting to access, correct, or ask about your information, contact that business first; we will help direct your request (see section 16).

4. The kinds of personal information we collect

What we collect depends on how you interact with us:

(a) Contact and identity details — name, business name, role, phone number, email, business address.

(b) Business contact details from public sources — for our outbound calls, business names, numbers and publicly listed addresses from public directories and listing services. See section 7.

(c) Call recordings — audio of calls our AI handles, both our own outbound calls and a Customer’s inbound calls. Calls are recorded, and we store the recordings (see section 15).

(d) Transcripts and derived data — text transcripts, plus summaries, enquiry classifications, outcomes and similar data we generate from calls.

(e) Messages, enquiry details and quote information — the details a Caller gives the Service for the Customer (such as the Caller’s name and contact, the reason for the call, and a message to be passed on), and any quote the Service gives using pricing and information the Customer has provided or configured (the Service does not invent prices).

(f) Messaging content and metadata — the SMS we send or receive for the Service or sign-up, with related metadata (numbers, timestamps, delivery status, and call metadata such as time, duration and routing).

(g) Account and configuration information — what is needed to set up and run a Customer account.

(h) Payment information — handled by our payment provider; we receive confirmation of payment and subscription status only. We do not collect or store full card numbers or other financial-account details. Our payment provider handles a Customer’s billing data under its own terms (see sections 11 and 12).

(i) Website and technical information — IP address, device and browser details, and usage data from cookies when you use our website. Some cookies and analytics events may include identifiers (such as a device or account identifier). You can control or disable cookies in your browser, though some parts of the website may not work as intended.

(j) Support, diagnostic and security information — support requests, tickets and notes; technical diagnostics and error/event logs; and fraud-prevention and abuse signals (for example, indicators of suspicious traffic, spam, spoofing, excessive retries or attempts to misuse the Service). System event logs and support records may incidentally include some Caller information where it is needed to investigate or fix an issue.

(k) Approximate location — an approximate location we may infer from a phone number’s area or country code, or from an IP address. We do not collect precise GPS location.

(l) Correspondence — what you provide when you contact us, enquire, request support or complain.

(m) Calendar and booking information (where a Customer connects its Google Calendar) — to provide the appointment-booking feature, the Service accesses the Customer’s connected Google Calendar to read availability (including limited details of existing calendar entries, such as their timing, needed to tell whether a time is free) and to create, change or cancel appointments. The booking details the Service writes include the Caller’s name and contact details, the requested time, and the service or reason for the appointment. The Service uses this access only to check availability and manage bookings on the Customer’s behalf, and for no other purpose. See sections 7 and 11.

(n) Connected-service information (where a Customer connects a third-party service) — where a Customer connects a third-party service (a “Connected Service” — for example a calendar, CRM, messaging, email, accounting or scheduling service), we access and handle only the information needed to provide the feature the Customer has enabled, using access the Customer grants and can withdraw, and only while the connection is active. For lower-content integrations this may include availability and scheduling information, contact details and identifiers, and related metadata. Where a feature reads or writes the content of records, messages or entries, that content may include sensitive information or information about people who have not dealt with us directly; we treat connecting such a feature as a deliberate, gated step (handled under the written-approval and sensitive-information controls in section 5 and the Terms, with any further notice or consent the APPs require), not as an automatic part of any plan. We use connected-service information only to provide the connected feature on the Customer’s behalf and to keep it secure — not to train or develop our AI or voice models or other products and services; any use beyond providing the feature needs the Customer’s written agreement and a basis the APPs permit. For Caller information involved in a Connected Service, the protections in Section 20 of the Terms apply. (Google Calendar, in (m) above and section 7.5A, is the current example.)

We do not generally seek sensitive information, but some of the above (particularly voice data) may include it — see section 5. We do not seek government-related identifiers (such as a tax file number, Medicare number or driver-licence number), and we do not adopt, use or disclose them as our own identifier, except where required or authorised by law. If we accidentally receive one, we delete or redact it where lawful and reasonable.

Voice characteristics. Where our speech technology separates or labels speakers within a single call (so the transcript records who said what), any voice characteristics involved are used only transiently for that call’s transcription and speaker separation. We do not build a voiceprint or recognise a person across separate calls — see section 5.4.

Adding features and integrations over time. We may add or change features, tools and integrations. Where a new feature uses the kinds of information already described above for the purposes in section 8, no change to this policy is needed. Where a new feature would involve a genuinely new kind of personal information, a new purpose, a new overseas recipient or country, sensitive information, or automated decision-making with a legal or similarly significant effect, we will update this policy — and give any notice or obtain any consent the APPs require — before or when that feature becomes available.

