FIRSTLINE AI PRIVACY POLICY

Version: 1.0
Effective date: 3 October 2026

FirstLine AI is a trading name of Firstline Corporation Pty Ltd (ABN 90 086 391 157). We provide AI-powered business communication services, including our AI Chatbot Service and Phone Answering Service.

This Privacy Policy explains how we collect, use, disclose, hold and protect personal information when we provide our services, operate our website and deal with customers, callers and visitors.

1. Who this policy is about

This Privacy Policy applies to personal information we handle in connection with:

• our customers and prospective customers;
• people who contact or deal with our customers through our services;
• visitors who interact with an AI Chatbot Service operated for one of our customers;
• callers who interact with our Phone Answering Service;
• people who contact FirstLine AI directly; and
• visitors to our website.

Our services are provided primarily to businesses. Where we process personal information on behalf of a Customer, the Customer may also have its own privacy obligations and privacy policy.

2. Information we collect

The information we collect depends on how you interact with us or with a service operated for one of our Customers.

General

We may collect information such as:

• names and contact details;
• business and organisation details;
• information provided when you contact us;
• information about your use of our website and services;
• billing and transaction information; and
• information contained in communications with us.

AI Chatbot Service

When you interact with an AI Chatbot Service operated for a Customer, we may collect:

• the messages and replies exchanged during the conversation;
• your name and contact details if you provide them;
• information you provide in connection with a request, enquiry or booking; and
• technical information needed to operate the chatbot.

Where you ask the chatbot to provide information to the relevant Customer, such as a phone number for a callback, an email address, a message, booking information or other information, we transmit that information to the Customer so that the Customer can respond or take appropriate action.

Phone Answering Service

When you call a business using our Phone Answering Service, we may collect:

• your name;
• your phone number or other callback details;
• the reason for your call;
• booking or appointment information;
• messages and other information you provide during the call; and
• technical and service information associated with the call.

Where you ask us to pass information to the relevant Customer, such as a callback number, message, booking request or other information, we transmit that information to the Customer so that the Customer can respond or take appropriate action.

Sensitive information

Our services are not designed to ask for sensitive information.

If you voluntarily provide sensitive information during a call, chatbot conversation or other interaction, we will handle it as personal information in accordance with this Privacy Policy and applicable law.

3. How we use information

We may use personal information to:

• provide and operate our services;
• provide information, messages and requests to the relevant Customer;
• respond to enquiries and provide customer support;
• process payments and manage accounts;
• maintain and improve our website and services;
• monitor service performance and reliability;
• detect, prevent and address security issues, fraud, misuse or technical problems;
• comply with legal and regulatory requirements; and
• establish, exercise or defend legal rights.

We do not sell personal information.

AI models and service improvement

We do not use Customer, Caller or Visitor information to train AI models.

Our AI model is provided through Amazon Bedrock. Information sent to the model is not used by Amazon Bedrock to train its models.

For the AI Chatbot Service, we may use conversation information in de-identified form to improve our services and produce aggregated statistics, where permitted by our agreement with the Customer.

For the Phone Answering Service, we do not use call transcripts or summaries to train AI models or improve our services. Our voice service providers may use de-identified call data to improve their own services, subject to their terms.

4. Sharing information

We may disclose personal information to:

• the Customer for whom an AI Chatbot Service or Phone Answering Service is being provided, where the information is relevant to the service or where you have asked us to pass it to the Customer;
• service providers that help us provide, operate or support our services, including providers of cloud hosting, AI, telecommunications, voice processing, email, payment and customer-management services;
• professional advisers where reasonably necessary;
• government agencies, regulators or law-enforcement bodies where required or permitted by law; and
• another organisation in connection with a proposed or completed sale, transfer, merger or restructuring of our business.

We do not sell personal information.

When we use service providers, we take reasonable steps to ensure that personal information is handled appropriately and consistently with our obligations.

5. Where information is processed

Our principal database and AI model infrastructure are located in Australia.

Some service providers we use may process information outside Australia, including in countries such as the United States and Singapore, and potentially other countries depending on the services and providers we use.

Information processed through the Phone Answering Service may therefore be processed outside Australia.

Where required by applicable privacy law, we take reasonable steps in relation to overseas disclosures of personal information.

6. Security and retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

No method of storing or transmitting information is completely secure, and we cannot guarantee absolute security.

We retain personal information only for as long as reasonably necessary for the purposes for which it is held, including our legal, accounting and business-record requirements.

Our general retention periods are:

At the end of the applicable retention period, information will generally be destroyed or de-identified, unless the law permits or requires us to retain it for longer.

