Giday Privacy Policy

Launchr Pty Ltd (ABN 46 696 518 206), trading as Giday

Version 1.24. Last updated 25 October 2026. Latest change: section 2 names the federal Telecommunications (Interception and Access) Act 1979 beside the state recording laws; the OAIC's postal address is corrected to GPO Box 5288; the greeting is described as each business's own wording, which must say the call is recorded. Recent changes, newest first, are listed under Version history at the end of this policy.

The short version

• Giday is an AI receptionist. It answers the phone for Australian small businesses.
• Calls are recorded and transcribed. A notice at the start of every call the receptionist answers tells you the call is on a recorded line, before anything is recorded. It plays on every call, for every business, and it cannot be switched off.
• The agent is not a person, and it will tell you so plainly if you ask. If the business has set it up, it can put you through to the business owner; otherwise it takes a message. It can delete the recording and transcript of your call if you ask.
• We pass what you tell the agent to the business you rang. That is the whole point of the service.
• We keep transcripts for a limited time, not forever, and the call audio sits with our voice provider for 90 days, a period we set, and is then deleted.
• Some of the technology behind Giday sits overseas, mostly in the United States. Your phone number, what you said, the recording and the transcript go through those services.
• If you are unhappy with how we handled your information, tell us. If we do not fix it, you can take it to the Office of the Australian Information Commissioner.

The rest of this page explains all of that properly. Where this page and our Data Handling, Retention and Sub-processors statement give different periods for the same thing, the one more favourable to you applies (as in every document in the pack) and we will correct the other document.

1. Who you are dealing with

There are two organisations involved in a Giday call, and it matters which is which.

The client is the business you rang. The plumber, the clinic, the real estate agency. They decide what their agent says, what is in their price list, what gets booked, and what happens to the messages we take. Their own privacy practices are their own.

Launchr Pty Ltd builds and runs the Giday platform for that business. We are a Queensland company with two directors and no other staff. We hold the transcripts, the messages and the booking records on our systems, our voice provider holds the call audio, and we hand the message to the client.

So both of us hold information about you, and you can ask either of us about it. This policy covers what Launchr does. It does not cover what the business you rang does with the message once they have it.

2. Where we stand on the Privacy Act

We would rather be straight with you about this than sound clever.

The Privacy Act 1988 (Cth) does not cover every business. Under section 6D, a business with an annual turnover of $3 million or less is generally outside it, unless one of several exceptions applies. Launchr is under that threshold today. Whether one of the exceptions catches us is genuinely arguable, because we handle information about callers on behalf of other businesses, and Australian law has not settled how that is treated.

We are not going to hide behind an unresolved argument.

We handle personal information as if the Australian Privacy Principles applied to us in full, and we give you the rights set out in this policy whether or not the Act compels us to. We are also a two-person company and we are not going to claim we are perfectly compliant with anything. Where we fall short of a standard, this policy and the Data Handling statement say so.

Some laws apply to us regardless of our size, and we take them seriously:

• the Telecommunications (Interception and Access) Act 1979 (Cth) and the listening devices and surveillance devices laws of each State and Territory, which govern recording a phone call;
• the Spam Act 2003 (Cth), which governs text messages;
• the Australian Consumer Law; and
• the statutory right to sue for a serious invasion of privacy, which came into force on 10 June 2025.

Nothing in this policy limits your rights under the Australian Consumer Law.

3. If you rang a business and got our AI receptionist

3.1 What we collect during a call

• Your phone number, as presented by the phone network, and the time, date and length of the call.
• Your name, if you give it.
• What you say. The agent asks what you need. Whatever you tell it becomes part of the message.
• The call audio, as a recording held by our voice provider.
• A transcript of the call, made automatically from the audio, and a short written summary of what you wanted.
• Booking or job details, if the agent books something: the address, the time, what the job is.
• The figure the agent quoted, if it quoted one.
• Your email address, only if you give it.

We collect this because it is the only way to take a message, book a job, or quote from a price list. If you do not want to give it, you can ask the agent to put you through to the business (where the business has set that up), or hang up and contact them another way.

We do not ask for and do not want your card details, bank details, Medicare number, tax file number, licence number or passwords. Please do not read them out. If one ends up in a transcript by accident, tell us and we will remove it.

