Privacy Policy

1. Who we are

Toby is an AI receptionist for Australian trade businesses. A tradie diverts their unanswered calls to an Australian number we provide. Toby then either answers the phone and talks to the caller, or texts them back — depending on how that tradie's number is set up — has a normal conversation, and books a quote visit, or the job itself, into the tradie's calendar.

Toby is operated by Ashton Sydney Gathercole, trading as Hello Toby (ABN 39 426 072 712), of Queensland, Australia. Written contact: [email protected]. In this policy, "we", "us" and "our" mean that business. You can reach us at [email protected].

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (the APPs).

2. Two groups of people, and who is responsible for what

Almost every privacy question about Toby comes down to telling these two groups apart.

The tradie — our customer

The trade business that subscribes to Toby. We collect their information directly, to set up and run the service and to bill them. We deal with them as our own customer, and this policy applies to that information in the ordinary way.

The tradie's callers — everyone else

The people who ring the tradie, don't get an answer, and end up speaking or texting with Toby. They are not our customers. They rang a plumber, not us. Their information reaches us only because we run the tradie's phone answering for them.

For caller information, the tradie decides what happens: it is their business, their customer relationship and their booking. We handle that information on their behalf, to provide the service to them, and we do not use it for our own purposes — we don't sell it, we don't market to callers, and we don't use one tradie's callers to do anything for another tradie. Each business's data is kept separate.

Both we and the tradie may have obligations under the Privacy Act for the same information. If you are a caller and you want something changed or deleted, you can come to us (see section 10) and we will act, or pass it to the tradie where it is properly their call.

3. What we collect

From the tradie

• Contact details — name, business name, mobile number and email.
• How the business runs — trading hours, breaks, days closed, the suburbs served, the jobs taken and not taken, and how Toby should talk. This is what Toby is set up from.
• The owner's mobile number, so we can text booking, cancellation and reschedule alerts.
• Calendar access, if connected — an authorisation token for Google Calendar (or the details needed for another calendar system), and the busy times we read back from it.
• Billing details, and enough records to invoice and meet tax obligations.

From the tradie's callers

• Mobile number — the number that rang, or that texted.
• Call metadata — that a call came in from that number, at what time, and whether it went unanswered or Toby answered it.
• What was said, as text. Where Toby answers the phone, our telephony provider converts the speech to text and sends us only that text. We never receive the audio, and no recording of the call is made or kept by us. The transcript is then held exactly like the text of an SMS conversation.
• The content of the conversation — everything said or typed, both directions, including anything volunteered that we never asked for.
• Name, as given during the conversation.
• Job description — what needs doing.
• Address or suburb — where the work is.
• Booking details — the day and time of the visit, and the matching entry written into the tradie's calendar.
• Delivery information from the phone network, so we know whether a message actually arrived.
• Opt-out records — if someone replies STOP, we record that number as opted out (see section 7).

We collect only what a booking needs. We never ask a caller for a date of birth, a licence, a bank account or a payment card, and Toby has no way to take a payment. If a caller volunteers something sensitive anyway, it sits in the message log like the rest of the conversation — so please don't put anything in a text that you wouldn't want kept.

4. Why we collect it, and the law behind it

Under APP 3 we only collect personal information that is reasonably necessary for what we do. What we do is book a visit, so we collect what a visit needs: who you are, where the job is, what the job is, and when. Specifically:

• To reply to a missed call and hold the conversation.
• To make, move and cancel bookings, and to keep them from clashing with each other or with the tradie's calendar.
• To tell the tradie what happened — a text for each booking, cancellation and reschedule.
• To remind the customer the day before the visit, so fewer people are stood up.
• To honour opt-outs and meet our obligations under the Spam Act 2003 (Cth).
• To keep the service working, investigate faults, and prevent misuse or fraud.
• To bill the tradie and keep the records the law requires.

Under APP 6 we use and disclose personal information for the purpose it was collected for, and for closely related purposes a person would reasonably expect — or where the law requires it. We do not sell personal information. We do not disclose it to anyone for their own direct marketing. Under APP 5, this policy — together with what Toby says in the conversation — is how we tell callers who has their information and why.

5. Who else sees it

Running a phone and SMS receptionist means other companies necessarily touch the conversation. We describe them by category, because the specific suppliers can change:

• The tradie. Obviously — the whole point is that they get the job. They see the conversation, the booking and the caller's number.
• A telecommunications provider. An Australian carrier or messaging provider supplies the number and carries every call and text in and out. They necessarily process the number and the message content, and keep their own records, as carriers do.
• Speech providers. On a call Toby answers, the caller's speech has to be turned into text and Toby's replies back into speech. Those two services are supplied through our telephony provider, and they process the audio of the call in order to do it. Only the text reaches us.
• An AI model provider. Toby's replies are generated by a large language model run by a third party. The conversation — including the name, job and address in it — is sent to that provider so it can produce the next reply.
• Calendar providers. If the tradie connects Google Calendar or another calendar system, booking details are written into it and held under that provider's own terms.
• Hosting and infrastructure providers, who run the servers and store the database and backups.
• Professional advisers, or a regulator or court, where we are required or permitted by law to disclose.

