Privacy policy

Draft: this privacy policy is being finalised and will be confirmed before Kewbee opens for sign-ups.

Last updated: to be confirmed before launch. This policy was drafted without a lawyer from how the service actually works. It is a careful starting point, not legal advice.

1. About this policy

This policy explains how Kewbee ("we", "us") handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our details: to be confirmed before launch. Privacy contact: to be confirmed before launch.

2. Two roles

Our customers are businesses. When a business uses the service to talk to its own customers, the business decides what to collect and why, and we process that information on its behalf. For that information, please contact the business first. We are directly responsible for the information we collect about the businesses and people who sign up to and use the service itself, such as account holders and staff.

3. What we collect

• Account details: names, email addresses, phone numbers, roles, seat levels and sign-in details, including Google or Apple sign-in identifiers if you use them.
• Service content: call logs, voicemail, text and picture messages, website chats, tickets, notes, tasks, calendar entries, meetings, contacts and files that your organisation and its customers put in.
• Recordings and transcripts: only if your organisation switches recording or transcription on. They are off by default. Voicemail is stored so it can be played back and can be transcribed.
• Technical data: device and app information, IP addresses, security logs, audit logs and the push-notification tokens needed to deliver notifications.
• Payment details: the information needed to invoice you. to be confirmed before launch.

We collect information from you, from the people your organisation invites, from your organisation's customers when they call, text or chat with it, and from the providers you connect.

4. Why we use it (APPs 3, 5, 6)

• To provide, secure, support and improve the service, including delivering calls, messages and notifications.
• To take payment, communicate with account holders and meet legal duties.
• To detect abuse, fraud and security problems.

We do not sell personal information. We do not use your customers' content for advertising, and we do not use it to train outside AI models. We do not send marketing to the customers of the businesses that use the service.

5. Artificial intelligence

Transcripts, summaries, suggestions and assistant answers are produced by AI software that we run on our own servers, so the content is not sent to outside AI services. to be confirmed before launch. AI output can be wrong, so people should check it.

6. Who else handles it (APPs 6, 8)

We use service providers only to run the service. They may handle personal information only to provide their service to us or to you:

• Phone and texting providers that your organisation chooses and connects (for example Twilio, ClickSend, Cellcast or Crazytel). Your agreement with them covers what they hold.
• Push notifications: Google (Firebase Cloud Messaging) and Apple (APNs) deliver notifications to phones. Notification content is kept short.
• Sign-in: Google and Apple, if you choose them to sign in.
• Bot protection: Cloudflare Turnstile on public sign-in and chat forms.
• GIFs: GIPHY, only when the GIF picker is used.
• Email delivery: Mailgun delivers account emails, invitations, password resets and notices. It handles the recipient address and the message content needed to deliver them.
• Hosting and storage: to be confirmed before launch.

If information is sent outside Australia we take reasonable steps to make sure the recipient protects it in line with the APPs. to be confirmed before launch

7. Security and retention (APP 11)

We use access controls, encryption in transit, audit logs and limited staff access, and we scan uploaded files for malware. No system is perfectly secure. We keep information while your organisation has an account. Your organisation can set how long recordings and transcripts are kept. After an account ends we keep information for a period (to be confirmed before launch) so it can be exported, then delete or de-identify it unless the law requires us to keep it longer.

8. Your rights (APPs 12, 13)

You can ask to see or correct personal information we hold about you. If your information is in a business's account, we may refer you to that business, and we will help it to respond. Write to to be confirmed before launch. We aim to reply within 30 days.

9. Complaints

Contact us first and we will investigate and reply. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Data breaches

If an eligible data breach is likely to result in serious harm, we will notify the affected people and the OAIC as the Notifiable Data Breaches scheme requires. For information we process on behalf of a business, we will tell that business promptly so that it can meet its duties.

11. Cookies and tracking

These public pages use no scripts, cookies or analytics. The signed-in app uses only what it needs to keep you signed in and remember your settings, and it does not include advertising trackers.

12. Changes

We will post changes here and tell account owners about material ones.