Legal
Privacy Policy
Last updated 8 October 2026
The short version
- We collect only what we need to reply to enquiries, run our clients’ systems and bill for our services.
- We never sell personal information, and we don’t use advertising or tracking cookies on this website.
- When we handle information about our clients’ customers (for example calls answered by our AI receptionist), we do it on our client’s behalf and only to provide their service.
- Our main database is stored in Australia (Sydney). Some service providers we use are overseas — they’re listed below.
- You can ask to see, correct or delete your information at any time: hello@novidigital.com.au.
- 1. Who we are
- 2. What we collect
- 3. Our clients’ customers
- 4. How we use it
- 5. AI and automated processing
- 6. Who we share it with
- 7. Overseas storage
- 8. Messages and opting out
- 9. Cookies and browser storage
- 10. How we protect it
- 11. How long we keep it
- 12. Access, correction and deletion
- 13. Data breaches
- 14. Questions and complaints
1. Who we are
Novi Digital (“Novi”, “we”, “us”) is the business name of Isitolo Ahio, a sole trader based in Queensland (ABN 29 852 691 146). We design and run websites, AI and automation systems for businesses. This policy explains how we handle personal information when you visit novidigital.com.au, contact us, become a client, use the Novi client portal, or interact with a business that uses our services.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we apply the same standards regardless of whether a particular obligation strictly applies to a business of our size.
2. What we collect
If you enquire or visit our website
- Your name, email, business name and anything you write in our contact form or emails.
- If you complete one of our online forms (for example onboarding, consent, authority, website sign-off, testimonial permission or a complaint), the answers you give, your typed signature, the date and time, and a reference number. We keep this record to set up and run your service and to show what was agreed, and we email you a copy.
- Messages you type into our website chat assistant, and any contact details you choose to give it (see section 5).
- Basic technical information our hosting provider records automatically (such as IP address, browser type and pages requested) for security and to keep the site running.
If you become a client or use the client portal
- Contact and business details (name, email, phone, business name, ABN, address, opening hours, staff names and rosters).
- Portal account details and a record of important account activity (for example logins, settings changes and support access).
- Billing details. Payments are processed by Stripe — we never see or store your full card number.
- Files and information you upload or send to us.
Sensitive information
We don’t ask for sensitive information (such as health information) about you. Some of our clients — for example health practitioners — may receive it from their own customers through the systems we run. We handle that information only on the client’s behalf, with additional care, and only as needed to provide their service.
3. If you’re a customer of one of our clients
If you called, messaged, booked with or enquired to a business that uses Novi, we may process information such as your name, phone number, email, what you asked for, booking details, call recordings and transcripts, and text or chat messages. We do this on behalf of that business, under our agreement with them, and only to provide their service (for example to answer your call, book your job or send you a confirmation).
That business decides how your information is used, and their own privacy policy applies. If you have a question or want to access or correct your information, please contact that business — or contact us and we’ll help or pass your request on.
4. How we use personal information
- To respond to enquiries and provide quotes.
- To set up, run, support and improve our clients’ websites, AI receptionists, automations and portal.
- To answer calls, capture enquiries, suggest and manage bookings, and send the messages our clients have switched on.
- To bill for our services and keep business records.
- To keep our systems secure, investigate problems and prevent misuse.
- To meet our legal obligations.
We don’t sell personal information, and we don’t use our clients’ customer data for our own marketing.
5. AI and automated processing
- Our website chat assistant: the chat on novidigital.com.au is an AI assistant powered by Anthropic’s Claude. Your messages are sent to Anthropic to generate replies. The conversation is kept only in your browser tab (it clears when you close it); we don’t store chat transcripts, except that if you ask us to get in touch, the details you give (such as your name, contact details and what you need) are sent to us so we can follow up. Please don’t share sensitive information in the chat.
- AI receptionist: calls to Novi and to businesses that use this service may be answered by an AI assistant, recorded and transcribed. Callers are told at the start of the call that it is recorded. On our clients’ lines the greeting also says the caller is speaking with an AI assistant. On Novi’s own line the assistant introduces itself by name and confirms it is an AI whenever a caller asks. Recordings and transcripts are used to handle the enquiry and to let the business review what happened.
