Privacy Policy

01Scope and Our Role

This Policy applies to personal information we handle in connection with:

• visits to and use of our website, including our interactive service demonstrations;
• enquiries made through our contact form, by email, by phone or through WhatsApp;
• orders placed through our online checkout and the management of customer accounts;
• the delivery of our consulting, design, development, deployment, maintenance and support services; and
• our business relationships with clients, prospective clients, suppliers and partners.

When we act as a controller. For information about website visitors, enquirers, customers and business contacts, CJ AI Agency decides why and how that information is processed, and is the “controller” (or the equivalent concept under applicable law).

When we act as a processor. When we build or operate an AI system for a client, that system may handle personal information about the client’s own customers, callers, users or staff (“End Users”). In that case our client is the controller and CJ AI Agency acts as a “processor” or “service provider”, processing that information only on the client’s documented instructions and under our written agreement with them. End Users should direct privacy questions to the business that deployed the chatbot or voice agent they interacted with. Section 6 explains how we handle that data.

02Information We Collect

The personal information we collect depends on how you interact with us. We aim to collect only information that is reasonably necessary for our functions and activities.

2.1 Information you provide to us

• Enquiry and contact details: your name, business email address, company name, the service you are interested in, and the content of your message when you submit our contact form, email us, call us or message us on WhatsApp.
• Order and billing details: your name, company, billing address, email address, phone number, the package purchased and any order notes when you buy through our checkout.
• Account details: your username, email address and password (stored only in hashed form) if you create a customer account.
• Project information: information you share to scope and deliver a project, such as business requirements, process documents, scripts, knowledge base content, brand assets, system access credentials and the names and contact details of your team members.
• Communications: records of our correspondence, meeting notes, feedback, support requests and survey responses.

2.2 Information collected automatically

• Technical and device data: IP address, browser type and version, operating system, device type, referring URL, pages viewed, and the date and time of access.
• Security data: server, firewall and login logs used to detect and block malicious traffic, spam, brute-force attempts and fraud. Our contact form also records the IP address and time of each submission for anti-abuse purposes.
• Preference data: settings such as your light or dark theme choice, which is stored only in your own browser.
• Cookie data: information collected through the cookies and similar technologies described in Section 7.

2.3 Information from third parties

• Payment providers: Stripe and PayPal tell us whether a payment succeeded and give us limited transaction details (such as the last four digits and card brand, or your PayPal email), but never your full card number or security code.
• Platforms you connect: if you grant us access to your systems (for example a CRM, helpdesk, calendar, telephony account or database) so that we can build integrations, we access information in those systems only as needed to perform the agreed work.
• Business contacts and referrals: contact details passed to us by a referrer or colleague, or published in professional directories.

2.4 Sensitive information

We do not intentionally collect sensitive information (such as health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, biometric or genetic data) about website visitors or enquirers. Please do not include sensitive information in contact forms or messages. If a client project requires an AI system to process sensitive information, we will do so only with the client’s documented instructions, appropriate consent mechanisms designed by the client, and additional safeguards agreed in writing.

03How We Collect Information

We collect personal information directly from you wherever reasonable and practicable, including when you fill in a form, place an order, communicate with us, attend a meeting or use our services. We also collect it automatically through our website technologies and, where described above, from third parties. If we receive unsolicited personal information that we could not have collected under the APPs, we will destroy or de-identify it as soon as practicable where lawful and reasonable to do so.

04How We Use Information

We use personal information for the following purposes:

• Responding to enquiries: answering questions, preparing proposals and quotes, and scheduling consultations.
• Delivering services: scoping, designing, building, testing, deploying, hosting, monitoring, maintaining and supporting AI chatbots, voice agents, custom agents and integrations.
• Processing orders and payments: fulfilling package purchases, issuing invoices and receipts, processing refunds and managing customer accounts.
• Account and relationship management: communicating about projects, approvals, milestones, renewals and service changes.
• Security and fraud prevention: protecting our website, systems, clients and users; detecting spam, abuse and fraudulent transactions.
• Improving our website and services: understanding how our site is used, fixing errors and improving our offerings, using aggregated or de-identified information wherever possible.
• Marketing: sending service updates and insights where you have agreed or where the law otherwise permits (see Section 16).
• Legal and compliance: meeting tax, accounting, record-keeping and other legal obligations, and establishing, exercising or defending legal claims.

