Privacy Policy

1. Scope and our role

Alovo provides AI-assisted reception and administrative tools to Australian businesses. This policy applies to people who visit or create an Alovo account, representatives of businesses using Alovo, people who contact us, and callers whose calls are handled using Alovo.

For account, website, support and billing information, Alovo decides how the information is handled. For caller information, Alovo generally handles information to provide services for the business the caller contacted. That business remains responsible for its own privacy notices, collection practices and instructions to Alovo.

In this policy, “Alovo”, “we”, “us” and “our” refer to the Australian operator of the Alovo service. Legal and privacy notices can be sent to admin@alovo.biz.

2. Information we handle

Business accounts and configuration

We may handle names, email addresses, phone numbers, business names, Australian Business Numbers, service areas or addresses, authentication identifiers, account status and support communications. We also store the information a business configures for its receptionist, such as services, hours, frequently asked questions, booking rules, call-routing choices, greetings, escalation contacts and retention settings.

Password-based authentication is provided through Firebase Authentication. Alovo receives verified account identifiers and email details, but does not receive the plaintext password entered into Firebase.

Calls, callers, leads and bookings

Depending on the business's configuration and what a caller provides, we may handle caller ID, name, phone number, email address, suburb, service requested, preferred appointment time, messages and notes. Call records may include provider identifiers, time and duration, call status, consent status, actions taken, structured outcomes and a summary. A conversation transcript may also be retained where permitted as described below.

A caller may incidentally provide sensitive information, including health or financial details, even though Alovo is designed for administrative reception rather than professional advice. We process that information only as needed to follow the business's approved workflow and instructions, and businesses should configure Alovo to avoid collecting sensitive information they do not reasonably need.

Connected accounts and services

If a business connects a calendar, we handle the connected account's identifier, email address, display name, chosen calendar, granted permissions, encrypted access credentials, token expiry and synchronisation status. We read availability and booking event data, and create, update or cancel booking events as described in section 4.

If a business connects a supported customer relationship management service, Alovo may send confirmed contact details, structured lead or booking information, the outcome and an Alovo record link. The current integration does not send raw call transcripts. If billing is enabled, Stripe processes payment details and Alovo retains related customer, subscription, invoice and payment-status identifiers rather than full card numbers.

Website and technical information

We may collect IP address, browser and device information, session cookies or browser storage, timestamps, request and security logs, and diagnostic information. If a business asks Alovo to import its public website, we retrieve the nominated page and retain the text the business reviews and approves for its receptionist.

3. How we use information

We use personal information where reasonably necessary to:

• create and secure accounts, authenticate users and administer business workspaces;
• answer routed calls, follow approved business instructions, capture enquiries, offer appointments, create bookings and capture callback requests;
• operate calendar, CRM, telephony, notification and billing integrations selected by a business;
• provide support, communicate service or security information and respond to requests;
• measure permitted usage, prevent abuse, troubleshoot failures and maintain service reliability;
• comply with law, enforce our terms and protect callers, customers, Alovo and others; and
• understand service performance using operational information that is aggregated or de-identified where reasonably possible.

We do not use personal information for unrelated purposes without an appropriate basis and, where required, notice or consent.

4. Google user data

A business may use Google Sign-In for authentication, which requests basic account identity, email and public profile information, or choose to connect Google Calendar. Calendar connections use basic account identity and email information together with calendar.freebusy and either calendar.events.owned or calendar.events. Alovo uses the connected account's primary calendar for the functions below. The narrower calendar.events.owned permission limits event access to calendars the connected account owns; a connection granted calendar.events may retain that broader permission until the account owner revokes it.

Alovo uses those permissions to:

• request busy start and end times so Alovo can calculate available appointment slots;
• read calendar events within the relevant time window when changing a booking, to identify conflicts while excluding the original booking event;
• create a private event for a booking confirmed by a caller or entered by an authorised business user, subject to the business's booking and approval settings;
• retrieve an Alovo-created event to verify creation and check it before changing it; and
• update or reschedule the linked event when an authorised business user edits a booking, or delete that event when they cancel the booking.

An Alovo-created event may contain the business and customer name, booking time, customer phone or email, booking notes and an Alovo booking identifier. Busy periods are used to calculate availability and are not retained as a copy of the connected calendar. Derived available times may be provided to OpenAI's live AI service and communicated to callers solely so the receptionist can offer appointment times.

When reading calendar events to calculate availability for a booking change, Alovo uses event identifiers, start and end times, event status, whether an event blocks time and the connected account's attendance response. Other calendar event details received from Google are not retained as a copy of the calendar or sent to the AI service.