5. Voice data, sensitive information, and voiceprints

5.1 Call recordings and transcripts are personal information and, depending on what is said, may include sensitive information (for example, health details a caller mentions). Sensitive information has stronger protections, including consent requirements.

5.2 Sensitive information. Our default is that the Service does not ask for sensitive information.

(a) Where the Service is deliberately configured to collect it for a Customer — for example, where a Customer operates in a health or similar field — the Customer is responsible, as the entity directing that collection, for obtaining the individual’s express consent (or relying on another basis the APPs specifically allow) as part of the notices and consents it owes its Callers (see section 10 and the Terms).

(b) The Customer’s consent responsibilities do not remove Hello Harper’s own obligations: where Hello Harper handles sensitive information (whether for a Customer or for its own purposes), Hello Harper retains its own duties under the Privacy Act and the APPs in respect of that handling — including the collection limits in APP 3 and the use and disclosure limits in APP 6 — and complies with them, in addition to any responsibilities the Customer carries (consistent with the Terms, section 8.4).

(c) A Customer must not configure the Service to deliberately collect sensitive information (or other high-risk information, such as health, biometric, children’s, financial-hardship, legal-matter or crisis information) without that consent and, where we require it, our written approval and any additional terms or plan we require.

(d) We may reject or suspend a use case that involves deliberate sensitive-information collection or other restricted use (see the Terms and section 18).

(e) Where Hello Harper collects sensitive information for its own purposes (as Controller), Hello Harper obtains express consent or relies on a basis the APPs allow. In each case, use is limited to handling the enquiry and the purposes in section 8.

Sensitive information and overseas processing. If any sensitive information surfaces on one of our own outbound calls (for example, where a person volunteers health information while declining), and to the extent any of that sensitive information is processed or transmitted overseas (for example, through the telephony/SMS carrier; see sections 11.2 and 12.1), we handle that sensitive information on the more protective APP 8.1 reasonable-steps footing (relying on contractual safeguards), not on the APP 8.2(b) consent footing in section 12.5. In other words, the “consequence of consent” carve-out in section 12.5 is not applied to sensitive information.

5.3 Unsolicited information. If we receive personal information we did not ask for, we assess whether we could have collected it under the APPs. If we could not (and it is not part of a Commonwealth record), we destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.

5.4 Voiceprints and biometric information. A call recording is not, by itself, a biometric identifier. A voiceprint — a persistent voice template used to recognise a person — would be biometric (and therefore sensitive) information, which attracts a higher consent bar.

(a) Our speech technology transcribes speech and may label which speaker said what within a single call — ordinary, expected processing that simply keeps track of who is speaking during that one call, using voice characteristics only transiently for that call (see section 4).

(b) The Service does not retain or reuse a reusable voiceprint or any cross-call speaker-recognition artefact, does not recognise a person as the same individual across separate calls, and does not use voice characteristics for biometric identification, identity verification or authentication.

(c) Any temporary same-call processing used only to tell speakers apart within a single call is not retained or reused.

(d) Voiceprints and similar identifiers are sensitive information under the Privacy Act; we will not create, retain or reuse a voiceprint, biometric template or cross-call speaker-recognition identifier unless we have first updated the Terms and this Privacy Policy and obtained express consent from each affected individual before collecting or using that biometric information.

6. Calls are AI-generated and recorded

6.1 Calls made by our outbound AI agent, and calls the Service answers for a Customer, are conducted by an automated, artificial-intelligence (AI) system, not a human operator.

6.2 The AI identifies itself. Whether the Service is answering calls for a Customer or making our own outbound and demonstration calls, the AI tells you it is an automated/AI assistant near the start of the call. In all cases, the AI is not configured to impersonate a specific, named real person or to deny that it is artificial — if you ask whether you are speaking with an AI, it will confirm that you are.

6.3 Calls are recorded. We record calls and create transcripts. Recording and transcription may be necessary to provide the Service (the AI understands and responds using the transcript). The Service is designed to give a recording notice near the start of the call and, if you do not wish to be recorded, to let you tell us and to act on your objection — by stopping recording and continuing only where the Service can do so, transferring you to a non-recorded path, or ending the call, as the Customer has configured (see the Terms and section 10). Recording and processing are for the purposes in section 8, which include improving, developing, training and analysing our AI and voice systems. If you do not want your recording used to train our systems, you can tell us (or the business you called) and we will act on it (see section 8.2).

6.4 For our own outbound calls (as Controller) Hello Harper is responsible for these disclosures. When the Service runs for a Customer (as Processor), the in-call AI and recording disclosures are built into the Service, and the Customer is responsible for ensuring its use is lawful in relation to its Callers (see section 10).

