Giday Privacy Policy

Launchr Pty Ltd (ABN 46 696 518 206), trading as Giday

Version 1.9. Last updated 3 September 2026. (What changed in 1.9: the emergency instruction in section 4.4 — hang up and ring 000, end the call, text the account holder — now applies to receptionists in restricted mode only. An ordinary receptionist is not given it. What changed in 1.8: the sign-up form is now a series of short steps, and what you type on each completed step is saved on our side as an unfinished sign-up for 7 days so you can pick up where you left off and so we can see where people get stuck — section 4.8. It is deleted when you finish or after 7 days, and we do not contact you about it. What changed in 1.7: we now accept health and medical clients, in a restricted mode described in section 4.4 — the agent is instructed not to hear, say or keep anything clinical, and call audio is not recorded at the voice provider for those clients. "Not sure" at the health question is treated as an ordinary signup. Every agent now tells a caller in danger to ring 000, ends the call and texts the account holder. What changed in 1.6: two new things, both described here before they start. First, when a free trial ends we now keep a one-way fingerprint of the email address, mobile number and IP address it used, so the same person cannot take the free trial over and over — see section 4.6. It is never used for marketing and never shared. Second, if you tick the box at sign-up we will email you when we add features, and you can unsubscribe from any of those emails — see section 4.7. Nothing changed about how we handle caller data.)

The short version

• Giday is an AI receptionist. It answers the phone for Australian small businesses.
• Calls are recorded and transcribed. A notice at the start of every call tells you the call may be recorded, before anything is recorded. It plays on every call, for every business, and it cannot be switched off.
• The agent introduces itself as an AI, and it will tell you it is an AI if you ask. It can put you through to the business owner. It can delete the recording and transcript of your call if you ask.
• We pass what you tell the agent to the business you rang. That is the whole point of the service.
• We keep transcripts for a limited time, not forever, and the call audio sits with our voice provider under its own retention policy.
• Some of the technology behind Giday sits overseas, mostly in the United States. Your phone number, what you said, the recording and the transcript go through those services.
• If you are unhappy with how we handled your information, tell us. If we do not fix it, you can take it to the Office of the Australian Information Commissioner.

The rest of this page explains all of that properly. Where this page and our Data Handling, Retention and Sub-processors statement give different periods for the same thing, the shorter one applies and we will correct the other document.

1. Who you are dealing with

There are two organisations involved in a Giday call, and it matters which is which.

The client is the business you rang. The plumber, the clinic, the real estate agency. They decide what their agent says, what is in their price list, what gets booked, and what happens to the messages we take. Their own privacy practices are their own.

Launchr Pty Ltd builds and runs the Giday platform for that business. We are a Queensland company with two directors and no other staff. We hold the transcripts, the messages and the booking records on our systems, our voice provider holds the call audio, and we hand the message to the client.

So both of us hold information about you, and you can ask either of us about it. This policy covers what Launchr does. It does not cover what the business you rang does with the message once they have it.

2. Where we stand on the Privacy Act

We would rather be straight with you about this than sound clever.

The Privacy Act 1988 (Cth) does not cover every business. Under section 6D, a business with an annual turnover of $3 million or less is generally outside it, unless one of several exceptions applies. Launchr is under that threshold today. Whether one of the exceptions catches us is genuinely arguable, because we handle information about callers on behalf of other businesses, and Australian law has not settled how that is treated.

We are not going to hide behind an unresolved argument.

We handle personal information as if the Australian Privacy Principles applied to us in full, and we give you the rights set out in this policy whether or not the Act compels us to. We are also a two-person company and we are not going to claim we are perfectly compliant with anything. Where we fall short of a standard, this policy and the Data Handling statement say so.

Some laws apply to us regardless of our size, and we take them seriously:

• the listening devices and surveillance devices laws of each State and Territory, which govern recording a phone call;
• the Spam Act 2003 (Cth), which governs text messages;
• the Australian Consumer Law; and
• the statutory right to sue for a serious invasion of privacy, which came into force on 10 June 2025.

Nothing in this policy limits your rights under the Australian Consumer Law.

