Legal

Privacy Policy

Draft of 14 October 2026.

Who we are

adoh.ai is run by [legal entity name], ABN [number] ("we", "us"). We make software that answers the private messages, comments and Google reviews an Australian local business receives. We follow the Privacy Act 1988 and the Australian Privacy Principles.

[Reviewer: a business with turnover under A$3 million may be exempt from the Privacy Act, but we handle personal information on behalf of clinics (possibly health information) and may be a contracted service provider. Please confirm whether we are covered, or should opt in under s 6EA, and word this paragraph accordingly.]

The short version

• Everything we store is kept in Australia, in Amazon Web Services' Sydney region.
• The AI that writes replies runs in Australia, on Amazon Bedrock.
• Messages travel through the platforms they were sent on — Instagram, Facebook, WhatsApp, Google — and, for some connections, through our messaging partner in the European Union. Both are explained below.
• A business's customers' messages belong to that business. We handle them to run adoh.ai for it, not for ourselves. We do not sell personal information, and we do not use it for advertising.
• We do not train AI models on anyone's messages.

Whose information this covers

Three groups of people, and we handle each differently:

• Customers of businesses that use adoh.ai — anyone who messages, comments on, or reviews a business that uses us. We call them Contacts. We handle their information on behalf of that business. The business decides what its Agent does, and its own privacy policy also applies to you.
• People who use adoh.ai — a business's owner, managers and staff (Team Members).
• Visitors to our website, adoh.ai, and to a business's Link Page.

If you messaged a business that uses adoh.ai

What we collect

When you send a business a private message, comment on its post, or leave it a Google review, the platform passes it to us so the business can answer. We keep:

• your name, username and profile picture link as the platform provides them, and the platform's id for you;
• the text of what you sent, and of the replies, including earlier drafts and edits of those replies. We do not keep photos, videos or other attachments; we note only that one was sent;
• for a Google review, your star rating;
• if you ask about something the business offers, the details you give in the conversation that let it follow up: your name, phone number, email address, what you are interested in, when suits you to be contacted, and whether you agreed to be contacted. We call this a Lead. When we first ask for these details, or when you first give them, the reply includes a short notice and a link to the business's own privacy policy;
• if the business takes orders through Square, the items you order, your pickup time and the name for the order;
• if a business's automated message includes a link, whether and when it was tapped. We count taps per recipient, and store no IP address, device or cookie with them.

We only receive what you send to the business on these platforms. We do not look you up anywhere else, and we do not combine what you sent one business with what you sent another.

How it is used

• To answer you. The business's AI Agent reads your message and writes a reply from information the business has given it. Depending on the business's settings, the reply is sent automatically, or a person at the business checks it first. In a private conversation, the Agent tells you it is an automated assistant.
• To let the business's staff see and answer the conversation, including in email and text alerts to them. Email alerts may quote your message; text alerts never do, but may give your name.
• To pass your enquiry to the business's own systems. If the business has connected its customer system (a CRM), we send it your Lead details. That system is chosen and run by the business, and may be outside Australia.
• To check the Agent's quality. When staff approve, edit or reject a draft reply, we keep what changed, so we can measure and improve how accurate the Agent is. We remove names, phone numbers, email addresses and other identifiers before any of this leaves the business's own records. [Reviewer: see note below.]
• To keep the service secure and to investigate misuse.

[Reviewer: the quality export is built but switched off pending this review (fact sheet §7). Confirm that using de-identified edit records to evaluate the service is a permitted secondary use (APP 6.2(a)) or needs the Business's agreement in the Terms, and whether the founder's plan to evaluate on a client's real, redacted enquiries is covered by this wording.]

How long it is kept

• Conversations, comments and reviews are kept while the business uses adoh.ai.
• Lead details are erased after 24 months with no new enquiry from you, or sooner if the business chooses a shorter period. Your messages in the conversation itself are kept until the conversation is deleted.
• When a business disconnects a channel, we delete that channel's conversations 30 days later. When a business stops using adoh.ai, we delete all its data 30 days after its access ends.

