This policy explains how Intelox Pty Ltd (ACN 700 471 665) collects, uses, stores and shares personal information. It applies to our clients, the people our call agent speaks with or messages, and visitors to intelox.com.au. We aim to handle personal information in line with the Australian Privacy Principles.
1. What we collect
| From | What we collect |
|---|---|
| People our agent calls, answers or messages | Name, phone number, email, call audio, call transcripts, messages, and details needed for the task (for example booking dates or orders) |
| People whose details pass through a client's automations | Whatever the client's workflows handle, such as names, contact details and records from the client's connected apps |
| Clients | Business and contact details, account login, billing details (card details are held by Stripe, not Intelox), and instructions for the agent and automations |
| Website visitors | Enquiry form details, and analytics data only if you accept cookies |
2. Call recordings
- 2.1What is recorded: the audio of calls made or received by our agent, and a written transcript of each call.
- 2.2When we tell you: the agent states at the start of every call that the call is recorded and where to find this policy. Recording begins at or after that notice.
- 2.3Why we record: to complete the task the call is for, to check quality and accuracy, to resolve disputes about what was said, and to meet legal obligations.
- 2.4Where it is stored: call audio is carried and stored by Twilio in its Australian (AU1) region, and processed by ElevenLabs (United States) and Google Gemini (Sydney, Australia) to understand the caller and produce the agent's voice. Transcripts and records are stored on our servers and database in Sydney, Australia.
- 2.5How long we keep it: recordings and transcripts are automatically deleted after 31 days, unless we need them longer for a legal claim, a client's written instruction, or to respond to a privacy request you have made.
- 2.6How to request deletion: email privacy@intelox.com.au with your phone number and the approximate date of the call. We will respond within 30 days. We may need to keep a record if the law requires it.
- 2.7Records kept while we respond: when we receive a request to access, correct or delete your information, we place a hold on the records it relates to. Those records are not automatically deleted until we have responded, even if they are older than 31 days. If the records were already deleted under our 31-day rule before your request reached us, we will tell you that and the date they were deleted.
3. How we use information
- To make and receive calls and send messages for our clients
- To complete tasks such as bookings and confirmations
- To provide, support, secure and improve our Services
- To bill clients and meet tax and legal obligations
- To respond to enquiries through our website
We do not sell personal information, and we do not use it for our own marketing without consent.
4. Automated decisions
Our call agent is an automated system. It can take actions without a person reviewing them first, including:
- Answering calls and questions, including over WhatsApp
- Making, changing or cancelling bookings, reservations and meetings
- Taking orders
- Deciding which information to pass on to our client
- Sending and receiving data through the n8n integration, for clients who turn it on (not yet available)
- Other tasks our client sets up that can be completed during a call or message
The agent follows rules set by our client. If you think an automated action affected you unfairly, contact privacy@intelox.com.au and a person will review it.
5. Connecting your Google account
Our clients can connect their own Google Calendar or Google Sheets so that the agent can use them while a call is happening. Connecting is optional, and this section describes everything we do with that access. You connect either by signing in with Google and allowing the access on Google's own screen, or by sharing the calendar or sheet with a service account from your own Google Cloud project.
What we read and write:
- Google Calendar: we read the start and end times of events on the calendar you nominate, so the agent knows which times are already taken, and we create a new event when a caller books one. We also read that calendar's time zone setting, so a booking lands at the hour agreed on the call. We do not change or delete events that are already there, and we do not change any calendar settings. Google returns the whole event, and the calendar's name and description with its time zone; we use only the start and end times and the time zone.
- Google Sheets: we read the rows of the spreadsheet you nominate, so the agent can answer questions about prices, availability, courses or whatever you keep there. Read-only - we never write to your sheet.
We only do either of these during a call, to answer the caller in front of us or to make the booking they asked for, or when you press Test on the integration in your console: Test reads the sheet's column names, or reads the calendar and makes a test booking that it deletes again straight away. Nothing runs in the background.
What we keep: the connection itself - an encrypted token, or the service-account key you pasted - for as long as the integration stays connected. We do not keep a copy of your calendar or your spreadsheet. One thing to be aware of: when the agent says a time or a price out loud, those words become part of the call recording and transcript, which are handled as described in section 2 and deleted on the same schedule.
What we never do: we do not sell data from your Google account, use it for advertising, use it to train AI models, or share it with anyone beyond the service providers listed in this policy who are needed to run the call.
Disconnecting: open Integrations in your console and press Disconnect, or remove our access at myaccount.google.com/permissions. Either one stops the access immediately.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Where information is processed
Our service providers process personal information in these locations. Some are outside Australia:
| Provider | What they process | Location |
|---|---|---|
| Google (Gemini) | The agent's thinking, Gemini Live voice mode, after-call summaries and analysis, script writing help, and image reading | Australia (Google Cloud Vertex AI, Sydney region) |
| ElevenLabs | Speech to text (hearing the caller) and text to speech (the agent's voice) | United States. Requests may also be processed in the Netherlands or Singapore |
| OpenAI | Optional alternative AI models and voices, only if a client selects them | United States |
| Supabase | Database for call records, client accounts and website enquiries | Sydney, Australia |
| Twilio | Calls, SMS, call recordings | Australia (Twilio AU1 region). Twilio does not yet guarantee that all data stays in the selected region |
| Meta (WhatsApp) | WhatsApp messages | Stored in Australia. Messages may be processed in other countries for up to 60 minutes |
| n8n (not yet available) | Call recordings, transcripts, messages, contact details, bookings and orders, only for clients who turn on the n8n integration once it is available | Germany (n8n Cloud, Frankfurt) |
| Resend | Emails sent from our website, such as enquiry replies and responses to privacy requests | United States |
| Our business email provider | Emails sent to and from our staff mailboxes (hello@, support@, billing@ and privacy@) | May be processed outside Australia, including in the United States |
| Google Analytics | Website usage data, only if you accept analytics cookies | United States, and other countries where Google operates |
| Stripe | Client billing details | United States, and other countries where Stripe and its providers operate |
| Vercel | Website and client console | Server functions in Sydney, Australia. Website files are served from a worldwide network |
We take reasonable steps to make sure these providers protect personal information in a way consistent with the Australian Privacy Principles, including through their contract terms.
7. Who we share information with
- The client the call or message was made for
- The service providers listed above
- Authorities, if the law requires it
8. Security
We protect personal information with encryption, access controls and secure hosting. Customer keys are encrypted. No system is completely secure, so we also keep a data breach response plan.
9. Access, correction and deletion
You can ask to access, correct or delete your personal information by emailing privacy@intelox.com.au. We will respond within 30 days. When we receive your request, we keep the records it relates to until we have responded, even if they would otherwise be deleted. If the call was made for one of our clients, we may pass your request to that client as well.
10. Data breaches
If a data breach is likely to cause serious harm, we will notify the affected people and, where required, the Office of the Australian Information Commissioner (OAIC). Our breach contact is Adithya Subramani Srinivasan.
11. Complaints
Contact privacy@intelox.com.au. We aim to respond within 30 days. If you are not satisfied, you can contact the OAIC at oaic.gov.au.
12. Changes
We will post any changes on this page with the date they take effect.
Last updated: 28 October 2026