Privacy

LexiLive Pty Ltd, ABN 11 701 307 913, of Augustine Heights, Queensland. In this policy, we and us mean LexiLive Pty Ltd.

We build and run AI answering and automation for Australian small and medium businesses. That means we hold two quite different kinds of personal information, and this policy treats them separately because the answers are different.

Information about you, when you deal with us. You visit this site, you ask us a question, you become a client. We decide what we collect and why. This policy governs it.

Information about your callers, when we run a service for you. Someone rings your business and our system answers. We are handling that person's information on your instructions, not our own. You decide what is collected and why. Section 5 covers what we do with it and what we will not do with it, and your engagement agreement covers the rest.

If you rang a business and reached us, and you want to know what happened to that call, section 12 tells you how to ask, and we will tell you which business it was and help you reach them.

Businesses turning over $3 million or less are generally outside the Australian Privacy Principles. We nonetheless handle personal information as though they applied to us, because our clients include health service providers who have no small business exemption whatever their size, because the exemption was never a shield against everything, and because a vendor that handles your callers' voices should be answerable under the same standard you are.

Where this policy states an obligation, treat it as a commitment we have made to you rather than one the Act currently imposes on us. We will say so plainly here if that changes.

• When you contact us: Your name, your business name, your email address, your phone number if you give one, and whatever you tell us about your business.
• When you use the tool on this site: The answers you type into it. An email address only if you give one. Nothing else that identifies you.
• When you become a client: Billing details, the settings and instructions you give us, and records of the work we do for you.
• When you browse this site: Pages you looked at, roughly where you were from your IP address, your browser and device type, and how you arrived.
• When we answer your calls: The caller's phone number, the audio of the call, a transcript of it, and whatever the caller tells us so that we can do what you asked us to do with the call. Where your business is a health service, that can include health information, because a caller describing why they need an appointment is giving health information whether they mean to or not. Health information is sensitive information under the Privacy Act and we treat it that way.
• When we send messages for you: The recipient's number and the content of the message.

To answer your enquiry. To give you a quote. To run the service you engaged us for. To invoice you and keep the records the law requires. To fix the service when it goes wrong. To tell you about our services where you asked us to, and you can stop that at any time.

We do not sell personal information. We do not rent or trade contact lists. We do not use one client's information to benefit another.

When we run a service for a client, we act on that client's instructions. The client decides what is collected and why.

• We do not use it for our own purposes.
• We do not use it, and we do not permit our providers to use it, to train AI systems. Section 7 sets out how that is enforced rather than asserted.
• We keep each client's information separated from every other client's.
• We reach your other systems by being added to them as a user with the access the work needs, not by holding your passwords.
• When an engagement ends, we export your information to you, delete it, and remove our access. Section 9 gives the timeframe.

This is the section most likely to matter to you, so it is the longest.

What we do. Every call our system answers begins with a spoken announcement, before the conversation starts, that says the call is recorded and transcribed, that the recording and transcript are shared with the service providers who help handle the enquiry, that staying on the line means the caller agrees, and that a caller who would rather not be recorded can hang up and contact the business another way. We log, for each call, that the announcement played.

It is on by default and we will not quietly turn it off. If a client asks us to disable it, we ask for that instruction in writing and we record it, because at that point the client has taken on a risk we can no longer help them carry.

Why the announcement says what it says. Australian law on recording a conversation is not one rule, it is nine, and the two halves of the problem do not line up.

Federally, recording a call is only interception if it happens without the knowledge of the person making the call, so telling the caller is what keeps it outside the prohibition entirely.

Then each state and territory has its own Act. In Victoria, Queensland and the Northern Territory a party to a conversation may record it. In New South Wales, Western Australia, South Australia, Tasmania and the Australian Capital Territory a party may record only if the other parties consent or a narrow protective exception applies. That much is widely known and widely mis-stated.

What is less widely said is that the states which are permissive about recording are the strict ones about sharing. Victoria, Queensland, the Northern Territory, Western Australia and the Australian Capital Territory each separately restrict passing a recording or a transcript to someone who was not on the call, and passing it on is the whole product: a transcript is no use to you sitting on our servers. In every one of those jurisdictions, the consent of the parties is an available exception. Consent is the only basis that works for both halves at once, in every state, which is why the announcement asks for consent to the sharing and not only to the recording.

And we cannot know where a caller is standing when your phone rings. So the announcement is written to satisfy the strictest jurisdiction, on every call, everywhere.

What is still yours. You are the business the caller rang. You decide whether to use the service, what your callers are told beyond the announcement, and what you do with the recordings afterwards. If you record by some other means as well, that is yours to get right. We are telling you what our part does so that you can see where your part starts.

We are not your lawyer. If your situation is unusual, get advice. We would rather you did.

Our services use speech systems and large language systems supplied by other companies. We do not build our own.