3.2 Recording, and the announcement

Every call the receptionist answers starts with a spoken greeting, before any audio is captured and stored, and the recording notice is inside it. The greeting is spoken in the receptionist's own voice. Each business chooses its wording, but every greeting must tell the caller the call is recorded. The standard greeting, for example, is: "Giday, you've reached [the business] — [the receptionist] speaking, on a recorded line. How can I help you?" If a caller asks whether they are speaking to a person, the agent says plainly that it is the business's virtual receptionist and never claims otherwise.

The notice plays on every call the receptionist answers, for every business, and it cannot be switched off. There is no setting for it and nobody here can turn it off for you. In New South Wales, South Australia, Western Australia, Tasmania and the Australian Capital Territory, that notice is how consent to record a call is obtained — so a call without one would leave neither the business nor us with consent to record it.

Being straight about what that notice does and does not do:

• it names the business and tells you the call is on a recorded line;
• it does not use the word "transcribed" — the call is transcribed, and that is why we say so here;
• it does not offer you a route to continue the call without being recorded.

If you would rather not be recorded, tell the agent. It will not argue. It will delete the recording and the transcript of that call, and either take your message another way or, where the business has set it up, put you through to the business. Deletion happens within an hour of the call ending. Being exact: the purge runs on an hourly sweep, so if the call is still being processed at our voice provider when the sweep runs, it goes on the next one instead. The agent cannot stop a recording part-way through a call, so the recording of that call exists until it is deleted.

3.3 The agent is an AI

It is not a person, and if you ask, it says so plainly and never claims otherwise. Where the business has set it up, it can transfer you to the business owner. It is set up not to give legal, medical, financial or safety advice, and to pass you to a person instead, by a transfer or a message for a call-back. If it ever does say something like that, it was not meant to and you should not rely on it — tell us and we will fix it. Any price it reads out is an estimate from the business's own price list, not a binding quote. There is no setting that changes that.

3.4 Sensitive things people mention

People sometimes tell a receptionist things that are sensitive: an injury, a health condition, a family situation. We do not need that detail, and the agent is instructed not to ask for it. If you have already said something you would rather was not on the record, tell the agent, or contact us at the address in section 14, and we will remove it.

3.5 Text messages

We send SMS in the client's name, not ours. Two kinds:

• Messages about your job: a booking confirmation, a reminder an hour before the booking (if the business has switched reminders on), a change of time, a cancellation. These follow on from the call you made and are not marketing.
• Follow-ups about a quote: only if you clearly said yes to that on the call. That consent is recorded, and every one of those messages identifies the business, gives you a way to contact them, and tells you how to stop.

Reply STOP and we stop sending marketing messages, and we suppress your number for that business. Our messages come from an ordinary Australian mobile number, so the reply actually reaches us. We also pass the opt-out to the business: we tell the business you opted out, and honouring it in its own systems is the business's own legal obligation. If it keeps messaging you after that, tell us — and you can also complain to the ACMA at acma.gov.au.

Once you opt out, automatic factual texts about a job, such as a booking confirmation or a reminder, stop too.

3.6 How long we keep it

This table says what we do today, including where a period is not yet enforced automatically. We would rather publish that than publish a promise the system does not keep.

When a business stops using Giday, your call recordings, transcripts and messages are deleted 7 days after its service ends, from our systems and from our voice provider's; its bookings and quotes go 90 days after. At the end of those periods we delete the records or strip them of anything that identifies you. Our client may keep their own copy for longer, under their own policy.

3.7 Getting a call deleted, or getting a copy

You can ask us to delete the records of your call.

• The fastest way is to say so on the call. The agent will action it, and the recording and transcript are purged within an hour of you hanging up.
• Otherwise, email hello@giday.com.au with the number you rang from, roughly when you called, and who you rang. We will confirm it is really you, usually by contacting you on the number the call came from, then delete the recording, the transcript and our record of the call. Email requests are handled by hand today, so allow up to 10 business days, and we will email you when it is done.

Deleted records are gone from our operational backups within a further 35 days.

Honest limits:

• The business you rang has its own copy. Anything the agent already passed to them — a message, a booking, a quote — is their record. We will pass your request on to them, tell you who they are so you can ask them too, and let them know you asked us.
• If a booking has already been made, deleting the call does not cancel the job. Contact the business for that.
• We keep a minimal record of the request itself, so we can show we honoured it.
• We may need to keep a minimal record where the law requires it, or where the information is genuinely needed for a legal claim or a complaint that is already on foot. If that happens we will tell you what we kept and why.

