Who we are and what this covers
We are an Australian company in Parramatta. This covers everything we do with personal information — the website, the product, and the calls your customers make.
This policy is issued by Lead Genie Au (ABN 65 600 477 271), trading as LeadGenie, of Suite 106, Level 1, 93 George Street, Parramatta NSW 2150 (“LeadGenie“, “we“, “us“).
It explains how we collect, hold, use and disclose personal information, and applies to:
- getleadgenie.com.au and any other website we operate;
- the LeadGenie platform, including the AI receptionist, conversational AI, CRM, messaging, automations, reviews and payments features;
- phone calls, emails, messages and meetings with us;
- personal information of individuals who interact with our customers through the platform.
“Personal information” has the meaning given in the Privacy Act 1988 (Cth) — information or an opinion about an identified individual, or an individual who is reasonably identifiable.
The exemption we are not relying on
Section 6D of the Privacy Act exempts most businesses with an annual turnover of A$3 million or less. We do not claim that exemption. We have chosen to handle personal information in accordance with the Act and the 13 Australian Privacy Principles as though we were bound by them, and to be held to this policy accordingly.
What we collect and how
Mostly what you type into a form or tell us on the phone. Some of it — logs, IP addresses — is collected automatically because that is how software works.
We do not collect sensitive information as defined in the Privacy Act — health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and the rest — and we require our customers not to store it in the platform either. See
clause 08 of the security page.
Where it is reasonable and practicable to do so, we collect personal information directly from the individual it relates to, in accordance with APP 3.6. Where the law requires an identifier we cannot practically collect — such as a tax file number — we do not collect it at all rather than collecting it “just in case”.
You can deal with us anonymously or by pseudonym where it is lawful and practicable, in accordance with APP 2 — for instance, asking a general question about pricing. It stops being practicable the moment you want us to ring you back or set up an account.
Calls, recordings and AI conversations
If you ring a business using our AI, it takes your name and number, and the call may be recorded — you are told at the start if it is. Ask it whether it is an AI and it will tell you.
This clause is for people in group B — you contacted a business, not us.
What is collected on a call
Typically your name, phone number, email address if you give one, the suburb or address the job relates to, what you are enquiring about, and any details you volunteer. The agent asks for what the business needs to quote or book the work, and reads contact details back to confirm them.
Recording
Where the business has enabled call recording, you are told at the beginning of the call, before your details are taken, and you can decline and still be helped. A transcript of the conversation is generated whether or not the call is recorded. Recording is governed by the Telecommunications (Interception and Access) Act 1979 (Cth) and state and territory surveillance devices legislation; our default configuration gives notice on every recorded call.
You are told it is an AI
Our agents disclose that they are artificial intelligence whenever asked, in any form, and chat conversations carry a persistent AI label. You can ask for a human at any point and the request is passed on immediately. This is set out in full in the
AI Disclosure statement.
Who ends up with it
The business you rang. We hold and process it for them. If you want it deleted, see
clause 09 — you can come to us and we will act, but the business is the one whose record it is.
Why we use it
To run the service, bill you, support you, keep it secure and meet our legal obligations. Not to profile you, and not to sell to you on someone else’s behalf.
We use personal information for the following purposes:
- providing, operating and maintaining the platform and the services you have engaged us for;
- setting you up — building your agent’s scripts, loading your pricing and service areas, connecting your calendar;
- responding to enquiries, providing support and resolving faults;
- billing, collecting payment and maintaining financial records;
- sending service communications — outages, changes, security notices, billing. These are not marketing and cannot be unsubscribed from while you hold an account;
- marketing our own products to our own customers and to people who have opted in, always with a working unsubscribe;
- improving the service, including through aggregated de-identified metrics;
- security, fraud prevention, investigating misuse and enforcing our Terms of Service;
- complying with Australian law, and responding to lawful requests from courts and regulators.
Where we use personal information for a secondary purpose, it will be a purpose you would reasonably expect and related to the primary purpose, consistent with APP 6. We do not sell personal information. We do not disclose it to third parties for their own marketing.
Who we give it to
Only the suppliers that make the product work, plus anyone the law compels us to tell. Never to data brokers, never for someone else’s advertising.
We disclose personal information to:
- Service providers who operate parts of the platform — cloud infrastructure and platform hosting, telephony and SMS carriers, AI and speech processing, email delivery, and payment processing. Each receives only what its function requires and is contractually bound to use it only on our instructions. They are described by function rather than named here; specific identities are available for a procurement or due diligence process on request.