7. How we collect personal information

7.1 Directly from you — when you call or are called by our AI agents, use our website, enquire, subscribe, or correspond with us.

7.2 From recorded calls and messages — through the call audio, transcripts, derived data and SMS content described in section 4.

7.3 From public sources (our outbound calls — as Controller). We source business contact details from public directories and listing services to identify and call businesses that may be interested in the Service.

(a) Because we obtain these details before we call, our APP 5 collection notice is delivered in the call itself (and you can ask for it again at any time).

(b) At or near the start of the call, the AI says, in substance, that it is an AI assistant for PMBD AI Pty Ltd trading as Hello Harper, that we obtained the details from public business listings, that the call is recorded and transcribed and may be used to improve and train our AI and voice systems, the purpose of the call, that while our primary processing takes place in Australia some limited processing (such as telephony carriage and analytics, and separately our payment provider’s processing of billing/payment data only — not the call audio or other Caller Data; see section 12.1) may occur overseas including in the United States, how to ask us to stop calling, and where to find this Privacy Policy.

(c) We keep source records of where business contact details came from.

Telemarketing call-conduct rules. Our own outbound sales and demonstration calls also follow the conduct rules in the Telemarketing and Research Calls Industry Standard (in addition to the Do Not Call Register rules in section 13). In substance this means: calling only within the permitted hours and days (and not on prohibited public holidays); identifying who is calling (Hello Harper) and the purpose of the call; giving our contact details and a calling-line identifier (a return number) so the call can be identified or returned; and ending the call immediately if the person asks. The detailed figures (such as exact calling hours) are kept current in our internal operating procedures.

7.4 Through the sign-up SMS and payment flow — where, during a call, you expressly agree to receive it, we send an SMS with sign-up information and a secure payment link. See section 13.

7.5 From a Customer (as Processor) — Caller information through the Customer’s use of the Service, on the Customer’s behalf.

7.5A From a Customer’s connected Google Calendar (as Processor). Where a Customer connects its Google Calendar to use the appointment-booking feature, the Service accesses that calendar through Google’s authorised API, using access the Customer grants by signing in to its own Google account (OAuth). We use that access only to read availability and to create, change or cancel appointments on the Customer’s behalf. The Customer is responsible for having the right to connect the calendar and for the information it contains. Our use of Google Calendar data complies with the Google API Services User Data Policy, including its Limited Use requirements.

7.6 From our service providers — as described in section 11, in the course of delivering the Service.

8. Why we collect, hold, use and disclose personal information

8.1 We collect, hold, use and disclose personal information to:

(a) provide and operate the Service — answering and routing inbound calls, greeting callers, handling routine enquiries, taking messages, giving quotes from information the Customer has provided, and sending and receiving SMS;

(b) run our own sales and marketing — outbound AI calls, demonstrations, and sign-up follow-up by SMS where you agree;

(c) create and manage accounts and process payments;

(d) support, maintain, secure and troubleshoot the Service — quality monitoring, diagnostics, security monitoring, detecting and preventing fraud, misuse and abuse, protecting the reputation of our calling/SMS numbers, meeting our carrier and platform compliance obligations, and enforcing our Terms;

(e) analyse, improve, develop and train — we use information collected through the Service to operate, maintain, secure and improve it, and to develop, train, fine-tune and evaluate our AI and voice models and other products and services, including by creating de-identified, aggregated or statistical data sets that we may use, share, license or otherwise commercialise (see 8.2). We rely primarily on de-identified or aggregated information for model development; where we use identifiable information for this purpose we do so consistently with the notices given and the consents and other bases the Privacy Act requires;

(f) comply with our legal obligations (including telemarketing and anti-spam laws and record-keeping), respond to lawful requests, and resolve disputes; and

(g) consider, plan for or carry out a business sale, merger, reorganisation or similar transaction, subject to appropriate protections (see section 11.3).

8.2 Using information to improve, develop and train our AI and voice models. We use information collected through the Service — including call recordings, transcripts and derived data — to operate, secure and improve the Service and to develop, train, fine-tune and evaluate our AI and voice models and other products and services.

