Privacy Policy

This policy explains how we handle personal information. Our Cookie Policy explains the cookies and similar technologies we use, and our Sub-processor List names the providers that may handle personal information for us. All three are at https://inspra.ai/legal.

Privacy at a glance#

1.About this policy#

1.1Who we are#

In this policy, 'we', 'us' and 'Inspra' mean Genius365 Pty Ltd ABN 50 679 963 967, trading as Inspra. Inspra AI is the AI platform we develop and supply. We are based in Melbourne, Victoria. Our contact details, and our Privacy Officer's details, are in section 17.

Genius365 Pty Ltd (Inspra) has chosen to be covered by the Privacy Act 1988 (Cth) under section 6EA, and we comply with it and the Australian Privacy Principles (APPs).

1.2Who this policy covers#

This policy covers personal information about:

• our customers, white-label partners and their staff and users;
• people who visit our websites, use our website voice demo or contact us;
• people we contact in our own sales and marketing, including by our own AI agent;
• people our customers' AI agents talk to or message, and people in contact lists our customers upload (section 6); and
• our suppliers and their staff.

1.3Our two roles#

1. a.

   When we decide how information is used. For our own customers, prospects, website visitors and marketing, we decide why and how personal information is handled. This policy explains what we do.

2. b.

   When we handle information for a customer. When a business uses our platform, its AI agents collect information from the people they talk to, and the business decides how that information is used. The business owns the intellectual property in that call data under our Customer Terms, and its own privacy policy applies. We handle the information for the business: to supply and secure our platform, give support and comply with the law. We also have our own obligations under the Privacy Act for the personal information we hold, including call data, and we meet them as this policy explains.

1.4Children#

Our services are for businesses and are not directed at children. We do not knowingly collect personal information from children through our website or platform for our own purposes. If you believe we have done so, please contact us and we will deal with it promptly.

2.Personal information we collect#

We collect only personal information that is reasonably necessary for our functions and activities. The kinds of information we collect, and how we collect them, are:

2.1Sensitive information#

People may share sensitive information, like health details, during a call or in our voice demo. Where we collect sensitive information, we do so only where reasonably necessary and with the individual's consent, unless a legal exception applies. The customer is responsible for any consent the law requires to collect it in its calls. A customer's responsibilities do not replace ours. We handle any sensitive information we hold as the Privacy Act and this policy require.

Our customers must tell us before they use the platform to collect health information (Customer Terms, Schedule 3). We do not use voice recordings to create voiceprints or other biometric templates to identify people.

2.2If you do not give us information#

If we cannot collect the information we need, we may not be able to supply the products or services you want or respond to your enquiry. Where it is lawful and practicable, you may deal with us without identifying yourself, for example when asking a general question.

3.How we collect personal information#

Unless it is not reasonable or practicable, we collect personal information directly from you, for example when you contact us by phone or online, sign up to our platform, use our website forms or voice demo, or talk to our team.

We may also collect personal information about you from:

• our customers, when their AI agents talk to you or message you, or when they upload contact lists;
• your organisation, or our white-label partners, when they give us details of their staff, users or clients;
• social media platforms, when you submit a lead form or interact with our advertising;
• publicly available sources, like business directories, company websites and LinkedIn;
• other companies in our group that you may have dealt with;
• our payment provider, carrier partners, identity and fraud checking services, and other service providers that help us supply our products;
• our websites and how you use them, using cookies and similar technologies; and
• your authorised representatives.

If we collect personal information about you from someone else, we take reasonable steps to tell you about it, unless it is obvious from the circumstances or a legal exception applies.

4.How we use personal information#

We use personal information for the purposes for which we collected it, for related purposes you would reasonably expect, and for other purposes the law allows. These include:

1. a.

   supplying our services: setting up and running accounts, running our customers' AI agents and, for a managed service, setting them up and tuning them, and connecting customers' phone numbers to the platform;

2. b.

   verifying and billing: checking that a business is eligible, verifying email addresses and phone numbers, preventing fake signups and fraud, charging and billing for products and collecting payment;

3. c.

   support and communication: answering enquiries, giving support and service, and telling customers about changes to our products, terms or policies;

4. d.

   safety and security: keeping our platform, our customers and the public safe, detecting and preventing misuse, scams and breaches of our Acceptable Use Policy and our Campaign and Batch Calling Terms (Campaign Terms), and responding to carrier and regulator requests;

5. e.

   improving our platform: monitoring, testing and improving our facilities and products, and using de-identified call data as described in section 8;

6. f.

   marketing our own services: see section 7;

7. g.

   legal and business purposes: complying with the law, managing and planning our business, dealing with complaints and disputes, and managing risk; and

8. h.

   other purposes: any other purpose you agree to.

