Privacy Policy

Last updated 1 November 2026

Draft pending legal review. This describes how we handle personal information today. It has not yet been reviewed by a lawyer and will be replaced by a reviewed version before general release. Questions in the meantime: privacy@velobiz.ai.

Who we are

Velobiz Pty Ltd (trading as Velobiz AI) provides AI assistants for small and medium businesses. This policy covers the Velobiz website, the setup wizard, the client dashboard and the AI services we run for businesses. We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 and handle personal information in line with them.

We handle information in two roles. For our own customers (the businesses that sign up) we decide how the information is used. For the people who call or message a business that uses Velobiz, the business decides and we process the information for it.

What we collect

• Setup information. Your name, your business name, your website address, and the business contact details we read from that website or you enter yourself.
• Account information. Email address, password (stored hashed by our authentication provider), and your business phone number.
• Your customers' information. When your AI employee handles a call, message or booking, we process the contact details and conversation content needed to do that on your behalf. You are the owner of that data; we process it for you.
• Technical information. IP address, browser user-agent and page addresses. On the public setup wizard we store only a one-way hash of your IP and user-agent, salted and rotated daily, to rate-limit abuse — not to identify you.
• Bot protection. Public forms and the setup wizard use Google reCAPTCHA v3, which collects device and interaction signals under Google's own privacy policy (see Cookies below).

Reading your website

When you enter a website address in the setup wizard we fetch a small number of publicly reachable pages from it — typically your home, about, services and contact pages — and use their content to pre-fill your configuration and, once you have an account, to build your assistant's knowledge base. We identify ourselves in those requests and we do not attempt to reach anything behind a login. If the pages contain personal information (for example a staff member's direct line), that information is treated as part of your business data under this policy.

How we use it

• To create and configure your account and AI employee.
• To operate the service — answering calls and messages, capturing leads, booking appointments.
• To send service communications such as alerts and account notices.
• To protect the platform from abuse and to meet our legal obligations.
• To improve the product in aggregate. We do not sell personal information.

AI processing

Conversation content and the website content described above are sent to third-party AI providers to generate responses and to structure your setup. Velobiz does not use your data, or your customers' data, to train AI models. Anthropic and Google's paid API services don't use the data we send them to train their models under their commercial terms. We are confirming the equivalent settings for every other provider and will list them in our AI Use Policy. Automated outputs can be wrong; you can review conversations in your dashboard.

Calls, recordings and transcripts

• Telling callers. Our default greeting tells callers at the start of the call that they're speaking with an AI assistant and that calls are recorded.
• Recordings. Our voice provider records calls so we can produce the written call summary. We remove access to call recordings after 30 days; the stored audio is then deleted under our voice provider's retention settings. You do not receive the audio.
• Transcripts and summaries. These stay with the lead record and are kept and deleted under the retention periods in "How long we keep it" below.

WhatsApp messages

If a business uses WhatsApp with Velobiz, messages between the business and its customers are sent and received through Meta's WhatsApp Business Platform, which handles them under its own terms. We keep the message content and the sender's number with the lead record so your AI employee can carry on the conversation and you can see it in your dashboard.

Website Builder

If a business orders a website we handle what it uploads (such as a logo, photos and documents), the pages we read from its existing website, and the content we generate for the new site. This is kept for the project and is business data under this policy. Content is sent to AI providers to generate it, as described under AI processing. Nothing is published to a live site without the business's approval, other than the profile and feature updates the business has switched on.

Visitor statistics on client websites

Websites built by Velobiz count visits without cookies. Each visit is counted using a one-way hash of the visitor's connection details, salted and rotated every day, so a visitor cannot be followed from one day to the next. We do not store the IP address, the user agent or any cookie for this.

Who we share it with

We share personal information only with the service providers we need to run the platform — cloud hosting and database, telephony and SMS, voice and speech, email delivery, calendar connectivity, payments, accounting for businesses that connect it, AI model providers and bot protection — and with anyone you explicitly connect, such as your calendar. We may disclose information where the law requires it.

Who receives your information outside Australia

Which provider sees what depends on the feature. Call audio goes to our voice and speech providers, conversation text goes to our AI model providers, and phone numbers and message text go to our SMS and WhatsApp providers. These are the providers outside Australia that receive personal information, and the countries involved. We take reasonable steps to ensure each handles your information consistently with the APPs.

Our database (Supabase) and our API (Vercel) are hosted in Sydney, Australia. Our workflow automation runs on a dedicated server operated by Hostinger.

How long we keep it

• Abandoned setups. If you start the setup wizard and don't create an account, the draft expires after 7 days and is swept automatically. Where you completed a signup, we keep the record of your acceptance of the terms as proof of consent.
• Anonymous demo sessions. Rate-limit records for the public voice and chat demos expire within minutes to 30 days depending on the surface.
• Call recordings. We remove access to call recordings after 30 days; the stored audio is then deleted under our voice provider's retention settings.
• Lead records, transcripts and summaries. Lead records are archived after 24 months. For Australian businesses they are deleted after 7 years, to meet record-keeping obligations, unless the business sets a longer period; elsewhere after 36 months by default.
• Account data. Kept while your account is active, and deleted after closure subject to the retention periods configured for your account and any records we must keep by law.

Automated decisions

From 10 December 2026 the Privacy Act (APP 1.7 to 1.9) asks us to tell you where computer programs make or help make decisions that could significantly affect you. We use computer programs, including AI, to qualify and score leads, to check whether an address is in a business's service area, to decide when follow-ups are sent, and to draft or send replies on a business's behalf. These can affect whether and how a business follows up with you. You can ask the business, or us, for a human to review a decision: email privacy@velobiz.ai.

Who at Velobiz can see your account

Velobiz staff access to a business's account is limited. Support staff sign in to an account only while the business has granted support access from Profile → Support access (for 24 hours, 7 days or 30 days, view-only or view-and-change), or in an emergency, when the reason is recorded and the business is notified. A small number of authorised staff can view and adjust a business's service set-up through our internal tools, only to deliver services the business has ordered, at its request, or where the law requires it. All access is logged and shown in the account's access history. Section 11 of the Terms of Service sets out when we change your data.

Your rights

You can ask us to access, correct or delete your personal information, or to export it. To correct information (APP 13), ask us or the business that holds it. We'll correct what we hold, or tell you why we can't. Your customers can opt out of marketing contact at any time, and every marketing message we send on your behalf carries an opt-out. To make a request, or to complain about how we've handled your information, email privacy@velobiz.ai. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Security

We use encryption in transit, tenant isolation enforced server-side, hashed credentials and least-privilege access to production systems. No system is perfectly secure; if a breach is likely to cause serious harm we will notify you and the Commissioner as the Notifiable Data Breaches scheme requires.

Cookies

We use cookies that are necessary for the service: an authentication session cookie, and — during public setup — a short-lived cookie holding an opaque token that lets you resume an unfinished setup. Both are httpOnly and cannot be read by scripts.

Our public forms and the setup wizard also use Google reCAPTCHA, which collects device and interaction data and may set cookies to detect abuse. Google's privacy policy applies to that data. We don't use advertising or analytics cookies on our site. If you connect WhatsApp from your dashboard, Meta's sign-in window may set its own cookies under Meta's terms.

Changes

We'll post updates here and, for material changes, notify you by email or in the dashboard.