You can also ask for a copy of what we hold about your call, and ask us to correct it if it is wrong. See section 10.

4. If you are a business using Giday

4.1 What we collect from you

Your business name and ABN, your contact name, email and phone number, your plan, your dashboard login, your settings, your support messages, and logs of who changed what and when. At sign-up we also ask whether your business provides a health service, and we keep your answer — section 4.4 explains what it changes. Sign-up happens in short steps; what you have typed on completed steps is kept as an unfinished sign-up for up to 7 days — section 4.8.

Card details go straight to Stripe through their hosted checkout page. We never see or hold your full card number.

4.2 Your price list and your website content

You can import content so the agent knows your business: services, prices, hours, policies, answers to common questions.

That import is for business content only. Do not load in customer lists, past job records, or anything containing other people's personal information. You will not knowingly do it and you will take reasonable care to check; if some gets in, tell us or we will find it, and we will remove it.

When you point us at your website, we read that address and a few of its usual pages (such as services, about, pricing, FAQ and contact), we obey the site's robots.txt, and we check whether the address looks like it belongs to your business. If it does not, we hold the draft for a person here to look at before it can go anywhere near your agent. Nothing read from a website reaches your live agent until you have read it and saved it yourself.

When you connect a job system such as ServiceM8, Giday pushes jobs out to it and does not pull your customer records in.

4.3 What is on you

You are the business your customers are actually ringing. You are responsible for the accuracy of your price list and your business information, for telling your customers what you do with their details, and for meeting your own privacy obligations, which may be heavier than ours — for example if you fall under the anti-money-laundering rules.

We are responsible for running the platform properly, applying your settings as you set them, and keeping a record of the figure your agent actually quoted on each call.

4.4 Health and medical clients: restricted mode

We do accept health-service clients — medical, dental, allied health, physiotherapy, chiropractic, podiatry, psychology and counselling, aged care, disability care, pharmacy, veterinary, and anything else where callers ring about their health — and we serve them under tighter limits than anyone else.

A business that provides a health service and holds health information is covered by the Privacy Act 1988 (Cth) at any size — section 6D does not exempt it — and in Victoria the Health Records Act 2001 has no small-business exemption at all. Those obligations are the practice's and stay the practice's; nothing in this policy moves them to us. What we can do is build the receptionist so that she holds as little health information as a phone service possibly can. That is what restricted mode is.

If you answer yes to the health question at sign-up, your agent runs in restricted mode from her first call, and you are shown this list before you finish:

• She does not discuss symptoms, conditions, diagnoses, medications, results, treatments or therapies — not to describe, confirm, guess at or repeat back. If a caller starts to explain what is wrong, she lets them finish, says she is not the right person for the clinical side, and gets them to the practice.
• Clinical detail is never written down, with one exception: an emergency alert (4.5) passes on what the caller said, so the practice can act. Otherwise a message about a health matter records only that the caller would like a call back, with their name and number, and whether they said it was urgent. A booking records the practice's own appointment type, never a symptom. You ring them and hear it from them.
• She gives no health advice of any kind, including whether something can wait or whether someone should come in. She says plainly that she is not qualified if asked.
• No audio and no transcript; we keep a call-log entry and the call-back message. For restricted clients the call audio is not recorded at the voice provider, and the provider's transcript is scheduled for deletion rather than retained. We do not publish this as a compliance claim; it is a description of the setting we use.
• Ordinary reception works normally — appointments, hours, location, fees, cancellations and rescheduling.

If you answer "not sure", you are signed up as an ordinary client. You know what your business is better than we do, and we do not put a professional into a mode they did not ask for. You can tell us at any time that your business is a health service and we will switch the profile on.

What restricted mode does not change. A booking is still a name, a time and a phone number, and the law may treat that as health information; we hold booking and message records, and the call-log entry, exactly as we do for every client (section 3.6). The recorded notice at the start of every call still plays and still cannot be switched off. We have not taken legal advice on the health sector; we have written down exactly what the receptionist does and does not do, and if the rules or the advice change we will change her with them and tell you.