3. If you rang a business and got our AI receptionist

3.1 What we collect during a call

• Your phone number, as presented by the phone network, and the time, date and length of the call.
• Your name, if you give it.
• What you say. The agent asks what you need. Whatever you tell it becomes part of the message.
• The call audio, as a recording held by our voice provider.
• A transcript of the call, made automatically from the audio, and a short written summary of what you wanted.
• Booking or job details, if the agent books something: the address, the time, what the job is.
• The figure the agent quoted, if it quoted one.
• Your email address, only if you give it.

We collect this because it is the only way to take a message, book a job, or quote from a price list. If you do not want to give it, you can ask the agent to put you through to the business, or hang up and contact them another way.

We do not ask for and do not want your card details, bank details, Medicare number, tax file number, licence number or passwords. Please do not read them out. If one ends up in a transcript by accident, tell us and we will remove it.

3.2 Recording, and the announcement

Every call to a Giday number starts with a spoken notice, before any audio is captured and stored. In words, it says: "Thank you for calling [the business]. Your call may be recorded for quality and training purposes." The agent then introduces itself as an AI assistant.

The notice plays on every call, for every business, and it cannot be switched off. There is no setting for it and nobody here can turn it off for you. In New South Wales, South Australia, Western Australia, Tasmania and the Australian Capital Territory, that notice is how consent to record a call is obtained — so a call without one would leave neither the business nor us with consent to record it.

Being straight about what that notice does and does not do:

• it names the business and tells you the call may be recorded;
• it does not use the word "transcribed" — the call is transcribed, and that is why we say so here;
• it does not offer you a route to continue the call without being recorded.

If you would rather not be recorded, tell the agent. It will not argue. It will delete the recording and the transcript of that call, and either take your message another way or put you through to the business. Deletion happens within an hour of the call ending. Being exact: the purge runs on an hourly sweep, so if the call is still being processed at our voice provider when the sweep runs, it goes on the next one instead. The agent cannot stop a recording part-way through a call, so the recording of that call exists until it is deleted.

3.3 The agent is an AI

It is not a person. It introduces itself as an AI assistant, and if you ask, it confirms it. It can transfer you to the business owner. It is set up not to give legal, medical, financial or safety advice, and to hand you to a person instead. If it ever does say something like that, it was not meant to and you should not rely on it — tell us and we will fix it. Any price it reads out is an estimate from the business's own price list, not a binding quote. There is no setting that changes that.

3.4 Sensitive things people mention

People sometimes tell a receptionist things that are sensitive: an injury, a health condition, a family situation. We do not need that detail, and the agent is instructed not to ask for it. If you have already said something you would rather was not on the record, tell the agent, or contact us at the address in section 14, and we will remove it.

3.5 Text messages

We send SMS in the client's name, not ours. Two kinds:

• Messages about your job: a booking confirmation, a change of time, a cancellation. These follow on from the call you made and are not marketing.
• Follow-ups about a quote: only if you clearly said yes to that on the call. That consent is recorded, and every one of those messages identifies the business, gives you a way to contact them, and tells you how to stop.

Reply STOP and we stop sending marketing messages, and we suppress your number for that business. Our messages come from an ordinary Australian mobile number, so the reply actually reaches us. We also pass the opt-out to the business, and the business has agreed with us to honour it across its own channels. If it keeps messaging you after that, tell us — and you can also complain to the ACMA at acma.gov.au.

Honest limit: some automatic factual texts about a job you actually booked, such as a booking confirmation, can still reach you after you opt out. If you do not want those either, tell us and we will stop them.

3.6 How long we keep it

This table says what we do today, including where a period is not yet enforced automatically. We would rather publish that than publish a promise the system does not keep.

At the end of those periods we delete the records or strip them of anything that identifies you. Our client may keep their own copy for longer, under their own policy.

3.7 Getting a call deleted, or getting a copy

You can ask us to delete the records of your call.

• The fastest way is to say so on the call. The agent will action it, and the recording and transcript are purged within an hour of you hanging up.
• Otherwise, email hello@giday.com.au with the number you rang from, roughly when you called, and who you rang. We will confirm it is really you, usually by contacting you on the number the call came from, then delete the recording, the transcript and our record of the call. Email requests are handled by hand today, so allow up to 10 business days, and we will email you when it is done.