- The LeadGenie customer whose business you contacted, where you are in group B.
- Professional advisers — accountants, lawyers, auditors — under obligations of confidentiality.
- Law enforcement, courts and regulators, where required or authorised by Australian law, or under a warrant, subpoena or court order.
- A purchaser, if we sell or restructure the business, on terms requiring equivalent protection.
We do not disclose personal information to data brokers, list vendors, advertising networks for profiling, or any party who wants it for their own marketing purposes.
Sending it overseas
Your data is stored on servers in the United States. We are telling you plainly because it matters and because most companies bury it.
The platform infrastructure on which our services run is located in the United States. Personal information you or your customers provide is stored and processed there, and is accessible from outside Australia by the providers who operate that infrastructure and the specialist services described in clause 05.
This is a cross-border disclosure under Australian Privacy Principle 8. Accordingly:
- We disclose the location, here and on the Data, Security & Privacy page, rather than leaving you to infer it.
- We have taken reasonable steps, including contractual data protection terms with our providers, to ensure overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles.
- We remain accountable to you for that handling. Hosting offshore does not shift our responsibility to a company you have no relationship with.
You should be aware that information held in the United States is subject to United States law, under which US authorities may in defined circumstances compel access. No contractual term removes that, and it applies to the great majority of business software hosted there.
If Australian data residency is a requirement for your business, tell us before you sign up so we can tell you honestly whether we can meet it.
AI and automated decisions
Our AI takes messages and books appointments. It does not decide anything about you that affects your rights — it cannot approve you, refuse you, price you differently or score you.
Personal information is processed by artificial intelligence in the course of delivering the service: speech is converted to text, replies are generated, and enquiries are categorised. The
AI Disclosure & Responsible AI statement sets out where AI is and is not used.
Substantially automated decisions
From 10 December 2026, APP 1 as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth) requires an APP entity to disclose in its privacy policy where it uses personal information in decisions made, or substantially made, by a computer program, where those decisions could reasonably be expected to significantly affect an individual’s rights or interests.
Our position, stated in advance of that date: we do not make such decisions. Our AI agents capture information, qualify enquiries and offer available appointment times. They do not decide whether an individual receives a service, set an individual’s price by reference to personal characteristics, assess creditworthiness, or rank one individual against another. No decision they make significantly affects an individual’s rights or interests.
If that changes, this clause will be updated and the change disclosed before the capability is released. Where a LeadGenie customer builds their own automations on top of the platform that do make such decisions, that is their automated decision-making and the disclosure obligation is theirs.
Cookies, analytics and marketing
The website uses cookies to work and to count visits. Marketing emails only go to people who asked for them, and every one has an unsubscribe link that works.
Cookies
We use cookies and similar technologies that are strictly necessary for the site to function, and analytics cookies to understand which pages are useful. Analytics data is used in aggregate; we do not use it to build an individual profile of you. You can block or delete cookies in your browser — blocking strictly necessary ones may break parts of the site.
The reviews widget
The reviews widget our customers install on their own websites sets no cookies, runs no advertising pixels, and does not track visitors.
Marketing
We send marketing only to our own customers and to people who have opted in. Every marketing message identifies us, includes a functional unsubscribe, and honours the unsubscribe promptly — as required by the Spam Act 2003 (Cth). Any telephone marketing complies with the Do Not Call Register Act 2006 (Cth).
Unsubscribing from marketing does not unsubscribe you from service communications about an account you still hold — outages, security notices and invoices will continue, and that is not a consent you can withdraw while remaining a customer.
Contact-form submissions are used to answer the enquiry. They are not added to a marketing list.
Your data versus your customers' data
If you are our customer: your customers’ details are yours, and you are the one responsible to them for it. We hold it for you and do what you tell us with it.
Two roles operate at once, and it matters which one applies:
- Where we act for ourselves. In handling your account, billing and support information, we determine the purpose and we are responsible to you under this policy.
- Where we act for you. In holding your customers’ personal information in your CRM, recordings and message history, we process it on your instructions to deliver the service. As between us, that information is yours, and your relationship with those individuals is yours.
What that means for a member of the public
If you contacted a business that uses LeadGenie and you want your details accessed, corrected or deleted, you can approach either the business or us. If you come to us, we will act on it — we will not send you away on a technicality. Where the record is the business’s, we act in consultation with them and will tell you plainly if there is a reason we cannot delete something.