The call-data limits in this policy apply to every use and disclosure described here: we use call recordings, transcripts and details of callers and contacts only as described in sections 4(d), 6, 8 and 9, and never for our own marketing.

5.Our websites and voice demo#

1. a.

   Website forms. Our website forms collect what you enter, such as your name, work email, company, phone number and message, and the page that referred you.

2. b.

   Voice demo. The voice demo on our website uses your microphone so you can talk to an AI agent. We use your voice and the conversation only to run the demo, improve it and respond to your enquiry. To make the demo work, some trusted service providers process the conversation for us as it happens, and some of them may be located outside Australia. They do not keep your recordings or conversation, although they may keep basic technical details, such as when the demo was used. We store our own copy of the conversation, and any website form details, securely in Australia and delete them from our website systems after 7 days. If we follow up an enquiry, we keep the enquiry details in our customer relationship management system for the period in section 13.

3. c.

   Bot protection. Cloudflare Turnstile checks our website forms and voice demo for bots. It processes information about your browser and device.

6.Calls and messages handled by our customers' AI agents#

Our customers create their own AI agents on our platform. When an agent handles a call or message, our platform holds personal information about the other person, such as their phone number, a recording and transcript, and the details the agent captures. Customers may also upload contact lists for their agents to call or message.

The customer owns the intellectual property in this call data under our Customer Terms, decides how it is used, and its own privacy policy applies. We handle it for the customer: to supply and secure our platform, give support, detect and prevent misuse, enforce our terms and comply with the law. We do not use it for our own direct marketing. We also have our own obligations under the Privacy Act for the personal information we hold, including call data, and we meet them as this policy explains.

Our customers must tell the people their agents talk to that they are speaking with an AI agent, disclose any recording or transcription at the start of the call, and meet the laws on calls, messages and call recording. If a customer's agent called you, or you called a business that uses our platform, you can contact that business, because it decides how its call data is used. You may also ask us for access to or correction of personal information we hold about you, including information we hold for a customer. We will assess your request under Australian privacy law and coordinate with the customer where appropriate.

Recording cannot be stopped part-way through a call. If you do not want a call to be recorded, the business must end the call, and you can ask it to deal with you another way.

Phone numbers and calls. We do not own or operate a telecommunications network or supply phone services. Customers bring their own carrier or take numbers directly from our carrier partner, which supplies them under its own terms. If a customer gives us information for a number through our platform, we pass it to the carrier partner. Carriers handle information about calls, such as numbers, call times and durations, under their own legal obligations and privacy policies, and may keep it for the periods the law requires of them.

If you receive an unwanted call or message from a number that uses our platform, you can report it to report-dnc@inspra.ai. We will pass it to the business responsible and act under our Acceptable Use Policy where needed.

7.Our own marketing and sales#

We may use and disclose personal information to market our own products and services, and those of our related companies, to businesses and their staff, but only where you have agreed or the law otherwise allows it. We may contact you by email, SMS and other electronic messages, phone calls (including calls made by our own AI agent), post, social media and targeted online advertising.

1. a.

   Calls from us. When we call you, we comply with the Do Not Call Register Act 2006 (Cth) and the Telecommunications (Telemarketing and Research Calls) Industry Standard 2017. If our AI agent calls you, it will tell you that it is an AI agent. We will tell you if a call is recorded.

2. b.

   Messages from us. Our marketing emails and messages identify us and include an easy way to opt out. You can opt out at any time, for example by using the unsubscribe link in an email or by replying to the message. We will stop sending you those messages within 5 business days.

3. c.

   Opting out of calls and other marketing. You can ask us at any time to stop marketing to you by any channel, and we will keep a record so that we do not contact you again for marketing. You can also ask us where we got your details, and we will tell you unless it is impracticable or unreasonable to do so.

4. d.

   Advertising. We do not use advertising pixels on our websites, and we will update this policy and our Cookie Policy before we do. We do not upload customers' call data or contact lists to advertising platforms.

We do not use information from our customers' calls, such as details of callers and contacts, recordings and transcripts, for our own marketing.

8.AI processing and use of de-identified data#

1. a.

   Our platform uses speech recognition, AI language models and voice synthesis to run AI agents, transcribe calls and produce summaries and scores. To do this, call audio, transcripts and related information are sent to our speech, voice, orchestration and AI model providers, which are listed in our Sub-processor List.

2. b.

   We do not use call data, including audio, recordings, transcripts and de-identified call data, to train or fine-tune AI models, and we do not ask anyone else to do so for us. This applies to information about callers and other people on a call, and about our customers. Our use of de-identified call data under paragraph (d) does not include model training or fine-tuning.

3. c.