  • De-identified information (our main basis). We may de-identify call recordings, transcripts and derived data. Once information is genuinely de-identified so that it is no longer about a reasonably identifiable individual, it is no longer personal information, and we may use and retain it indefinitely, including to train, fine-tune and develop our AI and voice models, without further consent. De-identification depends on the setting in which data is used, so we take reasonable steps to keep the risk of re-identification very low for that setting, we review that over time, and if we cannot keep the risk low enough we treat the information as personal information under this policy rather than as de-identified.
  • Identifiable information — recorded, held, and used on notice. We record and keep call audio (including raw audio) and transcripts, and we are open about it. At the start of the call we tell callers the call is recorded and that the recording may be used to handle the call and to improve, train and analyse our AI and voice systems. If a caller does not want their recording used for training, they can tell us (or the business they called), and we will take reasonable steps to act on it — for example by excluding their recording from future training, or de-identifying or deleting it. We rely mainly on de-identified data for model development; where we use information that still identifies a person, we rely on that notice and the absence of any objection, together with the business customer’s own notice to its callers (see the Terms). Raw call audio is the most sensitive case (voice can identify a person): we use it to improve and train our voice systems on that basis, and we do not use it to create a voiceprint or to identify a person across calls (see section 5.4).
  • We do not sell your information or give it to others for their own purposes. We do not sell personal information, and we do not give it to data brokers, advertisers or unrelated third parties for their own marketing or purposes. We use the information we collect for our own business purposes — operating and improving the Service, business analytics, and developing and training our AI and voice models. We may also create de-identified, aggregated or statistical data sets from information collected through the Service and use, share, license or otherwise commercialise those data sets — they no longer identify any individual. We do share it with the service providers and telephony/SMS carrier who help us run the Service (limited to that purpose; the carrier also acts under its own legal duties), with the Customer we collect it for, where the law requires or allows, and with an acquirer in a business sale or reorganisation under appropriate protections (see sections 11 and 12). Service providers cannot use your information to train their own models or for their own purposes, and we do not build advertising profiles.

8.3 We use or disclose personal information for a purpose other than the one it was collected for only where the APPs permit — for example, where you would reasonably expect it, you have consented, or it is required or authorised by law.

9. Automated decision-making

9.1 The Service and our outbound AI agent use AI and other automated systems to conduct conversations, classify and respond to enquiries, generate SMS, and take configured actions such as initiating a sign-up.

9.2 The information used can include the contact details, call audio, transcripts, messaging content and derived data in section 4. The outputs can include: classifying an enquiry; deciding how to respond, route or transfer a call; quoting a price using information the Customer has provided; taking a message; generating and sending an SMS (including a sign-up or payment link); and other actions a Customer has configured.

9.3 Could these decisions significantly affect you? For ordinary receptionist tasks — classifying an enquiry, deciding how to respond, routing or transferring a call, taking a message, or giving a quote from the Customer’s own pricing — the automated handling is not, in itself, intended to produce a decision that significantly affects your rights or interests; a human at the Customer’s business decides what to do with the message, quote or request.

(a) Some steps could matter more — for example, accepting a sign-up or initiating a payment link on our own outbound calls, or a call that touches on health, legal, financial-hardship, emergency or vulnerable-caller circumstances — and we treat those with more care.

(b) In particular, where one of our own outbound calls results in a sign-up or payment, the Service is supplied for business use only and is a “business contract” under the Competition and Consumer Regulations 2010 (Cth), so an Order for it is not an unsolicited consumer agreement and the unsolicited-consumer-agreement cooling-off and no-supply / no-payment rules do not apply (see the Terms clause 1.6(d) and the Order, Section 9).

(c) If, exceptionally, someone is genuinely acquiring the Service for personal, domestic or household use, we apply the unsolicited-consumer-agreement protections (including cooling-off rights and not charging or supplying before the law allows) that then apply.

9.4 Decisions the Service does not make. The Service does not make credit, employment, insurance, housing, health, legal, eligibility or safety-critical decisions about you, unless this is expressly agreed in additional terms with a Customer. It is not an emergency service (see section 18 and the Terms).

9.5 Human review. You can ask us about the automated handling of your personal information, and contact us (section 19) if you have a concern about, or wish to dispute, a decision made with the involvement of an automated system. A person at Hello Harper will review the matter (or, where a Customer made or controls the decision, we will direct your request to that Customer — see section 10).

10. Callers of a Hello Harper Customer (Hello Harper as the Customer’s service provider / Processor)

10.1 When the Service answers calls for a Customer, the Customer is the business you are dealing with, and is responsible for its relationship with, and the notices and consents owed to, its Callers. Hello Harper handles that information on the Customer’s behalf and on its instructions, and stores it in our systems to provide the Service. The Service’s in-call AI-identification and recording disclosures (section 6) are delivered to every Caller as part of the Service, regardless of the notices the Customer separately provides, so that a Caller always receives these disclosures from the collecting system. Where possible, the AI identifies the business it is answering for (for example, “I’m the AI assistant for [the business you called]”).