4.5 Emergencies in restricted mode

A receptionist in restricted mode has one further instruction that outranks all others. If a caller describes anything that sounds like danger to life or limb, she stops what she is doing and — by default — tells them immediately and plainly to hang up and ring triple zero (000), ends the call so their line is free, and sends the account holder a text at once with the caller's number and what they said. The practice may instead choose, at signup or on its settings page, that she first puts them through to the practice's nominated emergency number (telling them to ring 000 if that rings out), or first says one or two sentences the practice wrote (then tells them to ring 000); in every case the text to the account holder is sent. She does not ring 000 for them and never says or implies that she has, or that help is on the way. She does not assess how serious the situation is: she is instructed to err heavily towards saying it. An ordinary Giday receptionist is not given this instruction — she does not end a call for anything other than its normal conclusion — and Giday is not an emergency service for any client (Terms, section 3.5).

4.6 When a free trial ends: the repeat-trial record

The free trial is genuinely free — no card charged, and nothing charged if you do nothing. That only works if it is

one per business, so when a trial ends we keep a small record to stop the same person taking it

again and again.

What we keep is a one-way fingerprint, not your details. We take the email address, the mobile

number and the IP address the trial used, and run each through a one-way cryptographic function

with a secret key that is never stored alongside the result. What is left cannot be turned back

into your email address, your number or your address — not by us, and not by anyone who obtained

the file. It can only be compared against a future sign-up to see whether it is the same.

What it is for, and nothing else. Deciding whether a new sign-up is entitled to another free

trial. It is never used for marketing, never used to build a profile, never sold, never shared,

and never combined with anything else.

It never stops you becoming a customer. If you have had a trial before, you can still become a customer on a paid plan from day one. We tell you that plainly on the

screen, with how to reach us to set it up, rather than silently refusing you, and there is a way to reach a human if we have got it

wrong.

A shared address is not a shared person. IP addresses in Australia are routinely shared by

whole suburbs of mobile users, by offices, and by caravan parks. So a matching IP alone never

blocks anyone; it is only ever a flag for a human to look at. Only a matching email or mobile

stops a second free trial.

How long: 24 months from the day the trial ended, then deleted.

4.7 Emails about new features

If you tick the box at sign-up, we will email you when we add something to Giday, and occasionally

about things we think are genuinely useful to your business. The box is not ticked for you.

Every one of those emails identifies us, and every one has a working unsubscribe link that we

action immediately. Unsubscribing from feature emails never affects the emails you need — booking

notifications, billing, and anything about your service still reach you, because those are not

marketing.

If you had a trial and left, you are on that list only if you ticked the box. We may also send a

single email a couple of weeks later asking whether we can do anything better. If you would rather

not hear from us at all, one reply saying so is enough and we will action it.

4.8 Unfinished sign-ups

The sign-up form is a series of short steps. Each time you complete a step, what you typed on the steps so far is kept in your browser tab and a copy is saved on our side, so you can pick up where you left off and so we can see where people get stuck. That copy holds what you typed into the form fields — your business name, trade, area, website address, your notes about your business, receptionist name and voice, hours, quoting and after-hours choices, your state, numbers and email — and, if you used the practice chat on the sign-up page, the last few messages of that chat. It never holds the acknowledgement boxes, your answer to the health question, or your card details, and we do not record your IP address or browser against it.

It is deleted the moment you finish signing up, and otherwise deleted automatically 7 days after your last step. We do not email, text or ring you about an unfinished sign-up, and it is never used for marketing. If you want it gone sooner, email hello@giday.com.au with the business name you typed and we will delete it the same business day.

4.9 If you ask us to ring you back

Our website has a box where you can leave your name, your phone number and, if you like, your business name, and ask us to ring you back to set Giday up. We use those details only to ring you about Giday. We do not add you to a mailing list.

They reach us as an email (sent through Resend to our own Gmail mailbox) and, between 7am and 9pm Brisbane time, as a text message to the two of us who run Giday (sent through Twilio); both are listed in section 5. The website itself keeps no copy, only a count of how many requests were made. To have your details deleted, contact us at the address in section 14.

5. Who we share information with, and where they are

We do not sell personal information, and we do not use it for our own marketing. (One narrow exception, described fully in section 12: if you arrive at our website from one of our ads, we measure that arrival ourselves so we can audit what the ad platforms charge us — and if that ad click becomes a signup, we report the signup back to the platform that ran the ad, in the small hashed form section 12 spells out. All of it is about how a new client reached our website — it never touches your Giday service data, your callers, or their calls.)

We pass a caller's details to the business they rang. That is the service, and it is why you rang them.

