Privacy Policy
Last updated: February 26, 2026
1. Introduction
Speako Pty Ltd (ABN 39 682 800 371) ("Speako", "we", "us", or "our") is committed to protecting your privacy and handling personal information in accordance with applicable privacy and data protection laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Depending on where Subscribers and End Users are located and the nature of the interaction with the Service, additional laws and regulatory frameworks may apply (for example, GDPR/UK GDPR, CCPA/CPRA, or Canadian privacy laws).
This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use the Speako.ai service ("Service"), visit our website, or interact with us in any way. It applies to:
- Subscribers: Businesses and individuals who register for and use the Service
- End Users: People who interact with AI voice agents powered by the Service (e.g., callers to a business that uses Speako)
- Website visitors: Anyone who visits our website
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.
2. Information We Collect
2.1 Account and Business Information
When you register for the Service, we collect:
- Name, email address, and phone number
- Business name, type, address, and contact details
- Team member information (names and emails of invited users)
- Business operating details (hours, services, staff, menus)
- Account preferences and configuration settings
2.2 Payment Information
Payment processing is handled by Stripe. We do not store your full credit card or debit card details on our servers. Stripe may collect and process your payment card number, expiration date, and billing address. We receive and store a limited set of payment information from Stripe, including the last four digits of your card, card type, and billing history.
2.3 Voice and Call Data
When End Users interact with AI voice agents through the Service, we collect:
- Voice recordings of calls
- Transcripts generated from voice conversations
- Call metadata (duration, timestamp, caller phone number)
- AI agent tool interactions (e.g., availability checks, booking actions)
See Section 5 for detailed information about voice recording practices.
2.4 End User (Caller) Data
When End Users call a business using Speako, we may collect:
- Phone number (provided by the telephone network)
- Name and contact details (if provided during the call)
- Booking details (date, time, party size, service type)
- Communication preferences
2.5 Technical and Usage Data
We automatically collect certain information when you use the Service or visit our website:
- IP address, browser type, and device information
- Operating system and language preferences
- Pages visited, features used, and actions taken within the dashboard
- Error logs and performance data
- Referral URLs and search terms
2.6 Cookies and Tracking Technologies
We use cookies and similar technologies to collect information about your interactions with our website and Service. For full details, please see our Cookie Policy.
3. Legal Basis for Processing
We process personal information in accordance with the Australian Privacy Principles. Our legal bases for processing include:
- Contractual necessity: Processing required to provide the Service to you under our Terms of Use (e.g., managing your Account, processing payments, delivering voice AI functionality).
- Consent: Where you have given us explicit consent to process your information for a specific purpose (e.g., marketing communications). You may withdraw consent at any time.
- Legitimate interests: Processing necessary for our legitimate business interests, provided those interests are not overridden by your privacy rights (e.g., improving the Service, preventing fraud, ensuring security).
- Legal obligation: Processing required to comply with applicable laws, regulations, or legal proceedings (e.g., tax record keeping, responding to lawful requests from authorities).
Where GDPR (or similar laws) applies, the legal bases described above are intended to align with applicable lawful bases (including under GDPR Article 6).
4. How We Use Your Information
We use the information we collect for the following purposes:
- Service delivery: Providing, maintaining, and operating the Service, including AI voice agent functionality, booking management, and SMS notifications
- Billing and payments: Processing subscriptions, minute package purchases, invoices, and payment-related communications
- Account management: Managing your Account, authenticating users, and enforcing access controls
- Communication: Sending you service-related notices, updates, security alerts, and support messages
- Improvement: Analysing usage patterns to improve, develop, and optimise the Service, its features, and user experience
- Security: Detecting, preventing, and addressing fraud, abuse, security incidents, and technical issues
- Legal compliance: Complying with applicable laws, regulations, legal processes, and government requests
- Support: Responding to your enquiries, requests, and providing customer support
AI model training: Speako does not use Customer Data (including voice recordings or transcripts) to train publicly available or general-purpose AI models. We use third-party AI providers via API-based services under contractual data protection obligations. Where available, we seek to contractually restrict Subprocessors from using Customer Data to train their publicly available or general-purpose models.
5. Voice Recording and Call Data
Given the nature of our Service, voice recording and call data require special attention. This section provides detailed information about our practices.
5.1 What Is Recorded
When an End User calls a business that uses Speako, the voice conversation between the End User and the AI voice agent may be recorded. This includes the audio of the conversation and an automatically generated text transcript.