10.2 The Customer is responsible for ensuring its use of the Service is lawful in relation to its Callers, including giving any required notices and obtaining any consents needed for recording and processing calls under the Privacy Act and applicable State and Territory surveillance and listening-device laws. Hello Harper provides the in-call AI-identification and recording notices as part of the Service (see section 6). These Customer responsibilities are set out in, and backed by, the Customer’s agreement with us (the Terms).

10.3 If you are a Caller and you wish to access or correct your information, or you have a privacy concern from contacting a business that uses Hello Harper, please contact that business first, because the Customer is the primary contact. Where Hello Harper has its own access or correction obligation under the APPs (APP 12 and APP 13) for the call data we hold, we will meet that obligation, while coordinating with the Customer as the primary contact and directing your request to it where that is the right path (see section 16). If you cannot identify or reach the relevant business, you can still contact us (section 19) and we will help you, including by helping you identify the business or by responding directly where the law, security or safety, or our own Privacy Act obligations require or allow us to.

10.4 Hello Harper’s own handling of Caller information — including security and retention — is described in sections 14 and 15 and in the Terms.

10.5 The limits of our role. Where Hello Harper acts as Processor, the security, accuracy and retention commitments in this policy cover our own handling of Caller information. They do not extend to a Customer’s own systems, a Customer’s configuration choices, or how a Customer uses information the Service makes available to it — those remain the Customer’s responsibility under the Terms.

11. Who we disclose personal information to

11.1 We disclose personal information to service providers (sub-processors) who help us deliver the Service. We describe them by category here; the specific providers can change over time. The countries involved in our current arrangements are Australia and the United States — Australia for our primary, Hello Harper-controlled processing and storage, including the self-hosted speech-to-text and text-to-speech engines on our own AWS infrastructure, and the language model on AWS Bedrock, in the Sydney region, and the United States for our telephony/SMS carrier, our product-analytics provider and — where a Customer connects its Google Calendar — Google’s calendar service (and for our payment provider, which handles Customer billing data only — see section 12). We can provide details of the current providers, the countries they operate in, and the data they handle on request. The notice and objection mechanism for changing sub-processors lives in the Terms (Section 20.6).

11.2 The categories of service provider are:

  • Cloud hosting and infrastructure — hosted in the Amazon Web Services (AWS) Asia Pacific (Sydney) region.
  • Telephony and SMS carriage — a communications provider that carries calls and messages. The carrier is US-based, so call audio in transit, SMS content and call/message metadata may be processed overseas, including in the United States (see section 12).
  • AI language processing — a large language model accessed through AWS Bedrock in the Sydney region (a managed AWS service) to understand enquiries and generate responses, so the primary processing of call data by the language model takes place in Australia.
  • Speech-to-text and text-to-speech — engines used to transcribe and generate speech. Hello Harper self-hosts these engines on its own AWS infrastructure in the Sydney region, so the primary processing of call audio and speech takes place in Australia. This is the confirmed primary position; we do not warrant onshore-only, and some limited processing or transmission may still occur overseas (in particular through the telephony/SMS carrier and incidental routing).
  • Calendar and scheduling — Google LLC (Google Calendar API), used only where a Customer connects its Google Calendar to enable appointment booking; the Service reads availability and creates, changes or cancels appointments on the Customer’s behalf. Google is US-based, so calendar data may be processed overseas, including in the United States (see section 12). Our use of Google Calendar data complies with the Google API Services User Data Policy, including its Limited Use requirements.
  • Payments — our payment provider, which processes a Customer’s subscription payments and billing under its own terms (Customer billing data only, not Caller Data — see section 12).
  • Product analytics — a product-analytics provider used to understand how the Service is used; some analytics data may be processed overseas, including in the United States (see section 12). We do not use it as a store for call recordings or transcripts, and we configure analytics events to avoid including call content, SMS content, transcripts or sensitive information (this is aligned with the Terms); we review those settings as part of our privacy controls.
  • Business and operational tools — other providers supporting communications and customer support, which may touch limited personal information only where needed for the function.

11.3 We may also disclose personal information: in connection with an actual or proposed business sale, merger, financing, due diligence or reorganisation, to prospective purchasers, investors and their advisers under confidentiality obligations, and personal information may be transferred to the acquirer as part of the business assets if the transaction proceeds; to a Customer, where Hello Harper acts as that Customer’s Processor; to our professional advisers under confidentiality; where required or authorised by law, or to a court, regulator or law-enforcement body on a lawful request; to prevent or investigate fraud, misuse or a threat to safety or security; and to a successor entity in a business sale or reorganisation, subject to appropriate protections.