To make the platform work, we use these suppliers. Most of them are in the United States. The Data Handling, Retention and Sub-processors statement describes each one in more detail.

We also disclose personal information where the law requires it, for example a court order or a lawful request from a regulator or the police, and where it is needed to deal with a serious threat to someone's life, health or safety.

We do not use call recordings or transcripts to train any model of our own. We have not audited each supplier's own model-training terms, so we do not make a claim on their behalf; where a supplier offers a setting that stops it using customer data for its own training, we intend to turn it on, and the Data Handling statement records where we have confirmed it.

6. Sending information overseas

Be clear on what this means. Call audio, transcripts, caller phone numbers and message content leave Australia. They are processed in the United States and on Cloudflare's global network.

We do not claim your information stays in Australia, because it does not.

We take reasonable steps to make sure our overseas suppliers handle it to Australian standards, through their contract terms, their security and privacy commitments, and the settings we choose. We treat ourselves as accountable for what they do with it. If one of them mishandles your information, come to us. We are not going to point at a supplier and call it your problem.

7. Automated decisions

The Giday agent is automated. During a call it decides, without a person involved, what to say, what to write down, whether to offer a time in the diary, and what price to read from the client's price list.

That is not the end of the process. A person at the business you rang sees the message or the booking and can change it or ring you back. If you would rather deal with a human from the start, say so and the agent will transfer you, where the business has set that up, or take a message for someone to call you.

8. How we keep it safe

• Transcripts and records are encrypted in transit. At rest they rely on the encryption our storage platform applies by default; we do not add a second layer of our own and we do not operate per-client encryption keys.
• Integration credentials and API keys you give us are encrypted by us before they are stored, and decrypted only at the moment they are used.
• Each client's data is separated by tenant, and every read of call content is scoped to a single client.
• Access to production call data is limited to the two directors of Launchr Pty Ltd. We do not employ a support team and we do not give contractors access to production call data.
• We look at a client's call content only when we need to for a support request, a fault, a legal request, a deletion request, or a security investigation.
• We delete transcripts once the retention period is up, so there is less sitting around to lose.
• We do not hold ISO 27001 certification, a SOC 2 report or an independent penetration test report, and we do not describe our platform as "bank-grade" or anything similar.

No system is perfect, and we are not going to pretend otherwise. What we can promise is that we do not keep more than we need, for longer than we need.

9. If there is a data breach

If personal information we hold is lost, accessed without authorisation, or disclosed when it should not have been, this is what happens.

1. We contain it first, then work out exactly what was affected.
2. We assess whether it is likely to cause serious harm. We aim to finish that assessment within 30 days, and faster where recordings, transcripts or health information are involved.
3. We tell the affected client businesses within 48 hours of forming a reasonable suspicion, so they can meet their own obligations. They will only ever know if we tell them, so we tell them.
4. We notify the Office of the Australian Information Commissioner and the affected individuals, including callers, not just our clients. The notice says who we are, what happened, what kinds of information were involved, and what we suggest you do about it.
5. If health information collected in Victoria or New South Wales is involved, we also follow the State obligations that attach to it.

We do not rely on any exemption when deciding whether to tell people their information has been exposed. We will do steps 3 and 4 whether or not we are legally required to. It is a short conversation and it is the right one.

10. Getting a copy, and fixing mistakes

Ask us and we will give you a copy of the personal information we hold about you, and correct it if it is wrong. This applies to callers as well as to our clients.

Email hello@giday.com.au. We will confirm who you are first, and we aim to respond within 30 days, usually within 5 business days. It is free. If we cannot give you something, for example because it would reveal information about somebody else, we will tell you why in writing.

11. Complaints, and the OAIC

Step one: tell us. Email hello@giday.com.au, or write to us at the address in section 14. Tell us what happened and what you want done. We will acknowledge it within 5 business days and give you an answer within 30 days.

Step two: the OAIC. If we do not respond, or you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner.

• Web: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

The OAIC normally expects you to raise it with us first and give us 30 days.

Health information. If your complaint is about health information, you may also be able to complain to a State or Territory health complaints body, such as the Health Complaints Commissioner in Victoria or the Information and Privacy Commission in New South Wales.

Text messages and calls. Complaints about spam or telemarketing can also go to the Australian Communications and Media Authority at acma.gov.au.