We choose suppliers on the basis that they handle information only to provide their service to us. We are not going to quote you contract terms we haven't checked line by line — if you want to know exactly who our current providers are, email [email protected] and we will tell you.

6. Information going overseas

Some of the providers above operate outside Australia, or use servers outside Australia. That means personal information handled by Toby may be processed overseas. Under APP 8 we have to take reasonable steps to make sure an overseas recipient handles it consistently with the APPs, and to tell you where it is likely to go. The countries our current providers process information in are China and the United States. Specifically:

• China. The AI model that writes Toby's replies is run by DeepSeek. The conversation — including the name, job and address in it — is sent there so it can produce the next reply. This is the one we most want you to notice: it is ordinary customer conversation, and it is processed outside Australia.
• United States. Anthropic, for the once-a-month review that reads a business's past conversations to improve how Toby talks; and Twilio, the telephony and messaging provider that carries calls and texts in and out and keeps its own records of them, as carriers do — together with the speech services it uses on an answered call, currently Google for speech-to-text and ElevenLabs for the voice you hear. Where a tradie connects Google Calendar, booking details go to Google as well.

If we change to a provider in another country we will update this section before the change takes effect.

7. Text messages, and what STOP does

Every message Toby sends is about a booking — answering a call that was missed, arranging a time, confirming it, or reminding someone about it. We do not send marketing or promotional messages to callers, and tradies are not permitted to use Toby to send them either.

Under the Spam Act 2003 (Cth), anyone can tell us to stop. Reply STOP (or STOPALL or UNSUBSCRIBE) to any message from Toby and:

• the number is recorded as opted out immediately, before anything else happens to the message;
• we send one final message confirming it, and nothing after that;
• a later missed call from that number gets no reply at all — Toby will not start a new conversation with someone who has opted out, and will not make a booking on their behalf that they'd never be told about.

If you opted out and change your mind, reply START and you will be able to use it again.

8. How long we keep it

• Bookings. A booking stays live until the visit has been and gone. Shortly after that it is moved into an archive, kept there for a set period — six months by default — and then permanently deleted.
• Cancellations. When a customer cancels, we keep a permanent record that the booking existed and was cancelled. This is deliberate: it is the record that explains why a job that was in the diary isn't any more, and it is not covered by the deletion above.
• The conversation — what was actually said. We keep the text of the conversation in and out — spoken or typed, on the same timer and in the same place — for two years (730 days) from when each message was sent, received or spoken, and then permanently delete it. Two years is deliberate, not arbitrary — the tradie's monthly self-improvement review compares this winter to last winter, and a shorter window would make that comparison impossible. The count runs from the message, not from the visit — a conversation that never led to a booking is on the same timer as one that did. The two exceptions are below: an opted-out number's messages, and the bare record that a call came in.
• Delivery records. Separately from the words, we keep a log of messages sent and received with the network's delivery result, so a confirmation that never arrived can be told apart from one that did. Truthfully: this log has no automatic deletion timer today — it is kept for the life of the account. We would rather say that than print a number nothing in the system actually enforces.
• The record that a call came in. Separately from the words, we keep a short record that a particular number rang and got an answer — the number, the time, and nothing that was said. We keep this for at least as long as the conversation above, so this record can never be deleted before the words it explains — it is the record that answers someone who says they never contacted us, and it is why we were entitled to text back at all. If the number has opted out, this record is kept indefinitely for the same reason its messages are — see below.
• Opt-outs — kept indefinitely, on purpose. If you reply STOP, the record that you did is the only thing standing between you and being texted again. Deleting it would mean forgetting you ever asked us to stop — so we keep opt-out records for good. The opt-out record itself holds your number and the fact you opted out, and nothing else.
• Messages from a number that has opted out. Being straight with you about a side effect of the above: once a number is opted out, the two-year deletion no longer runs over that number's messages. They are kept so we can show what was said, when you told us to stop, and that we then did. It means the people who exercised this right have their conversation held longer than everyone else's, which is not a comfortable trade — we make it because being unable to prove we honoured a STOP is the worse one. If you would rather that conversation was deleted, ask us (section 15) and we will look at it.
• Tradie account records. Kept while the account is open, and afterwards for as long as we need them for tax, accounting and legal purposes.

Under APP 11.2, when we no longer need information and no law requires us to keep it, we destroy it or de-identify it.

9. Security, and where the data lives

Honestly, in general terms: messages travel over encrypted connections; access to the database and the dashboard is restricted to the people who need it to run the service; each business's data is separated by business; the database is backed up, and backups are treated as carefully as the database itself. The database is deliberately not kept in consumer file-sync folders, which can corrupt it. Data is hosted at Australia — Sydney for website data, Melbourne for the booking service.

No system is perfectly secure, and we're not going to claim otherwise. What we can say is that we don't collect what we don't need, which is the only protection that never fails.

