Privacy Policy

Chime Labs Holdings Pty Ltd (ABN 16 687 595 133 / ACN 687 595 133) ("Chime Labs", "we", "us", "our") respects your right to privacy and is committed to handling personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, hold, and disclose personal information in connection with:

• our website at https://chimelabs.ai ("Website"); and
• our AI voice receptionist and back-office automation platform at https://platform.chimelabs.ai ("Platform" or "Service").

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not.

If you have questions about this policy, contact us at info@chimelabs.ai.

This policy applies to:

(a) Customers — businesses and individuals who subscribe to the Service.

(b) Authorised Users — employees, contractors, or other individuals who access the Service under a customer's account.

(c) Callers — individuals who call a business that uses Chime Labs as its AI receptionist. If you have called a business that uses our Service, your call may have been answered, recorded, and transcribed by our AI. The business you called is responsible for notifying you of this at the time of the call. This policy explains how we handle that information.

(d) Website visitors — individuals who visit https://chimelabs.ai.

3.1 From customers and authorised users:

• Name, email address, phone number, and business details provided at sign-up
• Billing information (processed by Stripe — we do not store full card details)
• Account settings, preferences, and configuration data
• Communications with our support team
• Usage data and log data from the Platform

3.2 From callers (via the Service):

When a caller contacts a business that uses Chime Labs, we may collect:

• The caller's phone number and call metadata (time, duration, call direction)
• Audio recordings of the call
• Transcripts of the call generated by our AI
• Information the caller provides during the call (name, address, job details, enquiry type)
• Survey responses or follow-up engagement data, where applicable

The business you called is the primary controller of this information. We process it on their behalf to deliver the Service.

3.3 From website visitors:

• Browser type, operating system, referring URL, and pages visited (collected automatically via cookies and analytics tools)
• Information submitted via contact forms or enquiry forms

We collect personal information:

• directly from you when you sign up, use the Platform, or contact us;
• automatically when you use the Website or Platform (via cookies, log files, and analytics);
• from callers when they call a business that uses our Service; and
• from third parties, including integrated job-management and calendar platforms you authorise us to connect with.

By providing personal information to us, you consent to its collection and use in accordance with this policy.

5.1 To deliver the Service. We use personal information to:

• operate the AI voice receptionist and answer calls on behalf of our customers;
• record, transcribe, and analyse calls;
• create and manage job bookings and calendar entries in integrated platforms;
• process payments and issue Tax Invoices;
• provide customer support; and
• send service-related communications (including billing notices and product updates).

5.2 To improve the Service and train AI models. We use personal information — including call recordings, transcripts, and usage data — to improve the Service, develop new features, and train and improve the AI models used in the Service. This may include identifiable personal information. See clause 10 for your opt-out rights.

5.3 For outbound calling features. Where you have enabled outbound calling features, we process contact data to facilitate those calls in accordance with your instructions and applicable telemarketing laws, including the Do Not Call Register Act 2006 (Cth).

5.4 For legal and compliance purposes. We may use or disclose personal information to comply with a legal obligation, respond to a court order or subpoena, or cooperate with a law enforcement request.

5.5 For business transfers. If Chime Labs is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected individuals as required by law.

6.1 The Service records and transcribes inbound and, where enabled, outbound phone calls made to or by businesses that use Chime Labs.

6.2 Customers (the businesses using our Service) are responsible for:

• ensuring they have a lawful basis to record calls under applicable Australian state and territory surveillance and listening devices legislation (including the Surveillance Devices Act 2004 (Cth) and equivalent state laws);
• notifying callers that their call is being recorded and may be transcribed and processed by an AI system; and
• obtaining any consent required by the Privacy Act 1988 (Cth) or applicable state law.

6.3 Chime Labs provides the recording and transcription tooling. We are not responsible for a customer's failure to comply with their notification or consent obligations.

6.4 Call recordings and transcripts are stored on infrastructure hosted in Australia (Google Cloud Platform, australia-southeast1 region) and are accessible to the relevant customer via the Platform dashboard.

We may disclose personal information to:

(a) Sub-processors engaged to help us deliver the Service (see clause 8 for the full list);

(b) Integrated Platforms that you have authorised us to connect with, including ServiceM8, Simpro, ServiceTitan, AroFlo, Fergus, Acuity, Jobber, and Google Calendar;

(c) Professional advisers including lawyers, accountants, and insurers, where necessary;

(d) Regulators and law enforcement where required by law; and

(e) Successors in connection with a business transfer as described in clause 5.5.