12. Our website

On giday.com.au we use what is needed to keep the site working and to keep a login session, plus the advertising measurement described in this section. We run one third-party advertising pixel, Meta's, on the public pages of the site, and one visit counter, Cloudflare Web Analytics, on every page. There is no Google tag. You can block cookies in your browser; the site still works, but you will not be able to stay signed in to a dashboard.

There are three pieces of third-party code on giday.com.au. The first is not advertising or measurement: ElevenLabs' voice-widget code, loaded from a public code CDN (unpkg.com). It appears in exactly two places, and in both it loads only if you choose to start a chat — never on page load, and never if you don't press the button. The first is Chat with Verity on our home page, so you can talk to the agent before you buy. The second is Test your receptionist inside the client dashboard, so a signed-in client can talk to their own agent. If you press either one, ElevenLabs and the CDN can see that request, including your IP address and browser type, and ElevenLabs receives what you say in the chat. ElevenLabs is already the sub-processor that runs our calls and is listed as such in the Data Handling statement. The widget does not load at all unless you press the button. The second is Cloudflare Web Analytics, a visit counter, described next. The third is Meta's pixel, described after that. Both of those load with the page.

Cloudflare Web Analytics. Cloudflare is the company whose network serves this site, and it is listed as a sub-processor in the Data Handling statement. It adds a small counting script of its own to every page of giday.com.au, the dashboard and its login page included. We use it to know how many real visitors the site gets, which pages they read, which site sent them, which country they are in, and how quickly pages load. When a page loads, the script reports to Cloudflare, through our own domain: the address of the page, the page you came from, your browser and device type, and page-speed timings. Cloudflare works out the country from your connection. It sets no cookie and stores nothing in your browser, and Cloudflare states that it does not fingerprint individuals. So it counts visits; it does not recognise you from one visit to the next, and it is not used for advertising. It has nothing to do with callers or calls. It was switched on by a Cloudflare default rather than by a decision of ours, and it was already running when we found it on 13 October 2026; earlier versions of this policy said we used no third-party analytics, which was wrong for as long as it ran. An ad-blocker stops it, and the site works exactly the same without it.

Meta's pixel. Since 3 October 2026 the public pages of giday.com.au — the home page, the pages you can browse from it including this one, and the sign-up page — load a small piece of code from Meta Platforms (the company behind Facebook and Instagram). We use it for one reason: so the ads we pay Meta for can be shown to people likely to want Giday, and so we can stop paying for the ones that are not working. When one of those pages loads, your browser tells Meta directly: the address of the page, the page you came from, your IP address and browser type, and a cookie Meta's code sets on our site (_fbp, and _fbc if you arrived from a Meta ad) that lets Meta recognise the same browser again and, if you are logged in to Facebook or Instagram, connect the visit to your account. On the sign-up page it also tells Meta two further things: that you interacted with the page rather than just loading it, and that you completed the first step of the form. It does not send what you type. Your business name, email address, phone numbers and everything else you enter stay with us unless you finish signing up after arriving from a Meta ad, in which case the report described below applies. This happens for every visitor to those pages, whether or not you came from an ad and whether or not you sign up. The pixel is not on the client dashboard, the page you see after checkout, or any client's booking page, and it has nothing to do with callers or calls. Meta receives this as an independent company under its own privacy policy, processed in the United States. You can stop it by blocking third-party scripts or cookies in your browser — the site works without it — and you can control how Meta uses activity from other websites in your Facebook or Instagram ad settings.

If you arrive from one of our ads, we measure that ourselves. We said we would name any measurement here before turning it on, so here it is. When a visit arrives carrying an ad-click reference or a paid-campaign tag in the link (for example Google's gclid, Meta's fbclid, or a link we have marked as paid), we record — on our own infrastructure, nobody else's — that reference, the page you landed on, the time, and the technical details of the request: IP address, network, rough location and browser type. A small first-party script confirms the page really loaded in a browser. We use this for exactly two things: auditing what the ad platforms bill us against what actually happened (click fraud is real, and we check for it), and knowing which ad brought us a new client. We do not use it to profile you, we do not sell or share it with data brokers, and this record of ours is made by our own code, separately from Meta's pixel. The IP address and browser details are deleted within 90 days; the rest of the click record is kept no longer than 14 months. A first-party cookie (gd_clk) ties your arrival to a signup if you make one — blocking it costs you nothing except our ability to know which ad worked.