Deleted records are gone from our operational backups within a further 35 days.

Honest limits:

• The business you rang has its own copy. Anything the agent already passed to them — a message, a booking, a quote — is their record. We will pass your request on to them, tell you who they are so you can ask them too, and let them know you asked us.
• If a booking has already been made, deleting the call does not cancel the job. Contact the business for that.
• We keep a minimal record of the request itself, so we can show we honoured it.
• We may need to keep a minimal record where the law requires it, or where the information is genuinely needed for a legal claim or a complaint that is already on foot. If that happens we will tell you what we kept and why.

You can also ask for a copy of what we hold about your call, and ask us to correct it if it is wrong. See section 10.

4. If you are a business using Giday

4.1 What we collect from you

Your business name and ABN, your contact name, email and phone number, your plan, your dashboard login, your settings, your support messages, and logs of who changed what and when. At sign-up we also ask whether your business provides a health service, and we keep your answer — section 4.4 explains what it changes. Sign-up happens in short steps; what you have typed on completed steps is kept as an unfinished sign-up for up to 7 days — section 4.8.

Card details go straight to Stripe through their hosted checkout page. We never see or hold your full card number.

4.2 Your price list and your website content

You can import content so the agent knows your business: services, prices, hours, policies, answers to common questions.

That import is for business content only. Do not load in customer lists, past job records, or anything containing other people's personal information. You will not knowingly do it and you will take reasonable care to check; if some gets in, tell us or we will find it, and we will remove it.

When you point us at your website, we read only the pages you point us at, we obey the site's robots.txt, and we check whether the address looks like it belongs to your business. If it does not, we hold the draft for a person here to look at before it can go anywhere near your agent. Nothing read from a website reaches your live agent until you have read it and saved it yourself.

When you connect a job system such as ServiceM8, Giday pushes jobs out to it and does not pull your customer records in.

4.3 What is on you

You are the business your customers are actually ringing. You are responsible for the accuracy of your price list and your business information, for telling your customers what you do with their details, and for meeting your own privacy obligations, which may be heavier than ours — for example if you fall under the anti-money-laundering rules.

We are responsible for running the platform properly, applying your settings as you set them, and keeping a record of the figure your agent actually quoted on each call.

4.4 Health and medical clients: restricted mode

We do accept health-service clients — medical, dental, allied health, physiotherapy, chiropractic, podiatry, psychology and counselling, aged care, disability care, pharmacy, veterinary, and anything else where callers ring about their health — and we serve them under tighter limits than anyone else.

A business that provides a health service and holds health information is covered by the Privacy Act 1988 (Cth) at any size — section 6D does not exempt it — and in Victoria the Health Records Act 2001 has no small-business exemption at all. Those obligations are the practice's and stay the practice's; nothing in this policy moves them to us. What we can do is build the receptionist so that she holds as little health information as a phone service possibly can. That is what restricted mode is.

If you answer yes to the health question at sign-up, your agent runs in restricted mode from her first call, and you are shown this list before you finish:

• She does not discuss symptoms, conditions, diagnoses, medications, results, treatments or therapies — not to describe, confirm, guess at or repeat back. If a caller starts to explain what is wrong, she lets them finish, says she is not the right person for the clinical side, and gets them to the practice.
• Clinical detail is never written down. A message about a health matter records only that the caller would like a call back, with their name and number. You ring them and hear it from them.
• She gives no health advice of any kind, including whether something can wait or whether someone should come in. She says plainly that she is not qualified if asked.
• Nothing is kept at the voice provider. For restricted clients the call audio is not recorded, and the provider's transcript is scheduled for deletion rather than retained. We do not publish this as a compliance claim; it is a description of the setting we use.
• Ordinary reception works normally — appointments, hours, location, fees, cancellations and rescheduling.

If you answer "not sure", you are signed up as an ordinary client. You know what your business is better than we do, and we do not put a professional into a mode they did not ask for. You can tell us at any time that your business is a health service and we will switch the profile on.