We do not sell personal information to third parties.

We engage the following sub-processors to deliver the Service. Some are located outside Australia. Under APP 8, we take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.

Overseas disclosure notice (APP 8): Personal information — including call recordings and transcripts — may be transferred to and processed in the United States by the sub-processors listed above. We take reasonable steps to ensure these providers handle personal information in a manner consistent with the APPs, including through data processing agreements. However, you acknowledge that we may not always be able to ensure that an overseas recipient complies with the APPs, and that in such cases APP 8.1 may not apply to us.

We retain personal information for as long as necessary to deliver the Service and meet our legal obligations. Our standard retention periods are:

• Account and billing data: retained for 7 years after account closure (to meet tax and financial record-keeping obligations)
• Call recordings and transcripts: retained for 12 months after the call, unless you configure a shorter period in your account settings or request earlier deletion
• Usage and log data: retained for 12 months on a rolling basis

After the applicable retention period, personal information is securely deleted or de-identified. You may request earlier deletion by contacting us at info@chimelabs.ai (subject to our legal obligations to retain certain records).

10.1 As described in clause 5.2, we may use personal information — including call recordings and transcripts — to train and improve our AI models. This use may involve identifiable data.

10.2 If you are a customer and do not want your data used for AI model training, you may opt out at any time by emailing info@chimelabs.ai with the subject line "Data training opt-out". We will action your opt-out within 30 days. Opting out does not affect our ability to use your data to deliver the Service.

10.3 Data already incorporated into trained models prior to your opt-out cannot be removed from those models, but we will cease using new data from your account for training purposes from the date your opt-out is actioned.

10.4 Our AI sub-processors (OpenAI and Google) process data submitted via their APIs in accordance with their own terms. Our agreements with these providers require that data submitted via their APIs is not used by those providers to train their own foundation models. We will notify you of any material change to this position that we become aware of.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
• access controls and role-based permissions;
• infrastructure hosted with reputable cloud providers that maintain their own security programmes and controls; and
• data processing agreements with all sub-processors.

The transmission of information over the internet is not completely secure. While we take reasonable precautions, we cannot guarantee the security of information transmitted to or from the Service.

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If we become aware of an eligible data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• notify the Office of the Australian Information Commissioner (OAIC); and
• notify affected individuals (or customers, where the breach involves caller data) as soon as practicable.

If you believe a data breach has occurred, contact us immediately at info@chimelabs.ai.

You have the right to:

(a) Access personal information we hold about you. Submit a request to info@chimelabs.ai. We will respond within 30 days. We may charge a reasonable fee for access requests that require significant effort.

(b) Correct personal information that is inaccurate, out of date, incomplete, or misleading. Contact us at info@chimelabs.ai.

(c) Complain about a breach of the APPs. See clause 15.

(d) Opt out of AI training as described in clause 10.

(e) Request deletion of your personal information, subject to our legal obligations to retain certain records (see clause 9).

If you are an individual located in the European Union or United Kingdom, you may also have rights under the GDPR or UK GDPR, including rights of access, rectification, erasure, restriction, portability, and objection. Contact us at info@chimelabs.ai to exercise these rights.

When you visit https://chimelabs.ai, we may collect information such as browser type, operating system, pages visited, and referring URL using cookies and analytics tools (including Google Analytics).

You may disable cookies through your browser settings. Disabling cookies may affect your ability to use certain features of the Website.

We may use cookies to serve relevant advertising through third-party services. You can opt out of interest-based advertising through your browser or device settings.

If you have a complaint about how we have handled your personal information, please contact us at info@chimelabs.ai. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

We may update this Privacy Policy from time to time. Where changes are material — particularly changes that affect how we collect, use, or disclose personal information — we will notify customers by email at least 30 days before the changes take effect. The updated policy will be published at https://chimelabs.ai/privacy-policy with a revised "Last updated" date.

For privacy-related enquiries, access requests, corrections, or complaints:

• Email: info@chimelabs.ai
• Support: support@chimelabs.ai
• Registered office: available on request (ABN 16 687 595 133 / ACN 687 595 133)
• Website: https://chimelabs.ai