We will not use your personal information for a purpose that is materially different from those listed above unless you consent, you would reasonably expect it, or the law requires or permits it. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

05Legal Bases for Processing

Where the GDPR, UK GDPR or similar laws apply, we rely on the following legal bases:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may ask us for more information about that assessment.

06AI Systems and Client Data

Because we build and operate AI systems, we apply additional commitments to the data those systems handle.

6.1 No model training on your data

We do not use client data, End User conversations, call recordings, transcripts or knowledge base content to train our own models or any publicly available AI model. Where we use third-party AI model, speech-to-text, text-to-speech or telephony providers, we select enterprise or API service tiers whose terms prohibit using submitted data to train their models, wherever such terms are available, and we tell clients about any exceptions before deployment.

6.2 Processing on client instructions

When we act as a processor, we:

• process End User data only to build, operate, support and improve the client’s own system, as instructed by the client;
• ensure personnel who access the data are bound by confidentiality obligations;
• apply appropriate technical and organisational security measures (see Section 11);
• engage sub-processors only under written terms that offer equivalent protection, and inform clients of them;
• assist clients to respond to data subject requests and to meet their own security, breach notification and impact assessment obligations;
• delete or return client data at the end of the engagement, unless retention is required by law; and
• make available a Data Processing Agreement (DPA) on request.

6.3 Client responsibilities for End User transparency

Clients who deploy our AI systems are responsible for providing their own privacy notices to End Users, obtaining any consents required (for example, consent to record calls or to interact with an automated agent), and having a lawful basis for the data their systems collect. Our Terms & Conditions describe these responsibilities in more detail.

6.4 Demonstrations on our website

The interactive chatbot, voice and workflow demonstrations on our website are illustrative simulations. Please do not enter personal or confidential information into them.

07Cookies and Similar Technologies

Cookies are small text files placed on your device. Similar technologies include browser local storage. We keep our use of these technologies to a minimum.

We do not currently use advertising cookies or third-party behavioural tracking on our website. If we introduce analytics or marketing cookies in the future, we will update this Policy and, where required by law, ask for your consent before setting them.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the website, such as the checkout, from working. We treat a browser Global Privacy Control (GPC) signal as a valid opt-out request where applicable law requires it.

08How We Share Information

We do not sell, rent or trade personal information. We share it only as described below and only to the extent necessary:

• Service providers: trusted vendors who help us operate our business, including web hosting and infrastructure providers, payment processors (Stripe and PayPal), email delivery and workspace providers, communication platforms (such as WhatsApp, operated by Meta), project management and file-sharing tools, and accounting providers. They may use the information only to provide services to us.
• AI and telephony sub-processors: large language model, speech-to-text, text-to-speech, vector database, telephony and cloud infrastructure providers used to build and run client systems, under terms consistent with Section 6.
• Professional advisers: lawyers, accountants, auditors and insurers, under duties of confidentiality.
• Subcontractors: vetted developers or specialists who assist with a project, bound by written confidentiality and data protection obligations.
• Business transfers: a purchaser, investor or successor in connection with a merger, acquisition, restructuring or sale of assets, subject to equivalent protections.
• Legal requirements: courts, regulators, law enforcement or other authorities where required or authorised by law, or where necessary to protect the rights, property or safety of CJ AI Agency, our clients or others.
• With your consent: any other party where you have asked us or agreed for us to do so.

09International Data Transfers

We are based in Australia, and our website is hosted on infrastructure located in the United States. Some of our service providers, including payment, AI and cloud providers, store or process information in other countries, which may include the United States, the United Kingdom, member states of the European Union, Canada, Singapore and India. The countries involved can vary with the specific services a client selects.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs (APP 8). Where personal information originating in the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or the recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You may contact us to request more information about these safeguards.

10Data Retention

We keep personal information only for as long as necessary for the purposes described in this Policy, including to meet legal, tax, accounting and reporting requirements. When it is no longer needed, we securely delete or de-identify it.

11Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include:

• encryption of data in transit using TLS (HTTPS) across our website and checkout;
• encryption at rest for client data and credentials where supported by the underlying platform;
• a web application firewall, login protection, spam filtering and continuous security monitoring;
• role-based, least-privilege access controls and multi-factor authentication for administrative systems;
• isolated environments for client deployments, with secrets kept out of source code;
• outsourcing card processing to PCI DSS-compliant payment providers;
• regular software updates, backups and vendor due diligence; and
• confidentiality obligations for all personnel and subcontractors.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account passwords and any credentials you hold confidential, and for telling us promptly if you suspect unauthorised access.