What restricted mode does not change. A booking is still a name, a time and a phone number, and the law may treat that as health information; we hold booking, message and call records for the life of your account exactly as we do for every client (section 5). The recorded notice at the start of every call still plays and still cannot be switched off. We have not taken legal advice on the health sector; we have written down exactly what the receptionist does and does not do, and if the rules or the advice change we will change her with them and tell you.

A receptionist in restricted mode has one further instruction that outranks all others. If a caller describes anything that sounds like danger to life or limb, she stops what she is doing, tells them immediately and plainly to hang up and ring triple zero (000), ends the call so their line is free, and sends the account holder a text at once with the caller's number and what they said. She does not ring 000 for them and never says or implies that she has, or that help is on the way. She does not assess how serious the situation is: she is instructed to err heavily towards saying it. An ordinary Giday receptionist is not given this instruction — she does not end a call for anything other than its normal conclusion — and Giday is not an emergency service for any client (Terms, section 3.5).

4.6 When a free trial ends: the repeat-trial record

The free trial is genuinely free — no card charged, nothing to cancel. That only works if it is

one per business, so when a trial ends we keep a small record to stop the same person taking it

again and again.

What we keep is a one-way fingerprint, not your details. We take the email address, the mobile

number and the IP address the trial used, and run each through a one-way cryptographic function

with a secret key that is never stored alongside the result. What is left cannot be turned back

into your email address, your number or your address — not by us, and not by anyone who obtained

the file. It can only be compared against a future sign-up to see whether it is the same.

What it is for, and nothing else. Deciding whether a new sign-up is entitled to another free

trial. It is never used for marketing, never used to build a profile, never sold, never shared,

and never combined with anything else.

It never stops you becoming a customer. If you have had a trial before, you can still sign up

and pay — you simply start on a paid plan from day one. We will tell you that plainly on the

screen rather than silently refusing you, and there is a way to reach a human if we have got it

wrong.

A shared address is not a shared person. IP addresses in Australia are routinely shared by

whole suburbs of mobile users, by offices, and by caravan parks. So a matching IP alone never

blocks anyone; it is only ever a flag for a human to look at. Only a matching email or mobile

stops a second free trial.

How long: 24 months from the day the trial ended, then deleted.

4.7 Emails about new features

If you tick the box at sign-up, we will email you when we add something to Giday, and occasionally

about things we think are genuinely useful to your business. The box is not ticked for you.

Every one of those emails identifies us, and every one has a working unsubscribe link that we

action immediately. Unsubscribing from feature emails never affects the emails you need — booking

notifications, billing, and anything about your service still reach you, because those are not

marketing.

If you had a trial and left, you are on that list only if you ticked the box. We may also send a

single email a couple of weeks later asking whether we can do anything better. If you would rather

not hear from us at all, one reply saying so is enough and we will action it.

4.8 Unfinished sign-ups

The sign-up form is a series of short steps. Each time you complete a step, what you typed on the steps so far is kept in your browser tab and a copy is saved on our side, so you can pick up where you left off and so we can see where people get stuck. That copy holds only what you typed into the form fields — your business name, trade, area, receptionist name, hours, quoting and after-hours choices, your numbers, email and plan. It never holds the acknowledgement boxes, your answer to the health question, or your card details, and we do not record your IP address or browser against it.

It is deleted the moment you finish signing up, and otherwise deleted automatically 7 days after your last step. We do not email, text or ring you about an unfinished sign-up, and it is never used for marketing. If you want it gone sooner, email hello@giday.com.au with the business name you typed and we will delete it the same business day.

5. Who we share information with, and where they are

We do not sell personal information, and we do not use it for our own marketing. (One narrow exception, described fully in section 12: if you arrive at our website from one of our ads, we measure that arrival ourselves so we can audit what the ad platforms charge us — and if that ad click becomes a signup, we report the signup back to the platform that ran the ad, in the small hashed form section 12 spells out. All of it is about how a new client reached our website — it never touches your Giday service data, your callers, or their calls.)

We pass a caller's details to the business they rang. That is the service, and it is why you rang them.

To make the platform work, we use these suppliers. Most of them are in the United States. The Data Handling, Retention and Sub-processors statement describes each one in more detail.