7. Access and correction

You may ask us for access to personal information we hold about you and may ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We may need to verify your identity before providing access or making a correction.

There may be circumstances in which we are permitted or required by law to refuse access or correction. If this occurs, we will explain the reason where we are permitted to do so.

8. Cookies

Our website and services may use cookies and similar technologies to operate the website, maintain sessions, remember preferences, understand usage and support security.

Our Cookie Policy provides further information about the cookies and similar technologies we use.

AI Chatbot session storage

The AI Chatbot Service stores the conversation in the Visitor’s browser using session storage so that the conversation can continue while the page is open.

The session storage is deleted when the browser tab is closed.

We do not keep a server-side conversation history for the Visitor through this session mechanism.

This description applies to the chatbot’s session-storage mechanism and does not limit any information that may separately be provided to the relevant Customer as part of the service.

9. Phone Answering Service

Our Phone Answering Service uses an AI assistant to answer business calls and provide information or take messages on behalf of our Customers.

At the beginning of a call, the caller is informed that they are speaking with an AI assistant and that the call is being transcribed.

We do not record or retain the caller’s audio. The service instead creates a written transcript of the conversation.

The service may collect information such as the caller’s name, callback number, reason for calling, booking or appointment information and other information provided during the call.

Where a caller asks us to pass information to the relevant Customer, such as a callback number, message, booking request or other information, we transmit that information to the Customer so that the Customer can respond or take appropriate action.

The Phone Answering Service is not an emergency service. If you have an emergency, you should contact the appropriate emergency service by calling 000. The AI assistant cannot contact emergency services on your behalf.

Information collected through the Phone Answering Service may be used to:

• provide the answering service;
• send messages, requests and summaries to the Customer;
• measure and administer service usage;
• provide technical and customer support;
• maintain security and service reliability; and
• comply with legal obligations.

Voice and telecommunications service providers may process information as necessary to provide their services.

10. AI Chatbot Service

Our AI Chatbot Service allows visitors to communicate with an AI assistant through a website operated by one of our Customers.

The chatbot may collect messages and replies, contact details and other information provided by the Visitor.

Where a Visitor asks us to provide information to the relevant Customer, such as a phone number for a callback, an email address, a message, booking information or other information, we transmit that information to the Customer so that the Customer can respond or take appropriate action.

We use information provided through the chatbot to operate the service and, where appropriate, provide relevant information to the Customer.

The chatbot stores the conversation in the Visitor’s browser using session storage while the page is open. The session storage is deleted when the browser tab is closed.

The chatbot does not ask Visitors to provide sensitive information. If a Visitor voluntarily provides sensitive information, we handle it in accordance with this Privacy Policy.

11. Other websites

Our website or services may contain links to websites operated by other organisations.

We are not responsible for the privacy practices or content of those websites. We recommend reviewing the privacy policy of any external website you visit.

12. Children

Our services are designed for businesses and are not directed specifically to children.

We do not knowingly collect personal information from children for the purpose of providing services directly to them.

13. Data breaches

We take reasonable steps to protect personal information against unauthorised access, disclosure, loss or misuse.

If we become aware of a data breach that is likely to cause serious harm, we will take the steps required by law, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

14. Changes to this Privacy Policy

We may update this Privacy Policy when our Services, service providers or information-handling practices change.

The latest version will be published on our website with its updated date.

We will give Customers at least 30 days’ notice by email of material changes before they take effect, except where a shorter period is reasonably necessary to comply with law, regulation or a requirement of a regulator, or where the change does not materially disadvantage the Customer.

15. Contact and complaints

If you have a question, request or complaint about how we handle personal information, please contact our Privacy Officer.

Privacy Officer
Firstline Corporation Pty Ltd trading as FirstLine AI
ABN 90 086 391 157
PO Box 235
Doncaster VIC 3108
Australia

Email: contact@firstlineai.au
Phone: +61 412 210 998

We will review privacy complaints and respond within a reasonable period.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

16. Definitions

In this Privacy Policy:

Personal information has the meaning given to that term under the Privacy Act 1988 (Cth).

Customer means a business that enters into a Business-to-Business Services Agreement with FirstLine AI for one or more Services.

Caller has the meaning given in the Business-to-Business Services Agreement.

Visitor has the meaning given in the Business-to-Business Services Agreement.

AI Chatbot Service means the AI chatbot service described in the Business-to-Business Services Agreement.

Phone Answering Service means the AI phone answering service described in the Business-to-Business Services Agreement.

Services means the services provided by FirstLine AI under the Business-to-Business Services Agreement.

Where a term is not defined in this Privacy Policy, it has the meaning given to it in the Business-to-Business Services Agreement, where applicable.