Privacy Policy

Last updated 28 July 2026

Draft pending legal review. This describes how we handle personal information today. It has not yet been reviewed by a lawyer and will be replaced by a reviewed version before general release. Questions in the meantime: privacy@velobiz.com.au.

Who we are

Velobiz provides AI assistants for small and medium businesses. This policy covers the Velobiz website, the setup wizard and the client dashboard. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988.

What we collect

• Setup information. Your name, your business name, your website address, and the business contact details we read from that website or you enter yourself.
• Account information. Email address, password (stored hashed by our authentication provider), and your business phone number.
• Your customers' information. When your AI employee handles a call, message or booking, we process the contact details and conversation content needed to do that on your behalf. You are the owner of that data; we process it for you.
• Technical information. IP address, browser user-agent and page addresses. On the public setup wizard we store only a one-way hash of your IP and user-agent, salted and rotated daily, to rate-limit abuse — not to identify you.
• Bot protection. Public forms and the setup wizard use Google reCAPTCHA v3, which collects device and interaction signals under Google's own privacy policy.

Reading your website

When you enter a website address in the setup wizard we fetch a small number of publicly reachable pages from it — typically your home, about, services and contact pages — and use their content to pre-fill your configuration and, once you have an account, to build your assistant's knowledge base. We identify ourselves in those requests and we do not attempt to reach anything behind a login. If the pages contain personal information (for example a staff member's direct line), that information is treated as part of your business data under this policy.

How we use it

• To create and configure your account and AI employee.
• To operate the service — answering calls and messages, capturing leads, booking appointments.
• To send service communications such as your daily brief and alerts.
• To protect the platform from abuse and to meet our legal obligations.
• To improve the product in aggregate. We do not sell personal information.

AI processing

Conversation content and the website content described above are sent to third-party AI providers to generate responses and to structure your setup. We use providers that do not train their public models on our customers' data by default. Automated outputs can be wrong; you can review conversations in your dashboard.

Who we share it with

We share personal information only with the service providers we need to run the platform — cloud hosting and database, telephony and SMS, email delivery, calendar connectivity, AI model providers and bot protection — and with anyone you explicitly connect, such as your CRM. We may disclose information where the law requires it.

Where it's stored

Data is stored on cloud infrastructure that may be located outside Australia, including in the United States and the European Union. We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.

How long we keep it

• Abandoned setups. If you start the setup wizard and don't create an account, the draft expires after 7 days and is swept automatically. Where you completed a signup, we keep the record of your acceptance of the terms as proof of consent.
• Anonymous demo sessions. Rate-limit records for the public voice and chat demos expire within minutes to 30 days depending on the surface.
• Account and customer data. Kept while your account is active, and deleted after closure subject to the retention periods configured for your account and any records we must keep by law.

Your rights

You can ask us to access, correct or delete your personal information, or to export it. Your customers can opt out of marketing contact at any time, and every marketing message we send on your behalf carries an opt-out. To make a request, or to complain about how we've handled your information, email privacy@velobiz.com.au. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Security

We use encryption in transit, tenant isolation enforced server-side, hashed credentials and least-privilege access to production systems. No system is perfectly secure; if a breach is likely to cause serious harm we will notify you and the Commissioner as the Notifiable Data Breaches scheme requires.

Cookies

We use cookies that are necessary for the service: an authentication session cookie, and — during public setup — a short-lived cookie holding an opaque token that lets you resume an unfinished setup. Both are httpOnly and cannot be read by scripts.

Changes

We'll post updates here and, for material changes, notify you by email or in the dashboard.