We also disclose personal information where the law requires it, for example a court order or a lawful request from a regulator or the police, and where it is needed to deal with a serious threat to someone's life, health or safety.

We do not use call recordings or transcripts to train any model of our own. We have not audited each supplier's own model-training terms, so we do not make a claim on their behalf; where a supplier offers a setting that stops it using customer data for its own training, we intend to turn it on, and the Data Handling statement records where we have confirmed it.

6. Sending information overseas

Be clear on what this means. Call audio, transcripts, caller phone numbers and message content leave Australia. They are processed in the United States and on Cloudflare's global network.

We do not claim your information stays in Australia, because it does not.

We take reasonable steps to make sure our overseas suppliers handle it to Australian standards, through their contract terms, their security and privacy commitments, and the settings we choose. We treat ourselves as accountable for what they do with it. If one of them mishandles your information, come to us. We are not going to point at a supplier and call it your problem.

7. Automated decisions

The Giday agent is automated. During a call it decides, without a person involved, what to say, what to write down, whether to offer a time in the diary, and what price to read from the client's price list.

That is not the end of the process. A person at the business you rang sees the message or the booking and can change it or ring you back. If you would rather deal with a human from the start, say so and the agent will transfer you or take a message for someone to call you.

8. How we keep it safe

• Transcripts and records are encrypted in transit. At rest they rely on the encryption our storage platform applies by default; we do not add a second layer of our own and we do not operate per-client encryption keys.
• Integration credentials and API keys you give us are encrypted by us before they are stored, and decrypted only at the moment they are used.
• Each client's data is separated by tenant, and every read of call content is scoped to a single client.
• Access to production call data is limited to the two directors of Launchr Pty Ltd. We do not employ a support team and we do not give contractors access to production call data.
• We look at a client's call content only when we need to for a support request, a fault, a legal request, a deletion request, or a security investigation.
• We delete transcripts once the retention period is up, so there is less sitting around to lose.
• We do not hold ISO 27001 certification, a SOC 2 report or an independent penetration test report, and we do not describe our platform as "bank-grade" or anything similar.

No system is perfect, and we are not going to pretend otherwise. What we can promise is that we do not keep more than we need, for longer than we need.

9. If there is a data breach

If personal information we hold is lost, accessed without authorisation, or disclosed when it should not have been, this is what happens.

1. We contain it first, then work out exactly what was affected.
2. We assess whether it is likely to cause serious harm. We aim to finish that assessment within 30 days, and faster where recordings, transcripts or health information are involved.
3. We tell the affected client businesses within 48 hours of forming a reasonable suspicion, so they can meet their own obligations. They will only ever know if we tell them, so we tell them.
4. We notify the Office of the Australian Information Commissioner and the affected individuals, including callers, not just our clients. The notice says who we are, what happened, what kinds of information were involved, and what we suggest you do about it.
5. If health information collected in Victoria or New South Wales is involved, we also follow the State obligations that attach to it.

We do not rely on any exemption when deciding whether to tell people their information has been exposed. We will do steps 3 and 4 whether or not we are legally required to. It is a short conversation and it is the right one.

10. Getting a copy, and fixing mistakes

Ask us and we will give you a copy of the personal information we hold about you, and correct it if it is wrong. This applies to callers as well as to our clients.

Email hello@giday.com.au. We will confirm who you are first, and we aim to respond within 30 days, usually within 5 business days. It is free. If we cannot give you something, for example because it would reveal information about somebody else, we will tell you why in writing.

11. Complaints, and the OAIC

Step one: tell us. Email hello@giday.com.au, or write to us at the address in section 14. Tell us what happened and what you want done. We will acknowledge it within 5 business days and give you an answer within 30 days.

Step two: the OAIC. If we do not respond, or you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner.

• Web: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

The OAIC normally expects you to raise it with us first and give us 30 days.

Health information. If your complaint is about health information, you may also be able to complain to a State or Territory health complaints body, such as the Health Complaints Commissioner in Victoria or the Information and Privacy Commission in New South Wales.

Text messages and calls. Complaints about spam or telemarketing can also go to the Australian Communications and Media Authority at acma.gov.au.

