Privacy Policy

Last updated: 20 April 2026

1. About this policy

This Privacy Policy explains how Allayze Pty Ltd ("Allayze", "we", "us", "our") collects, uses, discloses, and protects personal information when you visit allayze.com.au or use our services.

We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme. If you are in New Zealand, the Privacy Act 2020 also applies. Visitors from the EU and UK are welcome; we do not actively target those markets but we still honour core data rights where applicable.

This policy applies to everyone using the Website and our commercial services. It does not apply to Defence engagements, which are covered by separate agreements with appropriate data-handling controls.

Companion documents:

• Cookie Notice — tracking technologies and your consent choices.
• AI Voice Consultant Notice — how the voice assistant handles data.
• Sub-processors — live list of third parties we share data with.

2. Who we are

Allayze Pty Ltd
ABN: 85 681 486 822 · ACN: 681 486 822
Address: Gold Coast, Australia
Privacy contact: info@allayze.com.au

3. Who this service is for

Our Website and AI tools (AI Voice Consultant and free assessment) are provided for commercial evaluation only. They must not be used to submit classified, OFFICIAL: Sensitive, or Defence-controlled information. You must be 18 or older to use the Service.

4. What we collect

4.1 Information you give us

• Contact form: name, email, phone, company, industry, message.
• Free assessment: name, email, phone, company, industry, job title, country, budget, and project timeline.
• AI Voice Consultant: your spoken input is streamed in real time to Vapi for conversion to text. A written summary is saved to our Notion CRM. See the AI Voice Consultant Notice for full detail. Allayze does not store raw audio recordings.

4.2 Information collected automatically

• Technical data: IP address, browser type, device type, pages visited, referral URL, timestamps.
• Analytics and session data: where you consent via our cookie banner — see the Cookie Notice.

4.3 Sensitive information

We do not intentionally collect sensitive information (as defined by the Privacy Act). If you volunteer any in a form or voice session, we treat it with the same care as other personal information and delete it on request.

5. Why we collect it and the legal basis

6. How we use third-party providers

We use a small set of trusted providers to run the Service. A full, live list is maintained at /sub-processors. Each entry shows the provider's role, the data shared, and a link to their own privacy policy.

As of the date of this policy, our providers are:

• Vapi — real-time voice AI (US). Processes speech-to-text and text-to-speech for the AI Voice Consultant. See vapi.ai/privacy.
• Notion — CRM and record-keeping (US).
• Microsoft 365 — outgoing email and calendar scheduling (Microsoft global data centres).
• Vercel — website hosting (US/global).
• Google Analytics 4 and Google Ads conversion tracking (US) — analytics and ad measurement. Loads only after you accept the Analytics or Marketing categories in our cookie banner.
• Microsoft Clarity (US/global) — session replay and heatmaps. Loads only after you accept Analytics.
• LinkedIn Insight Tag and Meta Pixel (US) — ad retargeting and conversion measurement. Load only after you accept Marketing.

When we introduce a new provider that processes personal data, we update the sub-processor page and the "Last updated" date above.

Under APP 8, Allayze remains accountable for the acts and omissions of these providers in relation to your personal information.

7. International transfers

Most of our providers store or process data outside Australia — primarily in the United States and, for Microsoft services, in various global Microsoft Azure data centres. By using the Service, you acknowledge these transfers.

We protect overseas transfers by:

• Contracting only with providers that offer enterprise-grade data protection terms.
• Relying on recognised data protection frameworks and standard contractual clauses where available.
• Applying the same access controls, encryption, and retention standards across jurisdictions.

8. How long we keep your information

We may retain specific records longer where required by law, to resolve a dispute, or to enforce an agreement. You can request earlier deletion at any time.

9. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Request deletion of your information (subject to legal retention obligations).
• Object to marketing or stop-contact requests.
• Complain about how we have handled your information.

To exercise any of these rights, email info@allayze.com.au. We will respond within a reasonable time, typically within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. New Zealand residents can contact the Office of the Privacy Commissioner at privacy.org.nz.

10. Security

We take reasonable steps to protect your personal information. Our current measures include:

• Multi-factor authentication on all administrator accounts across Notion, Microsoft 365, Vercel, Vapi, and Google.
• Encryption in transit (HTTPS across the Website and all sub-processor integrations).
• Encryption at rest as provided by our sub-processors by default.
• Role-based access control limiting internal access to personal data to those who need it.

No system is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable, as required under the Notifiable Data Breaches scheme.

11. AI-specific disclosures

When you interact with our AI Voice Consultant:

• You are interacting with an AI system, not a human.
• Allayze does not use your inputs, transcripts, or summaries to train AI models.
• Our AI provider (Vapi) processes your inputs under its own terms — see the privacy policy linked on the sub-processors page.
• AI outputs are general information only and should not be treated as professional advice without verification.

12. Children

The Service is not directed to anyone under 18 and we do not knowingly collect information from people under 18. If you believe we have, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent change. For material changes, we will make reasonable efforts to notify you (for example, via a prominent notice on the Website) before the change takes effect.

14. Contact us

For any question, request, or complaint about this policy:

Email: info@allayze.com.au
Post: Allayze Pty Ltd, Gold Coast, Australia