   Operating the platform involves sending call data to third-party orchestration, speech, voice and AI model providers. Their handling of that data depends on the applicable contracts and settings. Some providers may retain call data and use it to train or improve their models. Our commitment in paragraph (b) about our own conduct does not extend to those providers' independent training activities. We remain responsible for meeting our own privacy obligations.

4. d.

   We may use de-identified call data (edited so it is no longer personal information) to develop, test, troubleshoot and improve our platform only, as our Customer Terms allow. Removing names alone is not enough to de-identify call content, such as recordings and transcripts. We do not use call recordings or transcripts in demonstrations without the customer's permission. Customers can opt out of this use, and Enterprise customers and customers handling health information are opted out unless they opt in.

5. e.

   Our staff may listen to recordings or read transcripts only where needed to give support, deliver a managed service, investigate misuse or a complaint, or comply with the law. We use access controls and log all staff access to recordings.

9.Automated decisions#

From 10 December 2026, the Privacy Act requires us to explain decisions that could significantly affect a person's rights or interests, where we use a computer program to make the decision or to do something substantially and directly related to making it.

1. a.

   Decisions we make. We use automated systems in these decisions:

   1. i.

      whether to open an account or keep it open, using email and phone number verification, checks on sign-ups from free email services, the number of accounts opened from the same IP address, the ABN and business details you give us, and Cloudflare Turnstile results, to detect fraud, fake sign-ups and repeat free starts;

   2. ii.

      whether to pause a campaign automatically, using call outcomes, invalid or failed call rates, opt-outs and complaints, carrier notices and similar signals, under our Campaign Terms;

   3. iii.

      whether to stop new calls when an account has no available balance, using the account's credit and plan balance; and

   4. iv.

      where we use automated checks on agent configuration and call activity, whether to flag or block content or activity that may breach our Acceptable Use Policy.

2. b.

   These decisions mainly affect businesses, but they can affect individuals, such as sole traders. If an automated decision affects you, you can contact us to ask for an explanation and for a person to review it.

3. c.

   Decisions our customers make. Customers may set up their AI agents to use what callers say and their phone numbers to hold conversations, answer questions, book appointments, transfer calls, score calls and label call outcomes. Customers may use these outputs to support their own decisions. The customer is responsible for explaining its own decisions, and our Customer Terms require it to keep meaningful human review of decisions that have a legal or similarly significant effect on a person.

10.Who we disclose personal information to#

We may disclose personal information as reasonably required to:

• our service providers, including for cloud hosting, speech recognition, voice and AI models, telephony and SMS, WhatsApp messaging, search, payments, customer relationship management, email, website security and analytics, and professional services such as legal, accounting and audit. Our Sub-processor List names the providers that may handle personal information in call data and customers' content;
• our carrier partners, when a customer gives us information for a number from them through our platform, and to respond to carrier requirements such as scam call tracing;
• the ACMA's SMS Sender ID Register, when we register a sender ID for a customer;
• the customer whose agent handled your call, and the carriers and systems connected to the customer's account;
• our white-label partners, where a customer uses our platform through a partner, subject to our confidentiality obligations;
• members of our corporate group and our agents, subject to our confidentiality obligations;
• your authorised representatives, and anyone you ask us to disclose it to;
• regulators, government agencies, courts and law enforcement bodies (such as the ACMA, the OAIC and the police) where the law requires or allows it;
• people who invest in or acquire all or part of our business, or are considering doing so, subject to our confidentiality obligations. We do not give them our customers' call data or content unless they acquire the business and take on our commitments to customers; and
• others where the law requires or allows it.

Disclosures remain subject to our confidentiality obligations and applicable law. We give customers at least 30 days' notice before a new sub-processor starts handling personal information in their call data or content, as our Customer Terms describe (Schedule 3 clause 4), except for urgent changes needed for security or to keep the service running, which we tell customers about as soon as practicable. We do not sell personal information. Where telecommunications laws apply to information about calls, including Part 13 of the Telecommunications Act 1997 (Cth), we use and disclose it only as those laws allow.

11.Overseas disclosure#

We store personal information mainly in Australia, in the Amazon Web Services Sydney region. Some of our service providers process personal information outside Australia to provide their services, in particular:

• speech recognition, AI model, voice and orchestration providers, some hosting providers, and telephony and messaging providers, mainly in the United States;
• our customer relationship management, website security, payment and sign-in providers (such as GoHighLevel, Cloudflare, Stripe, Google and Microsoft), mainly in the United States; and
• our staff and contractors, such as prompt engineers, system integrators, developers and applied engineers, some of whom work from outside Australia, in India and Pakistan. They can access personal information only where their role needs it. They are vetted before they start and are bound by confidentiality and non-disclosure obligations.