12. Our website

Beyond the advertising measurement described below, on giday.com.au we use only what is needed to keep the site working and to keep a login session. We do not run third-party advertising or tracking pixels on the site, and we do not use third-party analytics. You can block cookies in your browser; the site still works, but you will not be able to stay signed in to a dashboard.

There is one piece of third-party code on giday.com.au, and it is not advertising or measurement: ElevenLabs' voice-widget code, loaded from a public code CDN (unpkg.com). It appears in exactly two places, and in both it loads only if you choose to start a chat — never on page load, and never if you don't press the button. The first is Chat with Verity on our home page, so you can talk to the agent before you buy. The second is Test your receptionist inside the client dashboard, so a signed-in client can talk to their own agent. If you press either one, ElevenLabs and the CDN can see that request, including your IP address and browser type, and ElevenLabs receives what you say in the chat. ElevenLabs is already the sub-processor that runs our calls and is listed as such in the Data Handling statement. Nothing else third-party runs anywhere on the site, and nothing loads at all unless you press the button.

If you arrive from one of our ads, we measure that ourselves. We said we would name any measurement here before turning it on, so here it is. When a visit arrives carrying an ad-click reference or a paid-campaign tag in the link (for example Google's gclid, Meta's fbclid, or a link we have marked as paid), we record — on our own infrastructure, nobody else's — that reference, the page you landed on, the time, and the technical details of the request: IP address, network, rough location and browser type. A small first-party script confirms the page really loaded in a browser. We use this for exactly two things: auditing what the ad platforms bill us against what actually happened (click fraud is real, and we check for it), and knowing which ad brought us a new client. We do not use it to profile you, we do not sell or share it with data brokers, and it never involves third-party code on the page. The IP address and browser details are deleted within 90 days; the rest of the click record is kept no longer than 14 months. A first-party cookie (gd_clk) ties your arrival to a signup if you make one — blocking it costs you nothing except our ability to know which ad worked.

When an ad click becomes a signup, we now tell the platform that ran the ad — and only then. Version 1.3 promised to describe that report here before we started sending it; this is that description. If you arrive from a Meta ad and go on to sign up, we report that to Meta from our server to theirs — there is still no Meta pixel and no third-party advertising or tracking code on the site. There are at most two such reports about you, at two moments: one when you submit the signup form, and one when your trial actually begins at checkout — the second is how Meta learns the ad produced a client, not just a form-fill. Both carry the same, and only the following: the email address and mobile number you gave at signup, hashed before they leave us (a one-way fingerprint, not the address or number itself); the click reference Meta itself attached to the link you clicked; the page you landed on and the time; and the IP address and browser type of the signup request. Meta uses this to match the signup to the ad, so we can see which ads actually produce clients, stop paying for the ones that don't, and audit what we are billed. What never goes: anything about callers or calls, transcripts, your business content, what you did on our site, or anything at all about visitors who don't sign up. We now do the same for Google, through Google's server-side API — as version 1.4 said we would, before any Google ad spend begins. There is only one Google report, and it is sent at the second of those two moments: when your trial actually begins at checkout. Nothing is sent to Google when you merely submit the form. The Google report is smaller than the Meta one: it carries only the click reference Google itself attached to the link you clicked, the time your trial started, the identifiers of our own ad account that tell Google which report this belongs to, and two consent flags. Those flags record our assessment that consent applies for Australian traffic under Australian law. They are not a signal collected from you — we do not ask you for one, and we send Google nothing about you for them to govern. It does not include your email address or mobile number in any form, hashed or otherwise. There is no Google tag on the site either, and there never will be. The Data Handling statement lists both platforms, with the detail, in its section 3.5. If we ever add more measurement than what this section describes, we will name it here before we turn it on.

13. Changes to this policy

We update this page when what we do changes. The version number and date are at the top. If we make a change that materially affects how we handle personal information, we will email our clients at least 30 days beforehand and publish a short summary of what changed. We will not apply a change backwards.

14. Contact us

Launchr Pty Ltd (ABN 46 696 518 206), trading as Giday

Privacy enquiries: hello@giday.com.au

Post: 81-83 Campbell St, Surry Hills NSW 2010

Phone: (02) 7501 0101