Privacy Policy

Two groups of people, two different roles

If you signed up for SwitchTasker, we decide why your information is held and we are responsible for it directly. That is your name, your email address, and the record of your sessions.

If you rang, texted or emailed a business that uses SwitchTasker, you did not agree anything with us — you contacted them. That business decides why the conversation happens and what is done with it, and we handle it on their instructions. Your rights over that information are exercised against them, and we will help them answer you. If you are not sure who they are, contact us and we will point you to them.

What we collect from account holders

• Your name and email address, which is also how you sign in.
• Your password, stored only as a bcrypt hash. We never store or log the password itself and cannot read it.
• The IP address and browser of each session, so you can see where your account is signed in and end any session you do not recognise.
• Your company name, industry and timezone.
• A record of significant actions — who changed a setting, who removed a team member. This records the action, never the conversation content it touched.

What we handle on behalf of a business

When someone contacts a business through SwitchTasker, we hold:

• The phone number they called from, or the email address they wrote from, and the subject line.
• Everything said or written on both sides, including what the AI replied.
• A short summary of the conversation, its outcome, and an estimate of the tone, all written afterwards by a language model.
• Any appointment request or enquiry captured during it, which may include a name, phone number, email address and free-text notes.
• A recording of the call, but only if that business has switched recording on. It is off unless they choose it, and when it is on, callers are told before the greeting.

An AI answers, and a language model reads the conversation

Conversations are answered by a language model, not a person, unless a member of the business takes over. To produce each reply, the content of the conversation — and the caller's phone number or email address, and anything the business has stored about them — is sent to OpenAI in the United States. This happens on every turn of every conversation. It is not incidental; it is how the product works, and it is the most significant thing on this page.

Who else receives information

We use the following providers. Several are outside Australia, and information is transferred to them.

We do not sell personal information, and we do not use conversations to advertise to anyone.

Email we send

We only email people who contacted us or hold an account: sign-up verification, password resets, team invitations, and notices about the service. There is no marketing list and no campaign, which is why you will not find an unsubscribe link on an account email — there is nothing to unsubscribe from.

When an AI employee replies to an email or a text, it is replying to a message that was sent to the business first. Texting STOP to a business stops all further texts from it immediately.

How long we keep it

• Account information is kept while the account is open, and removed when it is closed.
• Conversations are kept until the business sets a retention period, after which they are deleted automatically each day. Any call recording is deleted before the record pointing at it.
• Appointment requests and captured enquiries survive the conversation being deleted, because they are a record the business acted on.
• The record of who did what is not deleted, so that a change to an account remains accountable.
• Opt-out records are permanent. If you text STOP, we have to remember that you did, or you would be texted again.

How it is protected

We describe only measures actually in place:

• Passwords are hashed with bcrypt. Resetting a password ends every session on the account.
• Sessions use rotating tokens that you can revoke individually.
• Credentials for a connected calendar or CRM are encrypted at rest with AES-256-GCM.
• Every incoming request from a provider is cryptographically verified against the exact bytes sent.
• Each business's data is separated by an identifier taken from the signed session, never from anything a browser can supply.
• Uploaded files are checked by their actual contents rather than their file name.

We do not currently hold SOC 2 or ISO 27001 certification, and we say so rather than implying otherwise.

Your rights

Under the Privacy Act 1988 (Cth) you may ask for a copy of the personal information we hold about you, ask us to correct it, or complain about how it has been handled. Write to us and we will respond within 30 days. If you are unhappy with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If your information reached us because you contacted a business that uses SwitchTasker, that business answers those requests. Ask us and we will tell you who to approach and pass the request on.

Changes

If we change this policy in a way that materially affects account holders, we will email them before it takes effect. The date at the top always reflects the current version.

Contact