Privacy Policy

1. Who we are and what this covers

MAIA SYSTEMS PTY LTD ("MAIA", "we", "us") is a Queensland company that builds practical automation for trade businesses. Our main product is Job Catcher: when a trade business misses a call, Job Catcher texts the caller a link to a short job form and sends the business a summarised "job card".

This policy covers personal information we handle through:

• our website www.maiasystems.com.au (hosted on Vercel), our demo number and our support line;
• emails we send to trade businesses about our service (section 10);
• sales, onboarding, contracts, payments and support for our clients;
• Job Catcher, which we run on behalf of our clients (see section 6 for how that is different).

2. Does the Privacy Act apply to us?

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to businesses with annual turnover of $3 million or more and to some smaller businesses in specific circumstances. MAIA is currently below that threshold. We follow the APPs anyway, as a matter of policy and because our clients and their customers expect it. Where this policy says "we will", we mean it as a commitment, whether or not the law currently compels us.

Separately, the Spam Act 2003 (Cth) applies to every text message Job Catcher sends, regardless of turnover, and we comply with it (section 10).

3. What we collect

From website visitors and prospects

• name, business name, email, mobile and anything you write to us (contact forms, email, text);
• if you ring our demo number: your mobile number, the time of the call, any voicemail and the words of that voicemail, and anything you type into the demo job form (we ask you to use made-up details on the demo). Demo job cards go to the founder's mobile.
• if you ring or text our support line (0495 099 247): your mobile number, the time of the call or text, your voicemail recording and the words of your text. A voicemail is recorded only after our greeting tells you so. We use this only to reply to you.

From clients (the trade businesses we work for)

• business and legal names, ABN/ACN, address, owner's name, email and mobile, business hours and service area;
• identity and address documents required by our phone-number provider (Twilio) to allocate an Australian mobile number in your business name — held only for that purpose;
• payment information: we never see full card numbers. Stripe collects and stores them. We see the last four digits, card brand, amount, date and Stripe reference;
• support messages, sign-off records (including screenshots from go-live test calls, which can show the phone numbers and texts used in the test), and contract records.

From trade businesses we email first

• the business name, the email address the business published, and a first name if the page shows one;
• the page where we saw the address, the date we saw it, and a saved copy of that page's text;
• why our email was relevant to that business's work;
• what we sent and when, and any reply, "no thanks" or unsubscribe.

From our clients' customers (through Job Catcher)

See section 6. In short: caller number, name, suburb/address, job details, photos, texts, voicemails and transcripts.

We do not collect sensitive information (such as health or religious information) on purpose. If a caller includes it in a free-text message, it is handled like any other enquiry data and deleted on the normal schedule.

4. How we collect it

• directly from you (forms, email, text, social media messages, phone, video calls, e-signing);
• automatically when a call or text passes through Twilio, or a form is submitted;
• from Stripe when you pay;
• from public registers (ABN Lookup, ASIC) to confirm business details before signing;
• from a trade business's own public page (its own website, or its own listing such as its Google Business Profile or Facebook business page), when we email that business first (section 10).

5. Why we use it

• to answer your enquiry and run the demo;
• to email trade businesses about our service, and to keep proof that we were allowed to (section 10);
• to set up, run, support and fix Job Catcher for you;
• to take payments, issue receipts and keep the records tax law requires;
• to meet legal obligations (telecommunications identity checks, record-keeping, responding to lawful requests);
• to improve Job Catcher using aggregate numbers only (for example "enquiries caught per month") — never using our clients' customer data to build features or to train models ourselves (section 11 covers the AI services we use);
• with your written agreement, to publish a case study (you approve the wording first).

6. Job Catcher — our clients' customers

7. Who we share it with

We share personal information only with the service providers needed to run our business and Job Catcher, with our professional advisers where needed, and where the law requires. We do not share for third-party marketing.

Planned, not in use yet: Cloudflare R2. We plan to store photos sent through Job Catcher job forms in Cloudflare R2 (a file storage service) instead of Airtable. No photo is stored there today. We plan to ask Cloudflare to keep them in its Oceania region (which includes Australia). Cloudflare says it tries to honour that request but does not promise it, so photos could be stored in another country. Before the first photo goes to Cloudflare R2, we will update this policy, with a new version number and date.

Planned, not in use yet: ElevenLabs. We are building a voice receptionist that can answer a call and ask about the job. When it is switched on, the caller's voice and words will go to ElevenLabs, a United States company. We have not yet checked where it keeps call data. No call is answered this way today. Before the first one is, we will update this policy, with a new version number and date. (Today we use ElevenLabs only to make our recorded phone greetings once. No caller information goes to ElevenLabs.)

New services. Before we start using any new service that will hold personal information, we add it to this list first, with the country where it keeps the information.

8. Overseas disclosure (APP 8)

Because of the providers listed above, personal information we hold is stored and processed outside Australia — mainly in the United States and Germany. Section 7 shows the country for each provider. Some providers also use worldwide networks, so information can pass through other countries on the way. We take reasonable steps to ensure those providers protect it, including choosing providers with published security programs (such as SOC 2 and ISO 27001), using their privacy/data-processing terms, choosing settings that keep our data out of AI training where a service offers them (see section 11), and limiting what we send to what is needed. Overseas providers may be subject to foreign laws, and Australian privacy law may not apply to them in the same way. By using our website, demo, or Job Catcher, you acknowledge this.

