Privacy Policy

Nimble is an AI phone receptionist for Australian small businesses. Nimble answers a business’s inbound phone calls, can record them, transcribes them, summarises them, can book appointments into the business’s calendar and can send text messages to its customers.

Nimble is operated by Michael Louis Russo trading as Nimble AI, ABN 47 795 081 403 (we, us, Nimble).

This policy explains what personal information we handle, how and why we collect it, who we share it with (including overseas), how long we keep it, how we protect it, and how to access or correct it or make a complaint. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It covers the Nimble website (including the homepage demo), the Nimble web app and the Nimble phone receptionist.

Because Nimble answers the phone on a business’s behalf, this policy covers groups of people whose information is handled very differently.

• The business owner and their team — the customer who signs up and configures the receptionist, and the team members they invite. You hold the account.
• The caller — a third party who rings or texts a business that uses Nimble. Callers do not have a Nimble account and did not sign up. Their information is captured because they contacted a business that uses Nimble.
• Website visitors — people who browse the Nimble website or try the homepage demo (see The homepage demo).

Account and business information

• Your name, business name, work email address and business phone number.
• Your password, stored only as a one-way hash — we never see or store it in plain text.
• If you turn on two-step sign-in, the secret for your authenticator app (stored encrypted) and your recovery codes (stored only as hashes).
• Team member names, email addresses and roles that you invite to your account.
• Business configuration: trading hours, services, service areas, greeting, transfer number, voice selection, notification settings and workflow settings.
• Your plan and billing details: the billing contact, invoices and payment history. Card payments are handled by Stripe; Nimble never sees or stores your full card number.

Call information

• Audio recordings of inbound calls answered by Nimble, while the business has recording on. Recording is on by default (see Call recording).
• Transcripts of those calls, produced automatically from the audio. Calls are transcribed whether or not recording is on.
• AI analysis generated from the transcript — a call summary, the caller’s apparent intent, the outcome, sentiment, whether the call needs the owner’s attention, questions the receptionist could not answer, and a running summary of each customer across their calls.
• Call metadata: the caller’s phone number (where the network provides it), the number dialled, date, time, duration and whether the call was answered, transferred or missed.

Personal information about the business’s customers

Nimble captures whatever a caller says, which usually includes:

• The caller’s name and contact phone number.
• The address where the work or visit is needed, and sometimes access notes.
• What the call is about — what needs doing, urgency, preferred times, prices discussed.
• Anything else the caller volunteers during the conversation.

Booking, messaging and notification information

• Appointment details written into a connected Google or Microsoft Outlook calendar, and the calendar availability we read to find a free time.
• Text messages sent to the business’s customers, text replies they send back, and opt-out requests (for example “STOP”).
• Notifications we send the business owner by email or text, which can include a caller’s number, name and a summary of the call, and a daily digest of the day’s calls.

Website scan information

When you ask Nimble to build your knowledge base, we fetch and read the publicly available pages of the business website you nominate and store the extracted text — services, prices, service areas, frequently asked questions — so the receptionist can answer questions about your business.

Support information

If you generate a support code in the app, we save a snapshot of your account’s service diagnostics so our staff can look into the problem. Snapshots are deleted automatically after 30 days.

Homepage demo

If you try the live demo on our homepage, we handle your voice, your IP address, your email address and the website address you enter, as described in The homepage demo.

Technical information

• Log data held by our hosting providers: IP address, browser and device type, pages and addresses requested, and error and performance logs.
• Security records: failed and blocked sign-in attempts, sign-outs and team changes, and a log of actions taken by Nimble administrators.
• Aggregate analytics from Vercel Web Analytics, which runs on every page of the Nimble website and web app. It does not use cookies.
• A cookie that keeps you signed in, and browser local storage used to remember preferences such as light or dark mode and which setup steps you skipped.

• From you, when you sign up, configure your receptionist, invite your team or contact us.
• From callers, through the phone call or text message itself. The phone network gives us the caller’s number unless they have blocked it.
• From your website, when you ask us to scan it, and from the website a demo visitor enters.
• From your calendar, if you connect one.
• Automatically, from your browser and our systems as you use the website and app.

