Whose data it is
Your customer data is yours. We hold it and work on it for you — we don’t own it and we can’t use it for our own purposes.
Two kinds of information move through the platform, and they are governed differently:
- Your customer data. The personal information of people who contact your business — names, phone numbers, addresses, job details, recordings, transcripts. As between you and us, this is yours. We process it on your instructions to provide the service. Under the Privacy Act 1988 (Cth) you are the entity with the primary relationship to those individuals.
- Your account data. Information about you as our customer — business name, contact details, billing information, support history, usage. We handle this as our own, under our Privacy Policy.
We do not sell, rent or licence either category. We do not use your customer data to market to your customers, and we do not share it with other LeadGenie customers, including your competitors.
Where it is physically held
On servers in the United States. Not in Australia. This is the most important fact in this document.
The platform infrastructure on which LeadGenie is delivered is hosted in the United States, on major commercial cloud platforms, across multiple availability zones for redundancy. Data is backed up within that same region. No customer data is held on premises at our Parramatta office, or on staff devices as a system of record.
What that means under Australian privacy law
Storing personal information with an overseas provider is a cross-border disclosure for the purposes of Australian Privacy Principle 8. Accordingly:
- We disclose it, here and in the Privacy Policy, rather than leaving you to infer it.
- We have contractual data protection terms with our infrastructure provider requiring handling consistent with the Australian Privacy Principles.
- We remain accountable to you for that handling. Offshore hosting does not transfer our responsibility to a company you have never heard of.
The part we cannot contract away
Data held in the United States is subject to United States law, including legal processes under which US authorities may in defined circumstances compel access. No contract we sign removes that. It applies to essentially every US-hosted business service, and you should assume it applies to other software you already use.
Lead Genie Au will update this clause and the version number on this page if the hosting location changes. It is not something we would change quietly.
Who we share it with, and why
Only the suppliers needed to make the product work — the platform, the phone network, message delivery, the AI, and the payment processor. Nobody else, and never for their own marketing.
Delivering an AI receptionist requires several specialist suppliers. Each receives only what its function requires, is contractually bound to handle it only on our instructions, and is prohibited from using it for its own purposes:
- Cloud infrastructure and platform provider — hosts the application, database and file storage. Sees everything, because it is where everything lives. United States.
- Telephony and messaging carriers — connect calls and deliver SMS. See phone numbers, call metadata and message content in transit.
- AI and speech processing providers — convert speech to text and generate the agent’s replies. Process conversation content. Contractually prohibited from using it to train their general-purpose models.
- Email delivery provider — sends transactional and marketing email you configure. Sees recipient addresses and message content.
- Payment processor — takes your subscription payment and any customer deposits you collect. PCI DSS compliant. Card numbers go to them, not to us.
We describe these suppliers by function rather than by name on a public page. If you need the specific identities for a procurement, due diligence or tender process, ask and we will provide them directly.
Beyond these, we disclose personal information only: to you and people you authorise; to professional advisers under confidentiality; where required or authorised by Australian law, including a court order or warrant; and to a purchaser as part of a sale of the business, on terms requiring the same protections.
How it is protected, and by whom
Encrypted while moving and while sitting still, with keys held separately, and tested by outsiders once a year.
Data in transit is protected with TLS 1.2 or 1.3 using 2,048-bit keys or stronger. Data at rest is encrypted using AES-256. Account passwords are not stored in recoverable form; they are hashed using industry-standard practice. Encryption keys are managed within a hardened key management system and rotated at intervals determined by the sensitivity of the data they protect. Customer-supplied encryption keys are not currently supported.
Those certifications belong to the infrastructure, not to us.
SOC 2 Type II and ISO/IEC 27001:2022 are held by the platform provider whose infrastructure LeadGenie runs on. Lead Genie Au is not itself SOC 2 or ISO 27001 certified, and we are not going to display those logos and let you assume otherwise.
What it means for you: the storage, network, encryption and physical security layer has been independently audited. Our own layer — how we configure your account, who on our team touches it, how we handle your onboarding documents — is governed by clause 05, not by an external audit. If your procurement requires an audited supplier, we are not it today.
Who at LeadGenie can see your data
A small number of us, only when there is a reason, and it is logged. We do not browse your customer list out of curiosity.
Access to your account by our team is limited to what is needed to set you up, support you and fix faults. Specifically:
- Access is role-based. Staff have the minimum access their job requires, and no standing administrative access to production systems.
- Support access to a customer account is time-limited and logged. Every access is attributable to a named individual.
- Higher-risk actions — exporting contacts, bulk deletion, changing domain or authentication settings — are restricted beyond ordinary support access.
- Access is reviewed periodically and removed on the day someone leaves, not at the end of the month.
- Company devices are encrypted and centrally managed, and access to our systems requires multi-factor authentication.
Where we listen to a recording or read a transcript, it is to resolve a fault, improve your agent’s performance, or respond to something you have raised. It is done on your account, for your benefit.