- AI scheduling: our system may suggest times and staff for new jobs based on the business’s opening hours, rosters and existing bookings. Suggestions are only confirmed when a person at the business accepts them.
- Automated messages: businesses can switch on messages such as booking confirmations, reminders, follow-ups and review requests.
We don’t use automated processing to make decisions that have a legal or similarly significant effect on you without a person being involved. AI outputs (such as call summaries) can contain mistakes; businesses can review the original recording or messages.
6. Who we share it with
We share personal information only with service providers who help us run our services, under confidentiality and security obligations, and only as needed:
| Provider | What for | Where |
|---|---|---|
| Supabase | Client portal database, logins and file storage | Australia (Sydney) |
| Netlify | Website hosting and server functions | United States and global network |
| Stripe | Subscription payments and invoices | Australia, United States and other countries |
| Anthropic | The AI model (Claude) that powers our website chat assistant — it processes chat messages to generate replies | United States |
| Google Fonts / jsDelivr | Delivering the website’s fonts and code libraries (your browser connects to them directly) | Global networks |
| Retell AI | Runs the AI receptionist: answers calls, records and transcribes them, and creates call summaries | United States |
| Twilio | Phone numbers, calls and SMS text messages (sending, receiving and delivery) | United States and global network |
| Resend | Sending emails (such as login links, confirmations and follow-ups) | United States and global network |
| Cal.com | Online booking and scheduling (names, contact details and appointment times) | United States and other countries |
| Make.com and Google | Connecting our tools and keeping enquiry, calendar and booking records (Gmail, Google Calendar and Sheets) | European Union (Make.com); United States and other countries (Google) |
| Other email, SMS and calling providers | Any further providers used for the messaging and AI receptionist services our clients choose | Varies by provider — ask us for the current list |
We may also disclose information if required by law, or to our professional advisers (such as our accountant or lawyer) under confidentiality.
7. Overseas storage and disclosure
Our main client database is hosted in Australia. Some providers listed above store or process information overseas, including in the United States. We choose reputable providers with strong security practices and take reasonable steps to ensure they handle information consistently with the Australian Privacy Principles.
8. Messages and opting out
We only send marketing messages with consent (express or inferred from an existing relationship), we always identify who the message is from, and every marketing message includes a way to opt out. Reply STOP to any marketing text or use the unsubscribe link in an email, and we’ll stop within five working days. Service messages (such as booking confirmations and billing notices) are still sent while you’re a client or have a booking.
The same rules are built into the messaging features we provide to our clients.
9. Cookies and browser storage
This website doesn’t use advertising or tracking cookies. To count visits, the website keeps a single date in your browser’s storage (so a visit is only counted once a day) and records anonymous daily totals — number of visitors and pages viewed. We don’t store your IP address or build a profile of you, and the totals can’t identify you. The client portal stores a login session and a few display preferences (such as text size) in your browser so you stay signed in. You can clear these at any time through your browser settings.
10. How we protect it
- All connections are encrypted (HTTPS), and data is encrypted at rest by our database provider.
- Each client business’s data is separated at the database level, so one client can’t access another’s.
- Portal access is invitation-only, with password-free secure email links, role-based permissions and an audit log of support access.
- Payment details are handled entirely by Stripe.
- We limit access to the people who need it and review our security settings regularly.
No system is perfectly secure, but we take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access.
11. How long we keep it
We keep information for as long as we need it to provide our services and meet legal requirements (for example, tax records are kept for five years). When a client leaves, we provide an export of their data on request and delete or de-identify it within 90 days, unless the law requires us to keep it longer.
12. Access, correction and deletion
You can ask to access, correct or delete the personal information we hold about you by emailing hello@novidigital.com.au. We’ll respond within 30 days. We may need to confirm your identity first, and if we can’t fulfil a request (for example because the law requires us to keep something), we’ll explain why.
13. Data breaches
If a data breach is likely to cause serious harm, we’ll notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we’ll notify affected clients promptly so they can meet their own obligations.
14. Questions and complaints
If you have a question or complaint about how we’ve handled your information, please email hello@novidigital.com.au. We’ll respond within 30 days. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
Changes to this policy
We’ll update this policy when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use your information, we’ll let clients know directly.