Privacy Policy

Yindi AI Pty Ltd (“Yindi”, “we”, “us”, “our”) provides an AI-powered phone receptionist service to schools and businesses. This policy explains what personal information we collect when our AI assistant answers a call, why we collect it, who we share it with, where it is stored, and how you can access, correct, or complain about the handling of your information.

We handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

Yindi provides its service to client organisations: the schools and businesses whose calls our AI assistant answers. When you call one of those organisations and speak to the Yindi assistant, we collect and handle your information on that organisation’s behalf so the call can be answered, logged, and actioned.

The client organisation decides why it uses our service and what it does with the information afterwards. Yindi is responsible for operating the platform securely and for handling your information as described in this policy. If you want to know how a particular school or business uses information about you beyond what we describe here, contact that organisation directly.

When the Yindi assistant answers a call, we may collect:

• Your phone number and, if you give it, your name
• A recording and/or transcript of the call
• The reason for your call and any details you provide, for example an absence report, an enquiry, a message for staff, or a support request
• The name and details of any other person you mention, such as a student you are reporting absent
• Records of confirmation messages we send by SMS or email at the end of a call

We collect this information directly from you during the call.

Some calls contain sensitive information as defined in the Privacy Act 1988 (Cth). The most common example is health information, such as when a parent explains that a child is absent because they are unwell or have a medical appointment.

We do not seek sensitive information beyond what you choose to tell us. Where it is captured in a call, we treat it as sensitive information: we use it only for the purpose of handling and logging your call, we do not use it for any other purpose, and it is deleted on the same retention schedule as the rest of the call record (see section 8).

Our service is used by schools, so calls frequently include personal information about students who are children. This information is provided to us by the adult who calls (usually a parent or guardian) or by school staff. We do not knowingly collect personal information directly from a child.

We recognise that children’s information requires additional care. We limit our collection to what the calling adult provides for the purpose of the call, we apply the same security and retention controls described in this policy, and we do not use children’s information for any purpose other than handling and logging the call on the school’s behalf. We are monitoring the development of the OAIC’s Children’s Online Privacy Code and will update our practices to align with it.

We use the information we collect to:

• Answer and handle your call on behalf of the client organisation
• Create a record of the call so the client organisation has an accurate log of what was discussed
• Allow you or the client organisation to review what was said on the call if needed
• Send you an SMS or email confirming the outcome of the call, where applicable
• Review a call recording or transcript where necessary to diagnose a fault or check that the assistant is handling calls correctly
• Maintain and secure the service, and meet our legal obligations

We do not sell your personal information. We do not use call recordings or transcripts to train, fine-tune or otherwise develop AI models. Where our staff review a recording or transcript, it is to fix a fault or improve how the assistant handles calls — not to train a model.

At the start of each call, the Yindi assistant tells you that the call is recorded and why. As set out in section 2, we also create a transcript of the call. By continuing with the call after this notice, you consent to the recording and to the handling of your information as described in this policy. If you do not consent, you can end the call and contact the organisation another way.

We share your information with:

• The client organisation you called (the school or business), which receives the call record and any logged details
• Service providers who help us run the platform, listed below
• The IT or telecommunications provider that manages the service for the organisation you called, where that organisation buys Yindi through a reseller. That provider’s authorised staff can access call records for the organisations they manage, under the same confidentiality and security obligations we apply to ourselves.
• Anyone you ask us to, or where we are required or authorised to disclose information by law

We use a range of service providers to deliver the service. We may change the specific providers we use from time to time, but they fall within the categories and countries set out below:

Where the organisation you called has connected its own system — for example a student management system, a job management system, or a calendar — we send the details of your call to that system at that organisation’s direction, using access it has authorised. Those systems are controlled by the organisation you called, not by Yindi. How information is handled once it reaches them is covered by that organisation’s own privacy policy.

If we begin using a provider located in a country not listed above, we will update this policy before doing so.

If a client chooses to connect a Google account so that Yindi can book appointments, we request access to that account's Google Calendar in order to check availability and create appointment events on the calendar the client connects.

Yindi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only access the Google Calendar that the client explicitly connects, and only to read free/busy availability and create or manage appointment events made through Yindi.
• We do not use Google Calendar data for advertising, and we do not sell it.
• We do not use Google Calendar data for any purpose other than providing and improving the appointment-booking feature the client has enabled.
• We do not allow humans to read Google Calendar data except where required for security, to comply with the law, or with the client's explicit consent.
• A client can disconnect their Google Calendar at any time from the Yindi portal, which revokes Yindi's access. Clients can also revoke access from their Google Account permissions page.

Google account credentials (refresh tokens) are stored encrypted and are used solely to maintain the connection the client authorised.

Some of the providers we use to handle your call are located overseas. As set out in the table above, the audio of your call is processed by voice conversation providers in the United States. The transcript and other call content are processed by AI conversation providers in the United States, and may also be processed in the European Union. Our web infrastructure providers are also located in the United States.

Before we begin using an overseas provider, we review the data protection and privacy terms it publishes and how those terms apply to our account, we configure the provider’s data retention settings where it offers them, and we limit the information we send to what the provider needs in order to perform its function. We rely on providers’ published data protection and privacy terms rather than separately negotiated data-processing agreements.

We maintain a current list of the providers we use, showing which of them handle call content and which are located outside Australia. We will provide that list on request.

The platform and database where your call records are stored are hosted on infrastructure located in Australia.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our measures include encryption of data in transit and at rest, encrypted backups, multi-factor authentication on all administrative access, role-based access controls, network firewalling with geographic restrictions, a web application firewall, and audit logging of system activity.

No method of transmission or storage is completely secure, but we work to protect your information and to respond appropriately if a data breach occurs, including meeting our obligations under the Notifiable Data Breaches scheme where it applies.

We retain call recordings and transcripts, and the personal information they contain, for 90 days, after which they are deleted in accordance with our data retention and destruction policy. We may retain information for longer only where we are required to by law or where it is needed to resolve a dispute or complaint.

You can ask us for a copy of the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, or misleading. This applies whether you are a client of Yindi or a member of the public who has called one of our clients.

To make a request, contact us using the details in section 13. We will respond within a reasonable period, normally within 30 days. There is no charge to make a request, though we may charge a reasonable cost for giving access in some cases. If we cannot give you access or make a correction, we will tell you why in writing.

Because we handle much of this information on behalf of client organisations, we may need to direct your request to the relevant school or business, or coordinate with them, to action it.

If you believe we have breached the Australian Privacy Principles or mishandled your personal information, contact our Privacy Officer using the details below. We will acknowledge your complaint, investigate it, and respond to you in writing, normally within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

Reach our Privacy Officer using the details below.

We may update this policy from time to time. The current version is always available at yindi.com.au/privacy, and the effective date at the top of the policy shows when it was last changed.

Changes in this version — 30 August 2026

• Call content is no longer sent to our error-reporting service (21 August 2026).
• A 90-day retention setting has been applied at our voice AI provider.
• Section 5 now discloses that our staff may review a recording or transcript to diagnose a fault or check the assistant’s handling.
• Section 6 now describes the call greeting accurately: it states that the call is recorded.
• Section 7 now discloses that a reseller’s authorised staff can access call records for the organisations they manage.
• Section 7 no longer lists CRM integrations as Yindi service providers; systems a client connects are controlled by that client.
• Section 8 now describes the steps we take before using an overseas provider, and notes that we rely on providers’ published terms.