Google access and refresh credentials are encrypted before storage. Disconnecting a calendar removes Alovo's locally stored credential and stops future access through that connection, but it does not revoke the authorisation grant shown in the Google account or delete events already created in Google Calendar. Alovo booking records and the corresponding Google event identifiers or links may remain under the general retention rules in section 8. The account owner can separately remove Alovo's access through their Google Account permissions.

5. Calls, transcription and AI processing

To provide an AI receptionist, live call audio is transmitted to voice, telecommunications and AI providers, including OpenAI, for real-time processing and transcription. Live audio must be processed for the AI service to operate even where the business has selected a no-transcript configuration. Alovo's current service does not itself persist raw call audio, although a business or telecommunications provider may separately record calls under its own settings and notices.

Businesses must configure and deliver any notices or consent mechanisms required for their calls. Depending on the configured route, callers may hear that the service uses AI, that live audio is processed outside Australia, and whether a transcript may be retained. Where transcript retention is enabled, the transcript is stored only when the route's recorded consent state permits it. Structured details deliberately supplied for an enquiry or booking may still be retained separately from a transcript.

Alovo sends the AI provider only the business context and live-call information needed to conduct the approved workflow. AI output can be incomplete or incorrect, so businesses must review their configuration, maintain a suitable human or fallback path, and must not use Alovo for emergency response or professional advice.

6. When we share information

We may disclose information to:

• the business the caller contacted and authorised users of its Alovo workspace;
• hosting, database, authentication, security and support providers, including Railway and Google Firebase;
• AI, transcription, telephony and communications providers, including OpenAI, Crazytel, Twilio where configured, and Resend;
• Google Calendar, Microsoft Outlook, Apple/iCloud calendar services, HubSpot, Pipedrive or Zoho when a business chooses to connect that service;
• Stripe and related payment providers if the business uses paid features;
• professional advisers, insurers, authorities or other parties where reasonably necessary to comply with law, respond to legal process, prevent harm or protect rights; and
• a successor or proposed successor in connection with a merger, financing, acquisition or sale, subject to appropriate confidentiality protections.

We require service providers to handle information for the contracted service and under appropriate confidentiality and security obligations. We do not sell personal information.

7. Overseas processing

Alovo is designed for Australian businesses, but some processing occurs outside Australia. Our current web and voice hosting uses infrastructure in Singapore, while the primary Firestore database is configured in Sydney. OpenAI, Google, Microsoft, telecommunications, CRM, email and payment providers may process or support information in the United States and other countries where they or their subprocessors operate.

Privacy and data-protection laws in those countries may differ from Australian law. We take reasonable steps appropriate to the service and information to assess providers, limit disclosed information and protect information handled overseas.

8. Security, retention and deletion

We use administrative, technical and organisational safeguards appropriate to the information we handle. These include access controls, tenant separation, secure transport, encrypted storage of calendar and CRM credentials, secrets management, logging controls and procedures intended to avoid placing raw audio or transcript text in application logs. No online service can guarantee absolute security.

A business chooses a transcript retention period, commonly 7, 30, 60 or 90 days. Expired transcript bodies are scheduled for periodic deletion, so removal may occur after rather than exactly at the expiry time. Other records—including account, call metadata, consent, summaries, leads, bookings, usage, billing, security and audit records—are kept for as long as reasonably needed to provide the service, resolve disputes, maintain security and meet legal or accounting obligations.

A business can disconnect a calendar or CRM integration from Alovo. To request account or personal-information deletion, email admin@alovo.biz. We may verify identity or authority before acting, and may retain information where required by law or where a limited record is reasonably necessary for security, billing, dispute or audit purposes. Deleting information from Alovo does not automatically delete copies already sent to a connected service or the business the caller contacted.

9. Access, correction and your choices

Business account holders can review much of their workspace information in Alovo. You may ask us to provide access to, correct or delete personal information we hold about you, or raise a concern about how it has been handled, by contacting us. We may need enough information to verify your identity and locate the relevant record.

If your information was collected during a call to an Alovo customer, contacting that business directly may be the fastest way to exercise your rights because it controls the call workflow and customer relationship. You may also contact Alovo and we will assist the business where appropriate.

You can manage or revoke connected-app access through Google or the relevant provider. Revoking access may prevent calendar or other integration features from working.

10. Contact, complaints and changes

For privacy questions, access or correction requests, deletion requests or complaints, email admin@alovo.biz. Please describe the issue and the business or call involved without emailing unnecessary sensitive information. We will review the request, may seek verification or further details, and will respond within a reasonable period.

If you are not satisfied with our response and the Australian Privacy Act applies, you may be able to contact the Office of the Australian Information Commissioner.

We may update this policy as Alovo changes or legal requirements develop. We will publish the updated version here and change the “Last updated” date. If a change materially affects how we use Google user data or other personal information, we will provide additional notice or seek consent where required before applying the new use.