12Data Breach Response

If we suspect a data breach, we act promptly to contain it, assess the risk of harm and take remedial action. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, where required. Where we act as a processor, we will notify the affected client without undue delay so that they can meet their own obligations.

13Your Privacy Rights

Depending on where you live, you may have some or all of the following rights:

• Access: to request a copy of the personal information we hold about you.
• Correction: to ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.
• Deletion: to ask us to delete your personal information, subject to legal exceptions.
• Restriction and objection: to ask us to limit processing, or to object to processing based on legitimate interests or for direct marketing.
• Portability: to receive information you provided to us in a structured, commonly used, machine-readable format.
• Withdrawal of consent: to withdraw consent at any time, without affecting processing that took place before withdrawal.
• Non-discrimination: not to be treated differently for exercising your privacy rights.

How to make a request. Email info@cjaiagency.com with the subject line “Privacy Request”. We will need to verify your identity before acting on the request, and an authorised agent may submit a request on your behalf with proof of authority. We respond within 30 days, or sooner where the law requires; if we need more time, as permitted by law, we will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive. If we refuse a request, we will explain our reasons in writing and tell you how to complain.

If your information was collected by one of our clients through an AI system we operate for them, please send your request to that business. If you contact us instead, we will pass your request to them and help them respond.

14Additional Information for U.S. Residents

This section supplements this Policy for residents of California and other U.S. states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others.

• Categories collected in the last 12 months: identifiers (such as name, email, IP address); commercial information (such as packages purchased); internet or network activity (such as pages viewed and security logs); professional information (such as company and role); and inferences limited to responding to your business needs. We collect these from the sources and for the purposes described in Sections 2 to 4, and keep them for the periods described in Section 10.
• No sale or sharing: we have not sold personal information or “shared” it for cross-context behavioural advertising in the past 12 months, and we have no actual knowledge of selling or sharing the information of consumers under 16.
• Sensitive personal information: we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit under the CCPA.
• Your rights: you may request to know, access, correct and delete your personal information, to opt out of sale, sharing, targeted advertising and profiling, and to appeal a decision about your request by replying to our response. If your appeal is denied, you may contact your state Attorney General.

15Additional Information for EEA and UK Residents

For the purposes of the GDPR and UK GDPR, the controller of your personal information is CJ AI Agency, Melbourne, Victoria, Australia, contactable at info@cjaiagency.com. In addition to the rights in Section 13, you have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where an alleged infringement occurred. In the UK, this is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concerns first.

16Marketing Communications

We send commercial electronic messages only in accordance with the Spam Act 2003 (Cth), the U.S. CAN-SPAM Act, Canada’s Anti-Spam Legislation (CASL), the EU ePrivacy rules and the UK PECR, as applicable. This means we send marketing only with your consent (express or, where permitted, inferred from an existing business relationship). Each message identifies us and includes a working unsubscribe option. You can opt out at any time by using that link or by emailing us, and we will process your request within 5 business days. Even after you opt out, we may still send you transactional or service messages about your orders, account or projects.

17Children’s Privacy

Our website and services are designed for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, please contact us and we will promptly delete it. Clients who deploy AI systems that may interact with minors are responsible for complying with applicable children’s privacy laws, such as COPPA in the United States.

18Anonymity and Pseudonymity

Where lawful and practicable, you may browse our website and make general enquiries without identifying yourself, or by using a pseudonym. However, we need your real name, contact details and billing information to provide a proposal, process a purchase or deliver services.

19Third-Party Websites and Services

Our website may link to third-party websites, platforms and services, including social media profiles, WhatsApp, Stripe and PayPal. Those third parties operate under their own privacy policies, and we are not responsible for their practices. We encourage you to read their privacy policies before providing them with information.

20Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, technologies or legal obligations. The “Last updated” date at the top of this page shows when it was last revised. If we make material changes, we will take reasonable steps to tell you, for example by posting a notice on our website or emailing active clients. Your continued use of our website or services after an update takes effect means the updated Policy applies.

21Complaints

If you have a concern about how we have handled your personal information, please contact us first using the details below and tell us what happened. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992. You may also contact the data protection authority in your own country, as described in Section 15.

22Contact Us

For questions about this Privacy Policy, to exercise your rights or to request our Data Processing Agreement, please contact:

Please also read our Terms & Conditions, which govern your use of our website and services.