Privacy Policy

1. Who we are

Oviflow ("Oviflow", "we", "us") provides an AI phone receptionist service for small businesses in Australia. This policy explains what personal information we collect, why, and how it's handled — both for business owners who sign up for Oviflow, and for the customers who call an Oviflow-powered phone number.

2. Information we collect

From business owners (account holders):name, email address, phone number, business details you provide during setup (services, hours, pricing, FAQs, and any industry-specific information), payment details (processed by Stripe — we don't store card numbers ourselves), and any files you upload (e.g. menu photos).

From callers (your customers):when someone calls an Oviflow-powered number, we may collect their phone number, a recording and transcript of the call, and a summary generated by our AI (including any details they choose to share, such as their name or what they're calling about).

3. How we use your information

• To operate the AI receptionist — answering calls, understanding requests, and booking appointments where enabled.
• To send you (the business owner) call summaries and notifications by email and/or SMS.
• To send callers a confirmation text, but only if they gave verbal consent during the call.
• To process payments and manage your subscription.
• To improve the reliability and accuracy of the service.
• To comply with legal obligations, including Australian telecommunications and privacy law.

4. Third-party services we use

Oviflow is built on top of several third-party providers, each of which processes data on our behalf under their own security and privacy terms:

• Vapi — voice AI platform that answers calls, and stores call recordings/transcripts.
• Anthropic (Claude) — powers the AI's understanding and responses.
• Twilio — phone numbers, call routing, and SMS delivery.
• Google — Calendar (for appointment booking) and Business Profile (for optional setup auto-fill), only when you explicitly connect them.
• Stripe — payment processing and billing.
• Supabase — our database and account authentication.
• Resend — transactional email delivery.

5. Call recording

Calls to an Oviflow-powered number may be recorded and transcribed to provide the service and generate summaries for the business owner. Business owners are responsible for ensuring their use of call recording complies with applicable law in their jurisdiction, including any requirement to notify callers that a call may be recorded.

6. Data retention

We retain call recordings, transcripts, and account data for as long as your account is active, or as needed to provide the service and meet legal obligations. You can request deletion of your account and associated data at any time by contacting us.

7. Your rights

Depending on your location, you may have rights to access, correct, or delete your personal information, or to object to certain uses of it. To exercise any of these rights, contact us using the details below.

8. Security

We use industry-standard measures to protect your data, including encryption in transit and restricted access to production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do. Continued use of Oviflow after a change means you accept the updated policy.

10. Contact us

Questions about this policy or your data? Email us at privacy@oviflow.io.