Privacy Policy

1. Overview

This Privacy Policy explains how OrderStaff (“OrderStaff”, “we”, “us” or “our”) manages personal information when you visit our website, enquire about OrderStaff, use the OrderStaff platform, or call a business that uses OrderStaff.

OrderStaff is an AI phone staff platform for business workflows such as restaurant ordering, appointments, bookings and routine enquiries. Depending on the relationship, we may handle personal information for our own business purposes and/or on behalf of a business customer using OrderStaff.

2. Information we collect and hold

The kinds of information we may collect or hold include:

• contact details such as name, business name, email address, phone number, suburb and postcode;
• account, login and business configuration information;
• business operating information such as menus, products, services, treatments, staff, opening hours, availability, prices, modifiers and business rules;
• caller information provided during a call, such as name, phone number, order details, booking details, appointment preferences, delivery or pickup information and questions;
• audio recordings or call transcripts where recording or transcription is enabled and lawful;
• structured information generated from a call, such as an order, booking, appointment, enquiry or call outcome;
• support, billing and commercial communications; and
• website and device information such as IP address, browser information, pages viewed and cookie or analytics information.

We do not ask callers to provide sensitive information unless it is reasonably necessary for the relevant workflow and lawful to collect. Businesses should avoid configuring OrderStaff to collect information they do not need.

3. How we collect information

We may collect personal information directly from you when you submit a form, communicate with us, create or use an account, configure your business, or interact with OrderStaff.

We may also collect information from a business customer that has configured OrderStaff, from callers interacting with that business, and from service providers that support telephony, AI/voice processing, hosting, security, analytics, payments or customer support.

When OrderStaff acts on behalf of a business customer, that business may be responsible for its own privacy notices and collection obligations in relation to its callers and customers.

4. Why we use personal information

We may use personal information to:

• provide, configure, operate, secure and support OrderStaff;
• answer calls and interpret caller requests;
• create or update orders, bookings, appointments, enquiries and other configured business workflows;
• confirm information back to callers and provide business information;
• operate dashboards, logs and account features;
• communicate with business customers and respond to enquiries;
• improve reliability, quality, safety and product performance;
• detect misuse, security incidents and technical problems;
• meet legal, regulatory, tax, accounting and contractual obligations; and
• send marketing communications where we have the consent or other lawful basis required to do so.

5. AI and automated processing

OrderStaff uses AI and related software to understand speech and text, identify what a caller is asking for, retrieve configured business information, structure a request, and generate a response or workflow action.

OrderStaff is designed for routine business workflows. It is not intended to make decisions that significantly affect an individual’s legal rights, access to essential services or other similarly significant interests. If we introduce automated decision-making of that kind, we will update this policy and our practices as required by applicable law.

AI systems can make mistakes. Business customers are responsible for keeping their business information accurate and should monitor OrderStaff outputs and configuration appropriate to their use case.

6. Calls, recordings and transcripts

A call may be transcribed and, where enabled, recorded so OrderStaff can provide the configured service, create structured work, support quality and troubleshooting, and maintain appropriate records.

Recording and monitoring laws differ between Australian jurisdictions and use cases. Business customers must ensure that any call recording or monitoring they enable is lawful and that callers receive any notice or consent required for their circumstances. OrderStaff may provide configurable disclosure language, but this is not a substitute for legal advice.

If recording is not enabled, some call metadata, transcripts or structured workflow information may still be processed where necessary to provide the service.

7. When we disclose information

We may disclose personal information to:

• the business customer for whom the call or workflow is being handled;
• our personnel and contractors who need access to operate or support the service;
• technology providers supporting telephony, AI/voice processing, cloud hosting, security, analytics, payments, email, customer support or the website;
• professional advisers, insurers, auditors or prospective business transaction counterparties subject to appropriate confidentiality controls; and
• regulators, courts, law enforcement or other parties where required or authorised by law.

Service providers may include providers such as Cloudflare, ElevenLabs, Twilio and Shopify where those services are used in the relevant OrderStaff workflow. Our provider mix may change as the platform evolves.

8. Overseas processing and disclosure

Some technology providers may store or process information outside Australia. Depending on the provider and configuration, overseas locations may include the United States and other countries in which our service providers operate infrastructure.

Where Australian Privacy Principle 8 applies to an overseas disclosure, we will take reasonable steps required by law in relation to the overseas recipient, subject to any applicable exceptions.

9. Security and retention

We use technical and organisational measures designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, authentication, encryption provided by our infrastructure, logging, environment separation, provider security controls and operational procedures.

No internet or voice platform can guarantee absolute security. If we become aware of a data incident, we will assess and respond to it in accordance with our incident response processes and applicable legal obligations, including the Notifiable Data Breaches scheme where it applies.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, our contractual and operational needs, dispute resolution, security, and legal or accounting requirements. We take reasonable steps to delete or de-identify information when it is no longer needed, where required by law.

10. Access and correction

You may request access to personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity before responding.

If information is held primarily on behalf of a business customer, we may direct the request to that business or work with the business to respond, depending on the circumstances and applicable law.

11. Marketing and cookies

We may send commercial electronic messages where permitted by law. Our marketing messages will identify the sender and provide an unsubscribe method. You can unsubscribe at any time.

Our website uses cookies and similar technologies for essential website functions and may use analytics, functional or marketing technologies depending on the services enabled. See our Cookie Policy for more information.

12. Privacy complaints

If you have a privacy question or complaint, contact us using the details below. Please describe the issue and provide enough information for us to investigate it. We will acknowledge and assess complaints within a reasonable time.

If the Privacy Act 1988 (Cth) applies and you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner.

13. Contact us

We may update this Privacy Policy as our services, providers, legal obligations or information practices change. The current version will be published on this page with the updated date.