Our Sub-processor List shows the countries where each provider processes personal information. Before we disclose personal information to someone overseas, we take reasonable steps to make sure they handle it in line with the Australian Privacy Principles, unless an exception in the Privacy Act applies. Enterprise customers can arrange for their call data to be processed only in Australia.

12.How we keep personal information secure#

Genius365 Pty Ltd (Inspra) maintains an information security management system certified to ISO/IEC 27001:2022. Customers can ask us for a copy of the certificate, which sets out its scope. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure, including:

• hosting in Australia with a major cloud provider;
• encryption of personal information in transit and at rest;
• role-based access controls, multi-factor authentication for administrative access, and logging of access to recordings and transcripts;
• security testing, vulnerability management and secure development practices;
• staff training and confidentiality obligations; and
• due diligence on, and contracts with, our service providers.

We keep customer content and call data confidential for as long as we hold them. No system is completely secure, so we also ask customers to protect their accounts and credentials.

13.How long we keep personal information#

We keep personal information only as long as we need it for the purposes in this policy or the law requires. We then delete it or de-identify it. Our periods are:

We are not an archive. Customers must export and keep any records they need, including records they must keep under their own legal obligations, before the periods above end. Once information is deleted, we cannot recover it. If you ask us for a recording or other information that has been deleted, we will tell you that we no longer hold it.

We keep information for longer only where the law requires it, or where we need it to deal with a complaint, a dispute, a regulator's request or a legal claim, and only for as long as that need lasts. If we close an account for breach of our Customer Terms, the same 30 days apply unless the content is unlawful or keeping it would cause harm.

14.Data breaches#

If we suspect a data breach that is likely to cause serious harm, we assess it promptly. Where the law requires, we notify the people affected and the Office of the Australian Information Commissioner as soon as practicable. If a security incident affects a customer's data on our platform, we will also tell the customer without undue delay and, where feasible, within 72 hours after we confirm the incident, unless the law or a law enforcement or regulator investigation requires us to delay. Our notice to customers is separate from any notice the law requires, and does not delay it.

15.Cookies and similar technologies#

Our websites and platform use cookies, browser storage and similar technologies. Our main marketing site, inspra.ai, uses Google Analytics 4 (provided by Google LLC) to measure site usage in aggregate. You can opt out through your browser settings or the Google Analytics Opt-out Browser Add-on. Our Cookie Policy lists the technologies on each site, what they do and how you can control them.

16.Your rights and choices#

1. a.

   Access and correction. You may ask for access to the personal information we hold about you, or ask us to correct it. Anyone may make a request, including about information we hold for a customer. You do not need an account with us. We will process and respond to your request in accordance with Australian Privacy Principle 12 (access) and Australian Privacy Principle 13 (correction). There is no charge for making a request or for correcting personal information. Any charge for giving access will be only as the law allows.

2. b.

   Transcripts and outcomes. Call transcripts and recorded call outcomes are created automatically and may contain errors. We take reasonable steps to keep the personal information we hold accurate, up to date and complete, and you can ask us to correct a transcript or outcome about you in the same way.

3. c.

   Marketing. You can opt out of our marketing at any time (section 7).

4. d.

   Consent. Where we rely on your consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.

5. e.

   How to make a request. Contact us using the details in section 17. We may need to verify your identity, or the authority of someone acting for you, before we act. We aim to respond within 30 days. If we refuse a request, we will tell you why and how to complain.

17.Complaints and contact#

If you have a question or a complaint about how we have handled your personal information, including a complaint that we have breached the Australian Privacy Principles, please contact our Privacy Officer:

• Email: compliance-officer@inspra.ai or hello@inspra.ai
• Phone: 1300 467 772 (1300 INSPRA)
• Post: Privacy Officer, Inspra (Genius365 Pty Ltd), Suite 1, Level 10, 3 Bowen Crescent, Melbourne VIC 3004

We will:

• acknowledge your complaint within 5 business days;
• give you an estimated first response time;
• allocate your complaint to a suitably senior staff member; and
• process and respond to your complaint as soon as we reasonably can, and usually within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992. Complaints about unwanted telemarketing calls or spam can also be made to the Australian Communications and Media Authority (ACMA).

18.Third-party websites and white-label partners#

Our websites may link to sites that we do not control, and their own privacy policies apply. When a customer uses our platform through a white-label partner, under the partner's brand and web address, the partner's own privacy policy also applies to the partner's handling of personal information.

19.Changes to this policy#

We may update this policy. We will publish the updated version on our website with its effective date and keep earlier versions available at https://inspra.ai/legal. If a change materially affects how we handle customers' personal information, we will also tell customers by email at least 30 days before it takes effect.