5.2 Consent and Disclosure
Subscriber responsibilities: As a Subscriber, you are the data controller for Customer Data processed through your AI voice agent. You are responsible for:
- Ensuring callers are informed that they are speaking with an AI agent (where required by applicable law)
- Ensuring callers are informed that the call may be recorded (where required by applicable law)
- Obtaining any necessary consents for call recording under the laws of your jurisdiction and the caller's jurisdiction
- Complying with all applicable telecommunications and privacy laws
Speako provides configurable greeting messages that can include AI and recording disclosures. When voice recording retention is enabled, Speako requires that the Subscriber's Initial Greeting, Return Customer Greeting, and After Hours Message each include a recording disclosure. Speako's system validates that the recording disclosure adequately informs callers that the call may be recorded.
5.3 Storage and Security
Voice recordings and transcripts are stored using cloud storage and access controls designed to protect confidentiality. Access to recordings is restricted to the Subscriber whose AI agent handled the call and to authorised Speako personnel for support and operational purposes.
5.4 Retention of Voice Data
Subscribers can enable or disable voice recording retention through their dashboard settings. When enabled, voice recordings are retained for 90 days from the date of the call by default, up to a maximum of 180 days if configured by the Subscriber, after which they are automatically deleted. Subscribers may request earlier deletion at any time. When disabled, call audio is processed in real-time for the AI conversation but is not stored after the call ends. Transcripts and call metadata may be retained for the duration of the Subscriber's Account (see Section 9). We may retain aggregated and/or de-identified analytics for service improvement.
5.5 AI Processing of Voice Data
During a live call, voice audio is streamed in real-time to our AI provider (ElevenLabs) for processing and response generation. Audio is also processed by Twilio for telephony routing. Speako does not use voice recordings to train AI models. Please refer to our third-party providers' privacy policies for information about their data handling practices (see Section 6).
5.6 Biometric Information
The Service is not designed to perform and Speako does not perform biometric identification, voiceprint identification, or voiceprint recognition to uniquely identify an individual. You must not use the Service to collect, capture, store, or process biometric identifiers or biometric information (including voiceprints) for identification or authentication purposes.
6. Data Sharing and Sub-processors
We share personal information with the following categories of third parties for the purposes described below. We do not sell your personal information.
| Provider | Purpose | Data Shared |
|---|---|---|
| Twilio | Telephony, phone numbers, SMS delivery | Call audio, phone numbers, SMS content |
| ElevenLabs | Conversational AI voice processing | Call audio streams, agent configuration |
| OpenAI | Natural language processing | Text data for NLP tasks |
| Stripe | Payment processing | Payment details, billing information |
| Clerk | Authentication and user management | Email, name, authentication data |
| SendGrid | Transactional email delivery | Email addresses, email content |
| Cloudflare R2 | File and media storage | Voice recordings, documents, files |
| Google Analytics | Website analytics | Usage data, IP address (anonymised) |
We may also share information: (a) with your consent; (b) to comply with legal obligations; (c) to protect our rights, privacy, safety, or property; (d) in connection with a merger, acquisition, or sale of assets (in which case your information will remain subject to this Privacy Policy).
We will provide reasonable advance notice of material changes to our sub-processors that materially affect the processing of personal information (typically at least 30 days before a change takes effect), via email or notice on the Service.
7. International Data Transfers
Speako is based in Australia, but your information may be transferred to and processed in countries other than Australia, including the United States, where our third-party service providers operate. These countries may have data protection laws that differ from the laws of your country.
In accordance with APP 8 (cross-border disclosure of personal information), we take reasonable steps to ensure that overseas recipients handle your personal information in accordance with the Australian Privacy Principles. This includes entering into contractual arrangements with our sub-processors that require them to protect personal information to standards comparable to those under Australian law.
For users in the EEA, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses or other safeguards recognised under applicable law.
8. Data Security
We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. These measures may include:
- Encryption of data in transit (TLS/SSL) and, where applicable, encryption at rest
- Access controls and role-based permissions
- Secure authentication via Clerk (including multi-factor authentication options)
- Regular security monitoring and logging
- Secure infrastructure hosted on reputable cloud providers
- Employee and contractor access limited on a need-to-know basis
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.