[Reviewer: the last bullet is not yet true in the code (fact sheet gaps G1 and G2). It must not take effect until both deletions are built. Also, Lead erasure leaves the same details in the conversation's messages (G13): is that acceptable if disclosed, as here?]

Your choices

The quickest way to see, correct or delete what a business holds about you is to ask that business: it controls its conversations. We will help it answer you. You can also ask us directly at privacy@adoh.ai and we will work with the business to respond within 30 days.

[Reviewer: there is no tool yet to erase or export one Contact's messages (gap G4), so these requests would be handled by hand. The privacy@ mailbox does not yet exist. Confirm our obligations to a Contact who asks us rather than the business.]

If you use adoh.ai for your business

What we collect

• Your account: your name, email address and, if you choose, your mobile number for text alerts, with when you agreed to receive them. Sign-in is handled by Amazon Cognito in Sydney.
• Your business: its name, Locations, addresses, phone numbers, opening hours, website, and everything you put in its Knowledge Base, including files you upload and pages from your website you ask us to read.
• What you do in adoh.ai: which replies you approved, edited or sent, your alert preferences, and when you agreed to things such as our messaging partner's location.
• When you connect Facebook or Instagram: your Facebook user id and name as the person who authorised the connection, and access tokens for the Pages and accounts you chose. We encrypt the tokens with keys held in Amazon's Key Management Service.
• When you pay: billing details are collected and held by Stripe, our payment processor. We keep your subscription status and invoices; we never see your full card number.
• Technical records: our servers log each request, including the IP address and browser it came from, for 7 days, to keep the service working and secure.

[Reviewer: Stripe billing is designed but not yet built (fact sheet §8). Request logs include IP and user agent (G7); this policy discloses it rather than claiming otherwise.]

How we use it

To run your account, send the alerts you ask for, bill you, support you, keep the service secure, and tell you about changes to the service. We send you service emails and texts — alerts, approvals, invitations, billing — because the service cannot work without them. We will only send you marketing if you have agreed, and every marketing email will let you stop it.

[Reviewer: NEEDS-YOU already asks for confirmation that Draft alerts and verification codes are factual messages under the Spam Act 2003 and need no unsubscribe.]

Your customers' information

For your customers' messages, you decide what the service does and we act on your behalf. You are responsible for telling your customers, in your own privacy policy, that you use service providers such as adoh.ai to answer messages and keep enquiries, and, if you capture Leads, where their details go. Lead capture cannot be switched on until you give us your privacy policy's address, which the Agent links to.

Where your information goes

We store everything in Australia. To deliver messages and run the service, some information is sent to, or passes through, these organisations:

• Amazon Web Services (Sydney, Australia): our database, files, encryption keys, sign-in, email and text messages, and the AI models that write replies (Amazon Bedrock, on Australian infrastructure).
• Meta (Instagram, Facebook, WhatsApp) and Google (Google Business Profile): messages, comments, reviews and replies travel through their platforms, which store them under their own privacy policies, in the United States and elsewhere.
• Zernio, our messaging partner, in the European Union: while we complete our direct approvals with the platforms, messages, comments and reviews on some connections pass through Zernio on the way to and from the platform. A business must explicitly agree to this before connecting a channel this way, and we record that agreement. [Reviewer: at launch this still applies to Google reviews (gap G12). ADR 0008 records that Zernio is a Spanish entity with logging in the United States; confirm whether the US must be named here too.]
• Google: when a business looks up its own listing during setup (Google Places), and to check that links a business adds to its Link Page are safe (Google Web Risk). Only the search text and the links are sent.
• Square (if the business connects it): items ordered, pickup time and the name for the order.
• Stripe: billing details of businesses that subscribe.
• Cloudflare: serves our website and web app from its global network, and holds our early-access list in its Oceania region.
• The business's own customer system (CRM), if it connects one: Lead details, sent wherever that system is hosted.