11.4 Where service providers handle personal information on our behalf, we take reasonable steps — including contractual protections where appropriate — to require them to handle it consistently with the Privacy Act, to use it only for the purposes for which we engage them, and not to use a Customer’s Caller information to train their own models or for their own purposes (this matches the Terms). Some providers, such as our payment provider and telephony carrier, also handle some information under their own terms and legal obligations.

11.5 We do not sell personal information, and more generally we do not give it to others for their own purposes — see section 8.2. This does not limit our use, sharing, licensing or other commercialisation of de-identified or aggregated data sets that no longer identify any individual, or a transfer of personal information as part of a business sale, merger, financing or reorganisation (see sections 8.1(g) and 11.3).

12. Overseas disclosure and cross-border processing

12.1 Hello Harper self-hosts the speech-to-text engine and the text-to-speech engine on its own AWS infrastructure in the Sydney region, and runs the language model on AWS Bedrock in the Sydney region (a managed AWS service), so the primary processing of call data takes place in Australia. This is the confirmed primary position. It is not a blanket onshore claim: some processing or transmission of call data occurs overseas, including in the United States — in particular:

  • call audio in transit, SMS content and call/message metadata through our telephony and SMS carrier (US-based), together with incidental routing; and
  • limited usage and event data through our product-analytics provider; and
  • calendar availability and booking details — where a Customer connects its Google Calendar — through Google’s calendar service (Google LLC, US-based).

Separately, our payment provider processes a Customer’s payment and billing information — not call data — under its own terms, which involve overseas processing. We do not warrant that all processing occurs only in Australia, and we do not make a blanket “onshore” or “data sovereignty” claim. For any overseas disclosure we take the reasonable steps required by APP 8.1 and remain accountable under section 16C of the Privacy Act (see 12.2 and 12.3).

12.2 Our default approach (APP 8.1 reasonable steps). Before disclosing personal information to an overseas recipient, our default is to take steps that are reasonable in the circumstances to ensure the recipient handles it consistently with the APPs — in particular, putting in place contractual obligations requiring protections substantially consistent with the Privacy Act. This is the basis we rely on for our service providers.

12.3 Under section 16C of the Privacy Act, we generally remain accountable for the handling of personal information by overseas recipients to whom we disclose it, subject to the limited exceptions in the Act (see 12.5).

12.4 The countries involved in our current arrangements are Australia (our primary, Hello Harper-controlled processing and storage, including the self-hosted speech-to-text and text-to-speech engines on our own AWS infrastructure, and the language model on AWS Bedrock, in the Sydney region) and the United States (our telephony/SMS carrier and our product-analytics provider; Google’s calendar service where a Customer connects its Google Calendar; and our payment provider for Customer billing data only). We can provide details of the current countries and recipients on request, and we keep that information current as providers change.

12.5 Our primary basis is APP 8.1 reasonable steps — including for our own outbound calls. For all overseas disclosures, including those on our own outbound calls (where we act for ourselves as Controller), our default and primary basis is the APP 8.1 reasonable-steps approach in 12.2: taking steps reasonable in the circumstances — principally contractual obligations requiring protections substantially equivalent to the APPs — and remaining accountable under section 16C. This is the routine basis we rely on for outbound calls; we do not treat the APP 8.2(b) consent route as the routine basis for those calls.

Secondary option — consent (APP 8.2(b)). The consent exception in APP 8.2(b) is a secondary basis we would use only where it is genuinely necessary (for example, an overseas flow that the reasonable-steps basis cannot adequately cover) and only if a lawyer first confirms that valid, informed consent is workable in the call context. We would not rely on it unless that confirmation is given. If APP 8.2(b) is used, we make the consequence explicit at the point of collection (in the call), not only in this policy: the notice would tell you, in substance, that some processing may occur overseas including in the United States and that, if you consent, the APP 8.1 protection (and the related section 16C accountability) will not apply to that disclosure. If that consent is not obtained and no other APP 8.2 exception applies, we rely on the reasonable steps in 12.2. The “consequence of consent” carve-out is never applied to sensitive information (see section 5.2).

13. Telemarketing, anti-spam, and SMS sender identification

13.1 Do Not Call Register (our outbound calls — as Controller). For our outbound calls, we use Do Not Call Register washing and suppression processes before calling, in accordance with the Do Not Call Register Act 2006 (Cth), and re-wash as required, so that we do not knowingly make telemarketing calls to registered numbers unless an exemption applies.

