Zivah AI — Privacy Policy

Effective date: 16 June 2026 Version: 1.0

Zivah AI Pty Ltd (ABN 46 695 944 364) ("Zivah", "we", "us", "our") provides AI voice agent services. We are committed to protecting your personal information and handling it in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs"). This policy explains what personal information we collect, how we use and disclose it, how we keep it secure, and the rights you have.

If you are located in the European Economic Area (EEA) or the United Kingdom, the additional rights in Section 12 (EEA/UK data subjects) also apply to you.

Our services are currently offered only to customers in Australia. (See our Terms & Conditions of Trade for service availability.)

1. Who we are and how to contact us

Entity: Zivah AI Pty Ltd · ABN 46 695 944 364 · ACN 695 944 364 (GST-registered)
Registered office: C/- Foundations Tax and Accounting Pty Ltd, 89 Scott Street, Deagon QLD 4017
Privacy contact: privacy@zivah.ai
General contact: hello@zivah.ai

We are the entity responsible for the personal information described in this policy (the "data controller" for the purposes of the GDPR section, where it applies).

2. The kinds of personal information we collect

Depending on how you interact with us, we may collect:

a) Account and billing information (from our business customers): name, business name, ABN, contact email and phone number, billing address, and payment details processed by our payment provider.

b) Voice and call information (when our AI voice agents handle calls on a customer's number):

Call audio recordings of inbound and outbound calls handled by the service;
Transcripts generated from those calls;
Caller line identification (caller ID / phone numbers), call times, durations, and call metadata;
Information a caller provides during a call — for example a name, callback number, appointment details, or the reason for the call.

c) Website information: information you submit through forms, and limited technical data collected by cookies and analytics (see our Website & Cookie Notice).

Sensitive information. We do not seek to collect sensitive information (such as health information). A caller may nonetheless mention sensitive details during a call; where the content of a recording reveals sensitive information, we treat it as sensitive information under the Privacy Act. We do not create voice biometric profiles (voiceprints).

3. How we collect personal information

We collect account and billing information directly from our customers when they sign up.

We collect voice and call information when our AI voice agent answers or makes a call on a number operated through the service. Call recording notice and consent: our customers are responsible for ensuring that callers are notified that the call may be recorded and processed, and our service provides an audible notice at the start of calls for this purpose. Recording of telephone conversations is regulated by the Telecommunications (Interception and Access) Act 1979 (Cth) and, in Queensland, the Invasion of Privacy Act 1971 (Qld).

4. Why we collect, use and disclose personal information (APP 6)

We use personal information for the following purposes:

Primary purpose — delivering the service: answering and making calls, transcribing them, booking appointments, taking and relaying messages, transferring calls, and providing call summaries and reporting to our customer.
Service quality and improvement: monitoring accuracy and reliability, diagnosing faults, and improving the configuration of a customer's own agent.
Billing and administration.
Support and communication with our customers.
Legal and safety compliance: to meet our legal obligations and respond to lawful requests.

We will only use or disclose your personal information for a secondary purpose where you would reasonably expect us to and it is related to the primary purpose, where you consent, or where the Privacy Act otherwise permits or requires it.

4A. Your choice about improving AI services

Some of the speech and language providers that process calls can use call recordings and transcripts to improve their models. By default we do not allow this — your account is private, and your call data is used only to deliver your service, not to train or improve any provider's models.

The customer (the business operating the number) may opt in, through a setting in the customer portal, to allow call data to be used to improve those services in exchange for a lower price:

Private (default) — call recordings and transcripts are not used to train or improve any provider's models.
Opt in to improvement — the customer actively chooses to allow call data to be used to improve speech and language services; a lower price applies.

The opt-in is off by default and can be turned on or off at any time; the applicable price reflects the setting.

5. Who we disclose personal information to

We disclose personal information to:

Service providers who help us run the service — including a licensed Australian carriage service provider that supplies the underlying telephone carriage and numbers, hosting and database providers, AI speech-to-text / language / text-to-speech processors, and our payment provider.
Our customer — the business whose number the agent operates (call recordings, transcripts and summaries are made available to that customer).
Authorities and others where required or authorised by law.

We do not sell your personal information.

6. Overseas disclosure (APP 8)

Some of the service providers that process call audio and transcripts are located overseas. As a result, your personal information may be disclosed to, or accessed by, recipients in countries including the United States, and may be processed in Australia.

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual obligations. Under section 16C of the Privacy Act we remain accountable for personal information handled by these recipients.

(We disclose the countries involved rather than naming individual vendors. This satisfies APP 1.4(g) and APP 8; see https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information.)

7. How long we keep personal information

We keep personal information only as long as we need it:

Call recordings: retained for approximately 90 days, then deleted, unless we are required to keep them longer or you ask us to retain a specific recording.
Transcripts and derived call data: retained for the term of the customer's contract, then deleted or de-identified.
Account and billing records: retained for 7 years to meet taxation and corporate record-keeping obligations.

8. How we keep personal information secure

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including access controls, encryption in transit, and restricting access to authorised personnel. No system is completely secure; we cannot guarantee absolute security.

9. Data breaches (Notifiable Data Breaches scheme)

We maintain a data breach response plan. If we have reasonable grounds to believe an eligible data breach has occurred — an unauthorised access, disclosure or loss of personal information likely to result in serious harm — we will, in accordance with Part IIIC of the Privacy Act, contain and assess the breach, take remedial steps, and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

10. Accessing and correcting your information (APP 12 & 13)

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. Contact us at privacy@zivah.ai. We will respond within a reasonable time and may need to verify your identity.

If a recording relates to a call you made to one of our customers, please note the customer (the business you called) is generally the entity responsible for that information; we will help direct your request appropriately.

11. Complaints

If you have a privacy complaint, contact us at privacy@zivah.ai and we will acknowledge and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the OAIC (https://www.oaic.gov.au/privacy/privacy-complaints).

12. EEA / UK data subjects (GDPR)

This section applies only if and to the extent the EU General Data Protection Regulation (Regulation 2016/679) or the UK GDPR applies to our processing of your personal data — generally, where we offer services to, or monitor the behaviour of, individuals in the EEA or UK (GDPR Article 3).

Lawful basis (Art 6): we process personal data on the basis of performance of a contract (delivering the service our customer has engaged) and our legitimate interests (operating, securing and improving the service), and otherwise with consent or as required by law.
Your rights (Arts 15–22): access, rectification, erasure, restriction of processing, data portability, and objection to processing (including to processing based on legitimate interests).
International transfers (Chapter V): Australia is not the subject of an EU adequacy decision. Where we transfer EEA/UK personal data to Australia or other countries, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Complaints: you may lodge a complaint with your local supervisory authority.
EU representative (Art 27): We have not appointed an EU representative, as our services are offered in Australia. EEA/UK residents may contact us at privacy@zivah.ai.

13. Automated decision-making

Our AI voice agents follow the call flows configured by our customer. We do not use them to make legal or similarly significant decisions about individuals by automated means alone.

14. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and the "last updated" date shows when it last changed.