When an ad click becomes a signup, we now tell the platform that ran the ad — and only then. Version 1.3 promised to describe that report here before we started sending it; this is that description. If you arrive from a Meta ad and go on to sign up, we also report that to Meta from our server to theirs, in addition to what the pixel sends. There are at most two such reports about you, at two moments: one when you submit the signup form, and one when you complete sign-up by saving your card — the second is how Meta learns the ad produced a client, not just a form-fill. Both carry the same, and only the following: the email address and mobile number you gave at signup, hashed before they leave us (a one-way fingerprint, not the address or number itself); the click reference Meta itself attached to the link you clicked; the page you landed on and the time; and the IP address and browser type of the signup request. Meta uses this to match the signup to the ad, so we can see which ads actually produce clients, stop paying for the ones that don't, and audit what we are billed. What never goes in these reports: anything about callers or calls, transcripts, or your business content. Visitors who do not sign up are never the subject of one of these server reports; what Meta's pixel sends about a visit is described above. We now do the same for Google, through Google's server-side API — as version 1.4 said we would, before any Google ad spend begins. There is only one Google report, and it is sent at the second of those two moments: when you complete sign-up by saving your card. Nothing is sent to Google when you merely submit the form. The Google report is smaller than the Meta one: it carries only the click reference Google itself attached to the link you clicked, the time your trial started, the identifiers of our own ad account that tell Google which report this belongs to, and two consent flags. Those flags record our assessment that consent applies for Australian traffic under Australian law. They are not a signal collected from you — we do not ask you for one, and we send Google nothing about you for them to govern. It does not include your email address or mobile number in any form, hashed or otherwise. There is no Google tag on the site either, and there never will be. The Data Handling statement lists both platforms, with the detail, in its section 3.5. If we add more measurement than this section describes, we will name it here before we turn it on. We did not manage that with the pixel, as the note at the top of this policy explains.

13. Changes to this policy

We update this page when what we do changes. The version number and date are at the top. If we make a change that materially affects how we handle personal information, we will email our clients at least 30 days beforehand and publish a short summary of what changed. We will not apply a change backwards.

14. Contact us

Launchr Pty Ltd (ABN 46 696 518 206), trading as Giday

Privacy enquiries: hello@giday.com.au

Post: Level 1/63-73 Ann St, Surry Hills NSW 2010

Phone: (02) 7501 0101

Version history

What changed in 1.24, 25 October 2026: section 2 now names the federal Telecommunications (Interception and Access) Act 1979 (Cth) beside the state and territory laws that govern recording a call. Section 11 gives the OAIC's postal address as GPO Box 5288, Sydney NSW 2001 (it said 5218). The greeting is described as each business's own wording, which must tell the caller the call is recorded, with the standard greeting as an example. Nothing new is collected and nothing is kept longer.

What changed in 1.23, 24 October 2026: section 3.6 now says what happens to your records when a business stops using Giday — call records, transcripts, messages and the text log are deleted 7 days after its service ends, and bookings and quotes 90 days after, as the Terms and the Data Handling statement already said. It also states restricted mode the same way everywhere: no audio and no transcript; we keep a call-log entry and the call-back message (3.6, 4.4). The notice is described in the greeting's own words, "on a recorded line". Nothing new is collected and nothing is kept longer.

What changed in 1.22: once you opt out, a booking confirmation from a business's online booking page stops too, like every other automatic text.

What changed in 1.21: a business that has switched reminders on now sends you a reminder text an hour before your booking; it is a message about your job, not marketing, and replying STOP stops it.

What changed in 1.20: corrections so this document matches the service; nothing new is collected and nothing is kept longer. Section 5 now lists Google, whose Gmail service holds the Giday team's own mailbox: sign-up details, texts sent to our platform number and some forwarded enquiries reach us there. We used it before this version and should have listed it. The recording notice is described as playing on every call the receptionist answers (the short version and 3.2): a line whose service has ended plays a short message instead and records nothing. Section 3.5 now says plainly that we tell the business you opted out, and that honouring it in its own systems is the business's own legal obligation; it used to say the business had agreed with us to honour it, which is not an agreement we have. A cross-reference in 4.4 now points to the retention table in 3.6. 4.4 now says plainly that an emergency alert (4.5) passes on what the caller said — the one exception to clinical detail never being written down.