What the AI does. It converts call audio to text, decides what to say back within the rules you set, writes bookings and messages into the systems you nominate, and drafts summaries.

What it does not do. It does not send, pay, change or contact anyone outside the boundaries you agreed. Anything that crosses one of those boundaries stops and waits for a named person. It does not make a decision about a caller that has a legal or similarly significant effect on them. It does not learn from your information in a way that could surface your information to anyone else.

Training. Our providers are engaged on terms that do not permit training on information submitted through their business interfaces, and that do not permit retention beyond what is needed to return the response.

Getting it wrong. Language systems produce confident wrong answers and speech systems mishear, particularly on accents, on older voices and on poor lines. Every automated action is recorded so it can be reviewed. Anything consequential waits for a person. A caller can ask for a person and get one.

Automated decisions. From 10 December 2026 the Privacy Act requires a privacy policy to describe the kinds of personal information used in computer programs that make decisions significantly affecting someone's rights or interests, the kinds of decisions made solely by those programs, and the kinds of decisions those programs substantially contribute to. A person reviewing the output does not remove the obligation.

To that standard: our systems use a caller's phone number, what the caller says during the call, and the transcript of it. Nothing our systems do by themselves is a decision that significantly affects a caller's rights or interests. They sort, they draft, they estimate, and they book appointments into the slots a business has already chosen to make available. Where the outcome for a caller could matter, the process stops and a named person decides. The estimate this website produces from the answers you type is produced by a program, and it is an estimate rather than a decision about you.

We use other companies to run the service. Each one gets only what it needs. We can tell you which providers are involved in your setup. Ask, and we will name them in writing within two business days. Contact details are also kept in Attio, our CRM, so we can follow up.

• Changes to that list. We will tell you by email at least 30 days before a new provider starts handling your information, and you may object.

Where. Your information is stored and processed in Australia. Where a system is only available outside Australia, we say so, and we say which country, before you engage us to use it.

How long. These are our defaults. A client can set a shorter or longer period for their own service, within the range shown, and we will honour it.

• The 7 years is not our choice. Australian company law requires financial records to be kept for that period, and tax law requires 5 years, so the longer figure governs. Nothing requires us to keep call audio for any period at all, which is why the default for audio is short. Holding recordings indefinitely because storage is cheap is how a small breach becomes a large one.
• When you leave. We export your information to you in a usable format, delete it from our systems within 30 days of the export, and remove our access to your other systems. If you want written confirmation that it is gone, ask and we will send it.

We use access controls, encryption in transit, and a credential process that avoids shared passwords. Access to a client's systems is limited to the people doing the work.

We hold no SOC 2 and no ISO certification, and we do not imply one. There is no badge on this page because there is nothing to put on it. If a certification matters to your decision, say so early and we will tell you plainly where we are.

No system is completely secure. If something goes wrong and it is likely to cause serious harm, we will tell the affected people and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. We will also tell you, as our client, as soon as we become aware of it, whether or not the scheme requires it, because you will have your own people to notify and your clock starts when ours does.

You can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, ask us to delete it where we are not required to keep it, and tell us to stop sending you anything.

Email [email protected]. We will acknowledge within 2 business days and answer within 30 days. We do not charge for a request unless it is unusually large, and then we will tell you the cost before we start, and you can withdraw it.

If you rang an Australian business and an automated system answered, and you want to know what was recorded or want it deleted, email [email protected] with the number you rang and roughly when. The business you rang decides what happens to it, not us, so we will tell you which business it is and put your request to them. If they are our client we will help them answer it.

This site uses cookies to work and to understand how it is used. You can refuse the non-essential ones and the site will still work.

Analytics run through Cloudflare Zaraz with Google Analytics 4 and Consent Mode v2. Analytics cookies stay denied by default until Consent Mode records acceptance. Cloudflare Web Analytics is cookieless and does not need that consent.We also use PostHog to understand website use and the journey through our reports, and GrowthBook to assign test variations that help us improve the experience. These optional tools run only after you accept the Analytics purpose in our cookie settings. PostHog events exclude form contents, email addresses, sign-in tokens and report or sharing identifiers. Session recordings are disabled. Our PostHog project uses US infrastructure.We use Sentry to record technical errors on the website so we can fix them. Sentry runs for every visitor, including visitors who decline analytics, because a broken page has to be visible to us. It does not set a cookie and does not attach your account, your email address, form contents, report contents, sign-in tokens or your session. It receives the page address without the query string or fragment, so report and sharing identifiers are not sent, and anything shaped like an email address inside an error is removed before it is stored.

We do not use advertising cookies, and we do not sell or share site analytics for ads.

Tell us first. Email [email protected] and put complaint in the subject. A named person, not a queue, will look at it, and we will respond within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner, on 1300 363 992 or through oaic.gov.au.

We will update this policy from time to time and the date at the top shows when it last changed. If a change affects how we handle information we already hold for a client, we will tell that client directly before it takes effect.