Privacy policy

RoundHour is a registered business name of Kanini Solutions Pty Ltd (ABN 49 638 785 976) ("we", "us"). We provide an AI receptionist service for Australian businesses: our software answers phone calls for the businesses that subscribe to us ("business customers"), speaks with the people who call them ("callers"), takes messages, answers questions and, where enabled, books appointments.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We follow the Privacy Act whether or not a small-business exemption might apply to us.

1. Who this policy covers

• Callers — people who phone a business that uses RoundHour. Most have no direct relationship with us; we handle their information on behalf of the business they called.
• Business customers — owners and staff of subscribing businesses (account, dashboard and setup data).
• Website visitors — people browsing roundhour.com.au.

If you are a caller, the business you called holds the relationship with you; we process your information so that their phone gets answered. You can send requests about your information to us or to the business — we support both.

2. What we collect

From callers

• Your phone number (caller ID), and a callback number if you give one
• The audio of your call, and a text transcript of it
• What you tell the AI: your name, why you're calling, booking details, messages you leave, and an email address if you ask for something by email
• Call details: time, duration, and the business line you dialled

From business customers

• Name, business name, email, mobile number, business address and trading details
• Business knowledge you teach the AI: services, prices, policies, and documents you upload
• If you connect Google Calendar: the booking events we create and read on the calendar you authorise (see section 7)
• Login and security data: email one-time codes, and an optional authenticator app for two-factor login

From website visitors

• Basic technical logs. The dashboard uses one session cookie for login. There are no advertising trackers.

We do not provide our service to health or medical providers, and we do not set out to collect health information. If a caller volunteers something sensitive, it is handled under this policy like any other call content.

3. Recording of calls — consent and deletion

• Where call recording is switched on, the AI announces at the start of the call that the call may be recorded. This plays for every caller: Australian states differ on consent rules, so we apply the strictest standard everywhere.
• If a caller declines recording, the recording is stopped and deleted, and no transcript of that call is kept. A minimal marker that a call occurred is retained.
• Call recordings (audio) are deleted automatically after 90 days. Transcripts and call summaries are kept so the business can see its call history and the AI can recognise repeat callers.
• Training calls — a business owner teaching their own AI — are not recorded as audio.

4. Automated decision-making and AI

Your call is answered by an artificial-intelligence system, not a person. The AI:

• answers questions using information the business supplied;
• takes messages and, where the business enables it, books appointments;
• tells you it is an AI if you ask;
• transfers you to a person, or takes a message for one, on request. Complaints, emergencies and anything it can't handle are routed to people.

We use AI to help the business respond to you. We do not use AI to make decisions with legal or similarly significant effects about callers.

5. What we use information for

• Operating the phone service: answering, transcribing, messaging, booking
• Showing each business its own call history and analytics. A business sees only its own callers; this separation is enforced in the database.
• Sending service messages: booking confirmations, message notifications, call recaps
• Improving a business's own AI from its own calls. A business's data trains only its own agent, never another business's, and we do not train foundation models on your calls.
• Improving the service itself. We review calls to find where the AI got things wrong and fix its instructions. This is our own staff reading a call, not training an AI model on it.
• Security, fraud prevention and rate-limiting of abusive callers
• Billing and account administration for business customers

We do not sell personal information. We do not use caller information for marketing.

SMS. Every SMS lane that could carry marketing honours STOP and unsubscribe automatically, as required by the Spam Act 2003. Service messages are sent only in connection with your call or booking.

6. Where your information goes, including overseas

Personal information is stored in Australia: our database, file storage and servers run in Sydney. To operate the service we rely on specialist providers, some of them outside Australia. Before we send information overseas we take reasonable steps to make sure each provider handles it consistently with the APPs, including data-protection terms in our agreements with them.

Business customers who need the named list of our providers for their own records can ask us for it.

7. Google user data (Calendar connection)

If a business connects Google Calendar, we access only the calendar events needed to check availability and to create, cancel or reschedule bookings, using the calendar.events permission the business grants. Google access tokens are stored encrypted (AES-256-GCM). We use Google user data only to provide calendar booking inside the service, and our use complies with the Google API Services User Data Policy, including the Limited Use requirements. Disconnecting the calendar in the dashboard revokes our access.

8. How we protect information

• Tenant isolation enforced in the database (row-level security): a business can only ever see its own data
• Encryption in transit (TLS) everywhere; integration tokens encrypted at rest
• System logs are built to carry internal reference IDs, not personal details. Names, numbers and transcripts stay in the access-controlled database.
• Dashboard access requires login. Sensitive fields are masked on screen by default. Platform-operations access requires authenticator-app two-factor login.
• Call recordings delete automatically at 90 days, and our deletion tooling covers a caller's full record (section 9)

9. Access, correction and deletion

• Callers: you can ask us, or the business you called, what we hold about you, ask for corrections, or ask for deletion. We have built erasure tooling that removes a caller's records across the platform.
• Business customers: your account data and your business's call data are visible in your dashboard. Contact us for anything you can't do yourself.
• Contact: privacy@roundhour.com.au. We respond within 30 days.
• If you're unhappy with how we've handled something, tell us first. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Retention

11. Changes and contact

We update this policy when our practices change and note the date at the top. Material changes are notified to business customers by email.

Kanini Solutions Pty Ltd trading as RoundHour · ABN 49 638 785 976 · privacy@roundhour.com.au · Melbourne, Australia