Privacy Policy

Last updated: 26 October 2026

Who we are: Vocalis Desk is a sole-trader business based in Perth, Western Australia. Privacy questions: support@vocalisdesk.com.

Vocalis Desk ("we", "us") provides an AI phone receptionist and dashboard for businesses. This policy explains what information we handle, why, who we share it with and the choices you have. We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, and we aim to meet the privacy laws of the other countries our customers operate in.

Who this policy covers

• Our customers - businesses that sign up for Vocalis Desk, and the people who log in to their dashboard.
• Callers - people who phone a business that uses Vocalis Desk. For callers, the business is responsible for its own customer information; we handle it on the business's behalf to provide the service.
• Prospects - people who enquire about Vocalis Desk (contact details and notes of our conversations).
• Website visitors.

What we collect

• Account details: business name, contact name, email, phone numbers, address, industry, opening hours, services, prices, menus and other details you give us to set up your receptionist.
• Call information: the caller's phone number, call recordings, transcripts, summaries, the reason for the call, and details the caller gives (such as their name, contact number and booking details).
• Bookings and messages created by the receptionist or by you.
• Billing details: payments are handled by Stripe. We see your plan, invoices and payment status, but we never see or store your full card number.
• Help chat messages you send in your dashboard.
• Technical information: login and security records. We keep you signed in with a cookie and a login session stored in your browser. If you turn on notifications, we store your device's notification address and browser type. We don't use advertising or tracking cookies. We count visits to our public website with Vercel Web Analytics, which doesn't use cookies or identify you.

Cookies

We only use what's needed to keep you logged in: one login cookie and a login session saved in your browser. We don't use advertising, tracking or analytics cookies, so there's no cookie banner. Our website fonts are hosted by us, so visiting our site doesn't send your details to font providers.

Why we use it

• To answer calls, make bookings, take messages and transfer urgent calls for your business.
• To show you your calls, recordings, transcripts, bookings and reports.
• To send account emails (logins, payment notices, weekly reports) and notifications you've turned on.
• To bill you, prevent fraud and keep the service secure.
• To provide support and improve the service.

We don't sell personal information, and we don't use callers' information for our own marketing.

Sensitive information and children

Callers sometimes share sensitive information, such as health details when calling a clinic. We use it only to pass it to the business they called. Vocalis Desk is for businesses; we don't knowingly collect information about children, except when a child phones a business that uses us, and then it's handled as described here.

Automated decisions

Our AI receptionist uses what callers tell it to automatically check availability and make bookings, mark calls as urgent, transfer calls and summarise them. No person reviews these at the time. The business can review, change or cancel every outcome in its dashboard, and callers can contact the business to have a person look at an outcome.

Who we share it with

We use trusted service providers to run Vocalis Desk. They only use the information to provide their service to us:

• Vapi (phone calls and the AI voice), using OpenAI and speech providers to understand and speak on calls.
• Anthropic (Claude) - the help chat, reading call transcripts to fill in the caller's name and reason, and reading uploaded menus.
• Twilio or other phone carriers - phone numbers and call connections.
• Stripe - payments and invoices.
• Supabase - our database (hosted in Sydney, Australia).
• Vercel - website hosting.
• Resend - sending emails.

Our providers process information in Australia (Supabase, Sydney), the United States (Vapi, OpenAI, Anthropic, Twilio, Stripe, Vercel), Japan (Resend) and other countries where they or their sub-processors operate. Before disclosing information overseas we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, and we remain responsible for it. We may also share information if the law requires it.

Our role for callers' information: we act as a service provider to the business (a "processor" under the GDPR/UK GDPR and a "service provider" under the CCPA) and use it only to provide the service. Businesses that need a Data Processing Agreement can ask us for one.

Call recordings and AI

Every call starts with the receptionist saying it's a virtual (AI) receptionist and that the call is recorded. Businesses can't turn this off. Businesses using Vocalis Desk are responsible for making sure their use of call recording and AI answering follows the laws where they operate, including any extra notice or consent those laws require.

How long we keep it

• Call recordings, transcripts and caller details are deleted after 12 months (here and at our call provider).
• Sign-ups that are never finished are deleted after 90 days.
• After you cancel, you can ask for an export of your data for 30 days. We then delete your account data within 90 days, except billing records, which tax law requires us to keep for 5 years.

Security

Information is sent over encrypted connections, access is restricted by login, and each business can only see its own data. No system is perfectly secure, but we take reasonable steps to protect information from misuse, loss and unauthorised access. If a data breach is likely to cause serious harm, we'll notify the people affected and the regulator as the law requires.

Your choices and rights

• You can see and update most of your business details in your dashboard.
• You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it. We respond within 30 days, free of charge.
• EU/UK residents can also object to or restrict processing, ask for their data in a portable format, and complain to their local supervisory authority. California residents can ask to know, delete and correct their information, and won't be treated differently for doing so.
• You can turn off the weekly report email and phone notifications at any time.
• Callers who want to access or delete their information should contact the business they called. We'll help that business respond.

Complaints

If you have a privacy concern, contact us first and we'll respond within 30 days. If you're not satisfied, in Australia you can contact the Office of the Australian Information Commissioner (oaic.gov.au), or your local privacy regulator elsewhere.

Changes

We may update this policy. We'll change the date at the top, and tell customers by email about important changes.

Contact

Email support@vocalisdesk.com.