9. Data Retention
We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specific retention periods include:
- Account data: Retained for the duration of your Account plus 30 days following termination to allow for data export.
- Voice recordings: When voice recording retention is enabled by the Subscriber, recordings are retained for 90 days by default, up to a maximum of 180 days if configured, after which they are automatically deleted. Subscribers may request earlier deletion. When retention is disabled, call audio is not stored.
- Call transcripts and metadata: Retained for the duration of the Subscriber's Account, subject to Subscriber deletion/retention settings where available.
- Booking data: Retained for the duration of the Subscriber's Account.
- Payment and billing records: Retained for 7 years after the transaction to comply with tax and accounting obligations.
- Technical and usage logs: Retained for up to 12 months.
- Marketing consent records: Retained for as long as the consent is active, plus 3 years.
When personal information is no longer required, we will securely delete or anonymise it. Anonymised data that cannot be used to identify individuals may be retained indefinitely for analytics and research purposes.
10. Your Rights
Depending on your location and applicable law, you may have the following rights regarding your personal information:
10.1 Rights Under Australian Privacy Law
Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to:
- Access the personal information we hold about you (APP 12)
- Request correction of inaccurate, out-of-date, or incomplete information (APP 13)
- Complain about a breach of the APPs
10.2 Additional Rights for EEA/UK Users (GDPR)
If you are located in the European Economic Area or the United Kingdom, you additionally have the right to:
- Erasure: Request deletion of your personal information
- Portability: Receive a copy of your data in a structured, commonly used, machine-readable format
- Restriction: Request restriction of processing in certain circumstances
- Objection: Object to processing based on legitimate interests
- Withdraw consent: Withdraw consent at any time where processing is based on consent
10.3 Additional Rights for California Users (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:
- Right to know: Request information about the categories and specific pieces of personal information we have collected
- Right to delete: Request deletion of your personal information
- Right to opt-out: Opt out of the sale or sharing of personal information (note: we do not sell personal information)
- Right to non-discrimination: We will not discriminate against you for exercising your rights
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or the applicable timeframe required by law). We may need to verify your identity before processing your request.
11. Data Breach Notification
In the event of a data breach that is likely to result in serious harm to affected individuals, we will:
- Notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme within the timeframes prescribed by law
- Notify affected individuals as soon as practicable
- For EEA/UK users, notify the relevant supervisory authority within the timeframes required by applicable law (where applicable)
- Notify affected Subscribers so they can fulfil their own notification obligations to End Users
- Take reasonable steps to contain the breach and mitigate potential harm
Breach notifications will include the nature of the breach, the types of information involved, and the steps we are taking in response.
12. Children's Privacy
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child under 16 has provided us with personal information, please contact us at [email protected], and we will take steps to delete such information promptly.
13. Automated Decision Making
The Service uses artificial intelligence to make automated decisions during voice calls, including:
- Checking availability and suggesting appointment times
- Creating, modifying, and cancelling bookings
- Routing calls to human agents when appropriate
- Generating conversational responses based on the Subscriber's knowledge base
These automated decisions are made in the context of the Subscriber's business operations and are subject to the Subscriber's configuration and oversight. Where GDPR applies, individuals in the EEA may have rights under GDPR Article 22 regarding certain decisions based solely on automated processing. If you believe an automated decision has significantly affected you, you may contact the Subscriber (the business you called) or us at [email protected].
14. Data Controller and Processor Roles
Understanding who is responsible for personal information is important:
- Speako as data controller: For personal information of Subscribers and website visitors (Account data, payment data, usage data), Speako is the data controller and determines the purposes and means of processing.
- Speako as data processor: For Customer Data (End User information, voice recordings, booking data collected through a Subscriber's AI agent), Speako acts as a data processor on behalf of the Subscriber. The Subscriber is the data controller for this data and determines the purposes and means of its collection.
Subscribers requiring a formal Data Processing Addendum / Data Processing Agreement (DPA) may contact us at [email protected].
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. When we make changes:
- We will update the "Last updated" date at the top of this page.
- For material changes, we will notify Subscribers via email at least 30 days before the changes take effect.
- Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.
16. Contact Us and Complaints
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Company: Speako Pty Ltd
- Email: [email protected]
- Website: www.speako.ai
Complaints: If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
For users in the EEA/UK, you may also lodge a complaint with your local data protection supervisory authority.
Questions about your data?
We're here to help. Contact our support team anytime.