10. Seeing your information, and correcting it

Under APP 12 you can ask for a copy of the personal information we hold about you, and under APP 13 you can ask us to correct it if it's wrong. Email [email protected] and tell us what you're after.

• We'll ask enough to be sure it's really you — usually the mobile number the messages went to.
• We aim to respond within 30 days.
• It's free. If a request is unusually large or repeated we may discuss costs first, and we'll never charge for making a request.
• If we can't give you access, or won't make a correction, we'll tell you why in writing.

You can also ask us to delete information about you. We'll do that where we can — but two things we will not delete are an opt-out record (deleting it would mean texting you again, which is the opposite of what you asked for) and records we're legally required to keep. If your request is really about the tradie's own customer records, we'll tell you and put you in touch with them.

You can deal with Toby anonymously or under a pseudonym where it's lawful and practical, but be aware a booking needs a name and an address to be worth anything to the tradie turning up.

11. Complaints

If you think we've mishandled your personal information, tell us first: [email protected]. We'll acknowledge it, look into it properly, and write back — normally within 30 days.

If you're not happy with how we handle it, you can complain to the Office of the Australian Information Commissioner (the OAIC), which is the regulator for the Privacy Act. Their website is oaic.gov.au, and they can be contacted through the details published there. You don't need our permission to go to them.

12. If something goes wrong

If there's a data breach that is likely to cause serious harm, we'll follow the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act: contain it, assess it, and notify the people affected and the OAIC. Where the breach involves a tradie's callers, we'll tell the tradie as well, because they are the ones those people actually know.

13. This website, the demo, and how we track it

The demo on the home page is a real conversation with the same AI model that answers calls, in a sandbox. Nothing you type there books anything, and no tradie is contacted. But it is not a toy in privacy terms:

• We keep the conversation. What you type is sent to our server and to the AI model provider to generate the reply, and we store the exchange — we use it to see how Toby is handling real questions and to improve it.
• If you leave a mobile number or an email address in the "leave a number" box, we store it and use it to follow you up about Toby — that's what it's for. We don't pass it on to anyone else. If you'd rather we deleted it, email us and we will.
• Please don't type anything into the demo you wouldn't want kept — a real customer's details, for instance.
• If you sign up for launch updates using the email box in the site footer, we store that email address and use it only to send you occasional updates about Toby. Nothing else, no newsletter you didn't ask for, and we don't pass it to anyone else. Unsubscribe any time by emailing us.
• If you use the feedback page to review Toby, we store your name and business name (if you give them), your star rating and your comment. This page is for people already using Toby, not demo visitors. A review is never shown anywhere on the public site unless we ask you first and you agree — there is no automatic publishing.

We use two third-party analytics tools on this site: Google Analytics (GA4) and Microsoft Clarity. This replaces an earlier, stronger claim on this page that the site loaded nothing from other companies — that stopped being true the day we turned these on, so we are correcting it here rather than leaving a promise we'd broken.

• Google Analytics (GA4) records page views, which page you came from, broad device/browser and coarse location (typically city-level, derived from IP — Google, not us, resolves this), and a handful of specific actions on this site: submitting the demo callback form, the "Get started" form, the launch-updates email, or the feedback form, and — only if we are actively running an on-site experiment, which is normally switched off — which version of a test you saw. We do not send your name, email, phone number or message content to Google Analytics; the events above carry only a category label (for example, "a sign-up happened"), never the value you typed.
• Microsoft Clarity records session replay and heatmap data — mouse movement, clicks, scrolling and which parts of a page get attention — so we can see where the site is confusing or slow. Clarity is configured with its cookie-less tracking setting turned on, so it does not set a cookie on your device; it still processes your IP address and browser/device details to generate the session data, the same as any analytics tool must.

Both tools are configured, as far as we can control it, to avoid collecting anything typed into a form field as free text (Clarity masks input fields by default; we do not override that). If either tool is later found to have captured something it shouldn't have, contact us and we'll have it removed and reconfigure the masking.

Opting out. A browser privacy extension (such as an ad/tracker blocker) will stop both of these loading at all — nothing on this site depends on them working. Google separately publishes a browser add-on that opts you out of Google Analytics specifically across every site that uses it, and Microsoft's Clarity privacy notice, including its own opt-out information, is at clarity.microsoft.com/privacy.

Otherwise the site is still deliberately plain. It has no advertising and does not sell or share what these tools collect with any advertiser. It stores a small number of values in your own browser: how many demo messages you've sent, whether you've dismissed the callback offer, and — only when an on-site experiment is switched on — a random id used solely to show you the same version of that experiment consistently, never tied to your name or contact details. Those stay on your device. Our hosting provider keeps standard server logs, including IP addresses, for security and troubleshooting.

14. Changes to this policy

If we change how we handle information, we'll update this page and change the "last updated" date at the top. If a change is significant and affects tradies using the service, we'll tell them directly.

15. Contact us

Privacy questions, requests and complaints all go to the same place: [email protected]. A real person reads it.

Postal address: Queensland, Australia. Written contact: [email protected]. Operated by Ashton Sydney Gathercole, trading as Hello Toby (ABN 39 426 072 712).