13.1A Telemarketing call-conduct rules. Beyond the Do Not Call Register, our own outbound sales and demonstration calls follow the conduct rules in the Telemarketing and Research Calls Industry Standard: we call only within the permitted hours and days (and not on prohibited public holidays); we identify who is calling (Hello Harper) and the purpose of the call; we provide a calling-line identifier (a return number) and contact details; and we end the call immediately if you ask. We keep a record of consent where we rely on your consent (for example, the express agreement you give during a call to receive our sign-up SMS — see 13.2), for as long as reasonably necessary.

13.2 Commercial electronic messages — SMS (Spam Act). Where we send commercial SMS (including sign-up and payment-link messages), we do so consistently with the Spam Act 2003 (Cth): only with the necessary consent, identifying ourselves as the sender, and with a functional, low-cost way to unsubscribe. For our sign-up SMS, we rely on the express agreement you give during the call — not on consent inferred from the call alone — and we keep a record of that consent.

13.3 Unsubscribing. You can opt out of our commercial SMS at any time using the unsubscribe method in the message, or by contacting us (section 19). We act on unsubscribe requests within the period required by law.

13.4SMS Sender ID registration. We are registering our SMS sender identifiers in accordance with the Telecommunications (SMS Sender ID Register) Industry Standard 2025. Until a branded sender ID is registered, messages sent under it may be marked “Unverified” by mobile networks.

13.5 Not being called. If you do not wish to receive sales calls from us, tell our AI agent during a call, or contact us (section 19), and we will record your request not to be contacted. You can also register your number on the Do Not Call Register. You can ask us where we obtained your contact details and we will tell you unless it is unreasonable or impracticable, and we do not use sensitive information for direct marketing without your consent.

14. How we keep personal information secure

14.1 We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure — which may include technical and organisational measures within the AWS Sydney region.

14.2 No method of transmission or storage is completely secure, and while we work to protect personal information, we cannot guarantee absolute security.

14.3 For Customers, the security measures that apply to Caller information are also described, at a general level, in the security terms in the Terms (Section 20.5).

15. How long we keep personal information

15.1 We keep personal information only for as long as is reasonably necessary for the purposes in this policy — including operating and securing the Service and developing, improving and training our AI and voice models — and to meet our legal and record-keeping obligations and resolve disputes. When we no longer need information in identifiable form, we take reasonable steps to de-identify it (after which we may keep and use it indefinitely — see 15.4) or securely destroy it.

15.2 Call recordings and transcripts. We keep call audio (including raw audio) and transcripts for the purposes in this policy — operating the Service, quality, support, security, dispute resolution, and improving, training and analysing our AI and voice systems — and we are open about holding this data rather than hiding it.

(a) Where we no longer need audio in identifiable form, we take reasonable steps to de-identify it where practicable, or otherwise securely destroy it, subject to backups, legal holds and disputes.

(b) We may keep transcripts and derived data longer — including to develop, improve and train our AI and voice models — and where we keep them for the long term we take reasonable steps to de-identify them so that what we retain is no longer about an identifiable individual; where information remains personal information, we continue to handle it under this policy.

(c) We keep identifiable call records longer where we need to (for example, to resolve a dispute) or where the law requires it (for example, financial and tax records).

15.3 Where Hello Harper holds Caller information as a Customer’s service provider (Processor), retention is also governed by the Terms, including any retention the Customer sets and any deletion-on-exit arrangements (Terms Section 20.10), which prevail over our internal default periods.

15.4 Information that we have genuinely de-identified is no longer personal information, and we may keep and use it indefinitely, including in aggregated form, for analysis, reporting and improving our products. We treat information as de-identified only while the risk of re-identification in the setting where it is used stays very low; we review that over time, and if we cannot keep the risk that low we treat it as personal information under this policy rather than treat it as de-identified.

16. Accessing and correcting your personal information

16.1 You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

16.2 To make a request, contact us (section 19). We may need to verify your identity, and (because we organise call data around calls) we may need enough information to locate the relevant call — for example, the date and time, the phone number used, and the business you contacted. Where a recording or transcript involves more than one person, we take reasonable steps to protect the privacy of the other people on the call (for example, by redacting their information) when responding to your request. We will respond within a reasonable period (ordinarily within 30 days) and in accordance with the Privacy Act. The Privacy Act allows us to charge for giving access; any charge will not be excessive, we do not charge for making a request, and we will tell you about any charge in advance.

16.3 In limited circumstances we may decline a request — for example, where the law permits or requires, or where giving access would unreasonably affect another person’s privacy. If we refuse, we will tell you why in writing and how to complain. If we refuse to correct your personal information, you may ask us to associate with it a statement that you consider it inaccurate, out of date, incomplete, irrelevant or misleading, and we will take reasonable steps to do so.