You also control access at your end: add and remove your own users, set their roles, and require two-factor authentication across your team. The most common weak point in a business of your size is a shared login still held by a departed employee — that one is within your control, not ours.
Backups and getting data back
Backed up daily, and you have 30 days to undelete a contact you removed by accident. Take your own export anyway.
Databases are backed up daily, with seven days of backups retained and point-in-time recovery available. Backups are replicated within the hosting region, monitored for successful completion, and protected by access controls and write-once storage. Infrastructure is distributed across multiple availability zones, so the failure of one does not take the service down.
Disaster recovery is operated by the platform’s engineering teams; it is not a customer-triggered failover. What you can do yourself:
- Restore contacts, opportunities, custom fields, tags, notes and tasks deleted in the last 30 days, from the recycle bin.
- Roll back pages, blog posts and emails to earlier versions.
- Export your data at any time, in full, without asking us.
Our recommendation: take your own export periodically and keep it somewhere you control. Not because we expect to lose it, but because a business whose entire customer list exists in exactly one place — anyone’s place — is carrying a risk it does not need to.
How long we keep things
Recordings 12 months, financial records 7 years, everything else for as long as you are a customer.
The following retention periods form part of this statement.
Where a law requires us to keep something longer than the period above, the law prevails. Where you ask us to delete something we are legally required to hold, we will tell you which obligation prevents it rather than simply declining.
Where personal information is no longer needed for any purpose for which it may be used or disclosed, and we are not required by law or a court order to retain it, we take reasonable steps to destroy or de-identify it, consistent with Australian Privacy Principle 11.2.
What must not be stored in the platform
No card numbers, bank details, Medicare or passport numbers, or medical information. The platform is not built for it.
The platform is designed for sales, service and operational records. It is not a repository for highly sensitive categories of information, and using it that way creates risk for your customers that the system was not built to carry. You must not store in the platform:
- credit or debit card numbers, CVVs or full bank account details;
- government identifiers such as Medicare numbers, passport numbers, driver licence numbers or tax file numbers;
- health or medical information, unless we have specifically agreed the arrangement in writing beforehand;
- any other sensitive information under the Privacy Act 1988 (Cth) that is not necessary for the service you have engaged us to provide.
Payments, specifically
Card payments — your subscription, and any deposits you collect from customers through the platform — are handled by a PCI DSS compliant payment processor. Card numbers are not stored, processed or collected by Lead Genie Au and are not held in the platform database. Neither we nor our technology providers are PCI DSS compliant entities, which is precisely why card data goes to a processor that is.
If an AI agent is told a card number by a caller — it happens — the agent does not capture it into a record and does not read it back. Direct callers to the payment link instead.
If there is a breach
We tell you quickly and in everyday words, including what we don’t know yet — not a carefully lawyered email three weeks later.
Australia’s Notifiable Data Breaches scheme, under Part IIIC of the Privacy Act 1988 (Cth), requires notification of eligible data breaches — those likely to result in serious harm — to affected individuals and to the Office of the Australian Information Commissioner. Our commitments:
- We contain first, then assess. Suspected incidents are assessed promptly, and within 30 days at the outside, as the scheme requires.
- We notify you without undue delay once we establish your data is affected — including where we do not yet know the full extent. You will not learn about it from a news article.
- We tell you what we know: what happened, which categories of information were involved, the likely consequences, and what we are doing about it.
- We help you meet your own obligations. Where the affected information is your customers’, the notification obligation to those individuals may be yours. We give you what you need to discharge it.
- We report to the OAIC where the scheme requires it, and tell you when we have.
If you believe your account has been compromised — a suspicious login, phished credentials, records that have moved without explanation — call
0435 095 231 immediately rather than emailing. Speed matters more than tidiness.
Responsible disclosure
If you are a security researcher and have found a vulnerability, email
[email protected] with “Security disclosure” in the subject line. Report it to us before disclosing publicly and we will work it with you in good faith. We do not currently run a paid bug bounty, and we will not pretend otherwise.
Leaving, and taking your data with you
Export everything whenever you like, including on the way out. We do not hold your customer list hostage to keep you subscribed.
You can export your contacts, conversation history and records at any time during your subscription, without asking us and without a fee. There is no lock-in contract and no exit charge.
On cancellation:
- You keep export access for 30 days after your final billing period ends. We will remind you before that window closes.
- If you ask, we will produce a full export for you rather than making you work out the interface on your way out.
- After the 30-day window your data is scheduled for deletion, other than records we are legally required to retain — financial records for 7 years, and consent and opt-out evidence where needed to demonstrate compliance.
- Phone numbers we have provisioned for you can generally be ported to another provider. Begin that before you cancel, not after.
This statement describes our security and data handling practices. It sits alongside the
Privacy Policy, which sets out your rights under the
Privacy Act 1988 (Cth) and how to exercise them, the
AI Disclosure statement, and the
Terms of Service, which governs the contract between us. It is a description of practice, not a warranty, and it does not limit any rights you have under the Australian Consumer Law.