What changed in 1.19: clarifications so this document matches the service; where two documents give different periods, the one more favourable to you now applies here too, the same rule as the Terms; nothing new is collected and nothing about how long we keep it has changed. The receptionist can put you through to the business only where the business has set that up; otherwise it takes a message (the short version, 3.1, 3.2, 3.3 and 7). The emergency instruction for receptionists in restricted mode now has its own heading, section 4.5; there was no section 4.5 before.

What changed in 1.18: new section 4.9, for when you leave your name and number on our website and ask us to ring you back. Nothing else has changed.

What changed in 1.17: section 12 now describes Cloudflare Web Analytics, a visit counter that Cloudflare, the company whose network serves this site, adds to every page. Earlier versions said we used no third-party analytics. That was wrong for as long as the counter ran: it was switched on by a Cloudflare default, not by a decision of ours, and we found it on 13 October 2026. It sets no cookie, stores nothing in your browser and is not used for advertising.

What changed in 1.16: corrections so this document matches the service. Call audio is held by our voice provider for 90 days, a period we set, and not at all for a health practice in restricted mode (section 5). When you point us at your website we read that address and a few of its usual pages, not only one page (section 4). An unfinished sign-up also holds your website address, your notes about your business and the last few messages of the practice chat (section 4.8). The second advertising report is sent when you complete sign-up by saving your card (section 12). Nothing new is collected.

What changed in 1.15: a practice in restricted mode may now choose how a life-or-limb call is handled — the 000 instruction stays the default, or the caller is first put through to the practice's nominated emergency number, or first told the practice's own words; the text to the account holder is sent in every case.

What changed in 1.14: in restricted mode a call-back message may now carry one word on urgency, and a booking carries the practice's own appointment type; clinical detail is still never written down.

What changed in 1.13: version 1.12 described Level 1/63-73 Ann St, Surry Hills NSW 2010 as our registered office. It is our postal address for privacy requests; our registered office has not changed. Nothing else about how we handle your information has changed.

What changed in 1.11: we now run Meta's advertising pixel on the public pages of giday.com.au, and section 12 describes it. This is a real change, not a correction to wording, and we got the order wrong: version 1.5 promised to name any new measurement here before turning it on, and the pixel was switched on on 3 October 2026, before this version was published. For that period this policy said there was no pixel when there was one. There is a second thing we should say plainly. Meta's "automatic advanced matching" — a setting that lets Meta's own code read what is typed into a form, convert it to a one-way fingerprint and send it to Meta — was switched on by default on our account when the pixel went live, with email, phone number, name and date of birth among the fields it covers. We did not choose it, we were not using it, and we did not notice it until 5 October 2026, when we switched it off. Section 12 describes the pixel as it behaves now that it is off. If you typed into our sign-up form between 3 and 5 October 2026, a fingerprint of what you typed may have reached Meta during that window. Nothing changed about how we handle callers, calls or client data.

What changed in 1.10: the greeting quoted in this document now matches the greeting the line actually speaks. Launchr amended the wording on 2 October 2026 and it reads “Giday, you’ve reached [your business] — [your receptionist] speaking, on a recorded line. How can I help you?”. This is a correction to a quotation, not a change to your rights or ours: the recording notice is in the same place, inside the greeting, spoken in your receptionist’s own voice on every call before any audio is captured, and it still cannot be switched off.

What changed in 1.9: the emergency instruction in section 4.4 — hang up and ring 000, end the call, text the account holder — now applies to receptionists in restricted mode only. An ordinary receptionist is not given it.

What changed in 1.8: the sign-up form is now a series of short steps, and what you type on each completed step is saved on our side as an unfinished sign-up for 7 days so you can pick up where you left off and so we can see where people get stuck — section 4.8. It is deleted when you finish or after 7 days, and we do not contact you about it.

What changed in 1.7: we now accept health and medical clients, in a restricted mode described in section 4.4 — the agent is instructed not to hear, say or keep anything clinical, and call audio is not recorded at the voice provider for those clients. "Not sure" at the health question is treated as an ordinary signup. Every agent now tells a caller in danger to ring 000, ends the call and texts the account holder.

What changed in 1.6: two new things, both described here before they start. First, when a free trial ends we now keep a one-way fingerprint of the email address, mobile number and IP address it used, so the same person cannot take the free trial over and over — see section 4.6. It is never used for marketing and never shared. Second, if you tick the box at sign-up we will email you when we add features, and you can unsubscribe from any of those emails — see section 4.7. Nothing changed about how we handle caller data.