What that means for our customers
You need your own privacy policy, covering your collection of your customers’ information, that discloses that enquiries may be answered by an AI assistant and that calls may be recorded. You are responsible for having a lawful basis to contact the people you load into the platform. If you are not sure what yours needs to cover, ask us during onboarding — we will tell you plainly, but we are not lawyers and cannot draft it for you. Lead Genie Au will also give you what you need to meet your own obligations if there is ever a breach.
Keeping it safe, and how long we keep it
Encrypted, access-controlled, backed up. Recordings 12 months, financial records 7 years, everything else while you are a customer.
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, consistent with
APP 11.1. The controls are described in detail on the
Data, Security & Privacy page and include encryption in transit and at rest, role-based and logged access, multi-factor authentication, external penetration testing and continuous vulnerability scanning.
Retention periods are set out in the table at
clause 07 of that page and form part of this policy. In summary: call recordings 12 months by default; financial records 7 years; operational records for the life of the account; de-identified aggregate metrics indefinitely.
Where personal information is no longer needed for any purpose for which it may be used or disclosed, and we are not required by law or a court order to keep it, we take reasonable steps to destroy or de-identify it, consistent with APP 11.2.
If something goes wrong
We comply with the
Notifiable Data Breaches scheme in Part IIIC of the
Privacy Act. Where a breach is likely to result in serious harm, we notify affected individuals and the Office of the Australian Information Commissioner as the scheme requires, and we notify affected customers without undue delay — including where we do not yet know the full extent. The commitments are set out at
clause 09 of the security page.
Your rights, and how to use them
You can ask what we hold, ask us to fix it, ask us to delete it, and opt out of marketing. It is free, and we answer within 30 days.
You may:
- Ask what we hold about you and get a copy — APP 12. Free. We respond within 30 days. If we refuse, we tell you why in writing and how to challenge it.
- Ask us to correct it if it is wrong, out of date, incomplete or misleading — APP 13. Free. If we disagree, you can require us to attach a statement noting that you consider it inaccurate.
- Ask us to delete it, where we are not required to keep it. We will tell you plainly if a legal obligation prevents deletion, and which one.
- Opt out of marketing at any time, via the unsubscribe link or by asking us.
- Deal with us anonymously or by pseudonym where lawful and practicable — APP 2.
- Complain, and escalate to the OAIC if we do not resolve it. See clause 12.
How to make a request
Email
[email protected] with
“Privacy” in the subject line, or call
0435 095 231. Tell us what you want — a copy, a correction, deletion, or to opt out — and if you contacted a business rather than us, roughly when and which one.
We acknowledge, and ask for anything we need to identify you or find the record. We keep this proportionate — we will not demand a passport scan to delete a phone number.
We act. Access requests get the information. Corrections are made and, where we have already passed the wrong information on, we tell whoever received it. Deletions are done, or we tell you which legal obligation prevents it.
If we refuse something, we say so in writing, with reasons, and tell you how to complain. We do not refuse by silence.
We may need to verify your identity before acting, particularly for deletion — proportionately, and without demanding documents we do not need. We will not charge you to make a request. If producing a large volume of material involves significant work, we may charge a reasonable cost-based fee for supplying it, and will tell you the amount before doing anything. You never have to explain why you want your information.
Complaints, and changes to this policy
Complain to us first and we will answer within 30 days. If you are still not happy, the OAIC is free and independent, and we will not hold it against you.
Complaints
If you think we have mishandled your personal information or breached the Australian Privacy Principles, email
[email protected] with “Privacy complaint” in the subject line, or write to us at Suite 106, Level 1, 93 George Street, Parramatta NSW 2150. We acknowledge within 5 business days and give you a written response within 30 days.
If you are not satisfied, you may complain to the Office of the Australian Information Commissioner — oaic.gov.au, 1300 363 992, GPO Box 5218, Sydney NSW 2001. It is free, it is independent of us, and using it will not affect your account or your dealings with us in any way.
Changes
We may update this policy. The version number and effective date at the top of the page change every time we do. Where a change materially affects how we handle personal information, we will tell customers directly by email rather than relying on you noticing a new date. Continuing to use the service after a change takes effect means the updated policy applies.
Superseded versions are kept and available on request. A privacy policy that can be silently rewritten is not a commitment.