9. Automated decision-making and AI (APP 1 transparency, in force 10 December 2026)

10. Marketing, SMS and the Spam Act

• Job Catcher only texts people who contacted a client's business first (a missed call or a direct text). It is not a bulk-messaging tool and we will not load lists.
• Every text identifies the business sending it and includes "Reply STOP to opt out". STOP is honoured immediately, with one short confirmation, and the number is added to a do-not-contact list.
• We don't send marketing texts or make sales calls to anyone who hasn't asked to hear from us. No cold texts and no cold calls.

Emails we send to trade businesses (our own marketing)

We may email an Australian trade business to tell it about Job Catcher, even if it hasn't asked us first. We only do this when all three of these are true:

• The business published the email address itself, where anyone can easily see it: on its own website, or its own listing (such as its Google Business Profile or Facebook business page).
• Our email is relevant to the work that business does. For example, a missed-call service for a trade business that takes jobs by phone. We write down the reason from that business's own page. If we can't, we don't email.
• The page does not say the business doesn't want marketing or unsolicited emails.

The law calls this inferred consent (Spam Act 2003 (Cth), Schedule 2, clause 4). Anyone else gets our marketing only if they asked for it.

• No harvesting. No bought lists. We never use software that collects email addresses, and we never buy, rent or swap lists. Each address is copied by a person from that one business's own page.
• A person approves every email. AI tools may help us find a business's website and write a draft. Our systems only make drafts. Our director reads and approves every email, one by one or in a batch he has read, before it is sent. Nothing sends by itself.
• Who it's from. Every email says it is from MAIA SYSTEMS PTY LTD, with our ABN, our address and an email address that reaches us.
• Unsubscribe. Every email has a free, simple way to unsubscribe: reply "unsubscribe" or "STOP", or use the unsubscribe link in the email. It keeps working for at least 30 days after we send. We act on it within 5 business days at the latest, and we aim for the same day.
• Few emails. We send one first email and at most one follow-up. If the business replies, we stop the follow-up and answer the reply instead.
• Once you say no, we never email that address again. An unsubscribe or a "no thanks" puts the address on our do-not-contact list (suppression list). We check that list before every batch, and we never delete it.
• Proof we keep. For each business we email first, we keep the page link, a saved copy of the page's text, the date we saw the address, and why our email was relevant. We keep it for 2 years after our last email to that business, then delete it (section 12).

11. Security

• two-step login on the systems we use (Airtable, n8n, Twilio, Stripe, email, GitHub, Slack) where it is offered. We have not yet confirmed it is on for every one;
• secrets kept in credential vaults, not in documents or chat;
• settings that keep customer data out of AI model training where a service offers them. We have not yet confirmed this on every AI account we use;
• minimum data in alerts and logs. Support line alerts are the one exception: they show the caller's number and the words of a text, so we can reply. Logs of failed runs can hold customer details until they are cleared;
• photos sent through a job form: the business gets them by text, as links, when it asks. No login is needed, so anyone with a link can open that photo. The texted link stops working after 2 hours. Opening it leads to a second link, at Airtable, that can keep working for a few more hours. We leave these links out of our message log. Our text provider, Twilio, keeps its own record of sent texts, including the link;
• professional indemnity and cyber insurance in place before any client goes live.

No system is perfectly secure. Access to customer records is limited by our own rules, not by a technical lock (section 6). Text messages travel over public mobile networks; please don't send card numbers or similar by text.

12. How long we keep information

Provider backups are purged on each provider's normal schedule after deletion. Twilio keeps its own copies of texts and voicemail recordings. When OpenAI turns a voicemail into words, it may keep it for up to 30 days (section 7). Slack keeps our alert messages until we delete them. No delete job covers these yet, so they can be kept longer than the times above.

13. Access and correction (APP 12 and 13)

You can ask what personal information we hold about you, ask us to correct it, or ask us to delete it. Email hello@maiasystems.com.au. We'll verify it's you, then respond within 30 days (usually much faster). We don't charge for access. If we refuse (for example because we must keep an invoice), we'll tell you why.

14. Data breaches

If we become aware of a breach likely to cause serious harm, we will assess it promptly, contain it, notify affected clients within 2 business days of discovery, and — where the Notifiable Data Breaches scheme applies — notify the OAIC and affected individuals as the law requires.

15. Website, cookies and analytics

Our website is hosted on Vercel. Vercel keeps standard server logs (IP address, browser type, pages requested, times) for security and performance. Our website does not set cookies and does not run analytics or advertising trackers. Our setup app (/setup) saves its own page files on your device so it can work offline; this is not a cookie and does not track you. If any of this changes, we will update this policy first.

16. Complaints

Write to hello@maiasystems.com.au with "Privacy complaint" in the subject. Our director will acknowledge within 5 business days and aim to resolve within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner: oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001.

17. Changes and contact

We may update this policy. The current version always lives at www.maiasystems.com.au/privacy, and older versions are available on request.