Overseas disclosure (APP 8)

So: personal information may be disclosed to recipients in the European Union and the United States, and, through a business's CRM, wherever that CRM is hosted. Before disclosing it to Zernio we take reasonable steps, including a written agreement, to make sure it is handled consistently with the Australian Privacy Principles. Meta and Google receive messages because the person chose to send them on Meta's or Google's platform.

[Reviewer: (a) Is there a signed data processing agreement with Zernio that supports the APP 8.1 "reasonable steps" sentence? If not, it must be obtained or the sentence changed. (b) Is the CRM disclosure ours (APP 8) or the business's own use? The app warns the business that an overseas CRM takes Leads out of Australia. (c) The home page still offers to run AI processing overseas on request; that setting does nothing in the code (gap G8), so this policy does not offer it.]

Information from Facebook, Instagram, WhatsApp and Google

• We use information from these platforms only to provide adoh.ai to the business that connected them: to show, answer and organise its messages, comments and reviews. We do not sell it, use it for advertising, or share it with data brokers.
• We keep it only as long as this policy says, and delete it when the business disconnects or leaves, as described above.
• Deleting your Facebook data. If you connected a Facebook Page or Instagram account to adoh.ai, you can ask for your data to be deleted by removing adoh.ai from the apps or business integrations in your Facebook settings and asking for your data to be deleted; or by emailing privacy@adoh.ai. We then remove your Facebook id and name from our records, disconnect the Pages and accounts you authorised, destroy their access tokens, and give you a confirmation code and a page where you can check the status of your request.

[Reviewer: Meta requires a data-deletion process for app users. Today the callback disconnects and removes the authoriser's identity but keeps the Pages' conversations (gap G5); once channel deletion is built (G2) they are deleted 30 days later. Should this section say that? If we later connect to Google directly, Google's API Services User Data Policy (Limited Use) wording must be added here.]

Our website

• Early-access list. If you give us your email, we keep it with the kind of business you said you run and the country you visited from (worked out by Cloudflare; we do not store your IP address). We use it only to tell you when adoh.ai is ready for you. Ask us and we delete it.
• Counting visits. We use Cloudflare Web Analytics, which sets no cookies and reports totals, not people.
• Link Pages. A business's Link Page counts how many times each button is tapped. It stores nothing about who tapped it.
• No advertising pixels, and no cookies that track you.

How we protect it

• Data is encrypted in transit and at rest. Platform access tokens are encrypted individually, with keys held in Amazon's Key Management Service.
• Every business's data is kept separate: our software checks that a person belongs to a business before it reads or changes anything of that business's, and the database enforces the same separation as a second check.
• Only staff who need it to run and support the service can reach production data, and we log the export of customer details.
• Our logs leave out message text, phone numbers and access tokens.
• If a data breach is likely to cause someone serious harm, we will tell them, the business concerned and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

[Reviewer: encryption at rest is verified on the demo stack only; production infrastructure does not exist yet (gap G16). Confirm the breach-notification sentence where we act for a business that may itself be the entity required to notify.]

Backups

Deleted information can remain in our encrypted database backups for up to [35] days, until those backups expire. We do not restore it from a backup except to recover from a failure, and if we ever do, we delete it again.

Seeing, correcting and deleting your information

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing privacy@adoh.ai. We will reply within 30 days. We may need to confirm who you are first. If your request is about a business's conversation with you, we will involve that business. If we refuse, we will tell you why and how to complain.

Complaints

Email privacy@adoh.ai. A person will reply within 5 business days and aim to resolve it within 30 days. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner.

Changes to this policy

We will update this policy when what we do changes, and change the date at the top. If a change matters to businesses using adoh.ai, we will email them before it takes effect.

Back to home