16.4 Keeping information accurate. We take steps that are reasonable in the circumstances to ensure the personal information we collect, use and disclose is accurate, up to date, complete and (for use or disclosure) relevant. Automated transcription can mishear or misrecord what was said, so you can ask us to correct your information at any time under 16.1; where we have shared incorrect information, we will, if you ask us to, take reasonable steps to notify any Customer or service provider we shared it with, unless it is impracticable or unlawful to do so.

16.5 Callers of a Customer (as Processor). If your information was handled because you contacted a business that uses the Service, that Customer is generally the primary contact for your access or correction request, so please contact the business first. Where Hello Harper has its own access or correction obligation under the APPs (APP 12 and APP 13) for the call data we hold in our own systems, we will meet that obligation, while coordinating with the Customer as the primary contact (see section 10).

17. Notifiable data breaches

17.1 We have internal processes to identify, contain, assess and respond to suspected data breaches. Where Hello Harper has a notification obligation in its own right and a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

17.2 Where a breach involves Caller information we handle for a Customer (a Caller Data Breach), the Customer is primarily responsible for assessing and, where required, notifying its Callers and the OAIC. We will notify the affected Customer without undue delay (and in any event within the time set in Section 20.9 of the Terms) and assist it to meet its obligations, as set out in Section 20.9 of the Terms. We will not notify the Customer’s Callers without the Customer’s prior consent, unless the law requires us to, or we need to in order to meet our own obligations under the Privacy Act.

17.3 Direct notification backstop. Where we are required (or reasonably consider we may be required) to notify in our own right and coordinated notification with the Customer has not happened within a reasonable time, we may notify affected individuals and the OAIC to the extent reasonably necessary to meet our own obligations, after consulting the Customer where practicable. We will limit any such notification to what the law requires. This aligns with Section 20.9 of the Terms.

18. Children and vulnerable callers

18.1 Our sales activity and Customer relationships are directed at businesses, not children. The Service is offered to businesses; an account must be held by a business and set up by someone authorised to bind that business (see the Terms). The Service is also not intended for child-directed services (services aimed at children) without our written approval and any additional terms we require (see the Terms).

18.2 Callers who may be children or vulnerable. When the Service answers a Customer’s inbound calls, a Caller may sometimes be a child or another person in a vulnerable situation. Where that happens, we limit the information collected to what is needed to handle the call, we take reasonable steps not to use that information to train our AI models, and the Terms covers appropriate handling.

18.3 Escalation for distress, harm or emergency. The Service is a receptionist, not an emergency or crisis service (see section 9 and the Terms). Where a call shows indicators of distress, abuse, self-harm, threats to safety, or an emergency, the appropriate response is to escalate to a human or direct the person to the right help rather than have the AI handle it alone. Customers are responsible for configuring an appropriate escalation pathway for their business, and a Customer operating in a sensitive sector (for example, health, counselling, aged care, crisis, financial hardship, legal services or child services) must configure suitable escalation and obtain our written approval where we require it (see section 5.2 and the Terms (Section 7) restricted-use rules). Hello Harper does not warrant that the Service will detect distress, vulnerability or an emergency in any given call.

18.4 If you believe we hold a child’s personal information that should be removed, contact us (section 19) and we will take reasonable steps to delete it.

19. Contact us, complaints, and the OAIC

19.1 Contact and privacy enquiries. If you have a question about this policy or how we handle personal information, or you wish to make a request or opt out, contact:

19.2 Complaints. If you believe we have breached the APPs or mishandled your personal information, contact us using the details above. Describe your concern and how you would like it resolved. We will acknowledge your complaint promptly, investigate, and aim to give you a substantive response within a reasonable time. If we need longer for a complex matter, we will tell you why and keep you updated.

19.3 Escalating to the OAIC. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Post: GPO Box 5288, Sydney NSW 2001

20. Changes to this Privacy Policy

20.1 We may update this Privacy Policy from time to time to reflect changes to our practices, the Service or the law. The current version is identified by the version number and dates at the top.

20.2 If we make a significant change, we will take reasonable steps to notify you — for example, by posting the updated policy on our website and, where appropriate, notifying Customers directly. The updated policy applies from its effective date.

20.3 The version identified at the top of this policy, as published on our website, is the current Privacy Policy and supersedes all earlier versions. We can provide a previous version on request where practical. This policy is provided for information and is not part of any contract; it does not change a Customer’s contractual rights, which are governed by the Terms (including its own change provisions).

20.4 This Privacy Policy is available free of charge on our website, and we will provide a copy in an alternative form on request where reasonable.