We hold what we collect in our database, which is hosted in Singapore, and with the providers listed in Who we share it with. In particular, call recordings are held by Telnyx, our telephony provider, and not in our own database — Nimble stores a reference to each recording and fetches it when you play it. For calls answered by Nimble’s built-in Telnyx voices, Telnyx also holds the conversation and its AI analysis, which we read back to build the transcript.

This is the most important section in this policy for anyone running a business on Nimble.

Nimble records inbound calls by default. The business owner can switch recording on or off at any time with the Record calls switch on the Receptionist page. While recording is on, the business’s greeting must tell callers that the call is recorded: Nimble’s servers will not save a greeting that leaves this out, and a greeting saved before this check existed has the standard notice added when the call is answered. The standard notice tells callers the call is recorded, why, and that they can say if they would rather it was not. On some voices the notice is spoken by the AI, so its exact wording can vary slightly.

If a caller says they would rather not be recorded, the receptionist stops the audio recording. The call is still transcribed and summarised so that the business gets the message.

While recording is off, the greeting must not say that the call is recorded. When recording is off:

• Nimble’s OpenAI voices do not record the call at all.
• Nimble’s built-in Telnyx voices may still capture the first few seconds of the call before recording switches off, and the caller is told so.
• The call is still transcribed and analysed by AI, and the transcript and summary are kept, because that is how the business receives the caller’s message.

In Australia, recording a phone conversation is regulated by the Telecommunications (Interception and Access) Act 1979 (Cth) and by state and territory surveillance devices and listening devices legislation. The state and territory laws are not the same: what counts as adequate notice, whether one party or all parties must consent, and what you may then do with the recording vary depending on where the parties to the call are located.

We handle personal information to:

• Answer calls, understand what the caller wants and respond to them.
• Take messages, capture job and appointment details and pass them to the business.
• Check the business’s calendar and book appointments into it.
• Send text messages to the business’s customers at the business’s direction, and honour opt-out requests.
• Show the business its calls, recordings, transcripts, summaries and customer records in the Nimble dashboard, and send it notifications and a daily digest.
• Answer callers’ questions using the knowledge base built from the business’s website.
• Create and manage accounts and authenticate users.
• Run the homepage demo and prevent it being abused.
• Provide support, diagnose faults and improve the reliability and quality of the service.
• Detect, investigate and prevent misuse, fraud and security incidents.
• Meet our legal obligations and respond to lawful requests.

We do not sell personal information. We do not use call recordings, transcripts or callers’ personal information to advertise to anyone.

Nimble uses AI from two providers, depending on the voice the business chooses.

• Nimble’s built-in voices run on Telnyx. Telnyx’s AI assistant converts the caller’s speech to text, generates the receptionist’s replies with a language model and speaks them. Telnyx uses other model providers to do this — for example, a speech-to-text provider and a language-model provider — chosen within Telnyx’s platform. Telnyx stores the conversation and runs an automated analysis of it after the call.
• Nimble’s OpenAI voices run on OpenAI. The call audio, the caller’s number and a brief about the business are sent to OpenAI, which listens and replies in real time.

After every call, the transcript is sent to OpenAI to produce the summary and the other analysis described in What we collect. OpenAI is also used to read the business’s website when building its knowledge base, to suggest answers to common questions, and when the owner tests the receptionist in the app.

Our requests to OpenAI for summaries, analysis and website reading are sent with OpenAI’s setting that tells it not to store the response for later retrieval. OpenAI may still keep API data for a limited period under its own terms, for example to detect abuse. Nimble does not train AI models on your calls, and we have not allowed our AI providers to use your information to train theirs. OpenAI states that data sent through its API is not used to train its models by default, and may be kept for up to 30 days to detect abuse. Telnyx handles call data under its customer terms and privacy policy.

AI output can be wrong. Summaries, intents and outcomes are generated automatically and are not a substitute for listening to the call or reading the transcript.

If a caller asks whether they are speaking to a person, the receptionist tells them it is an AI. Whether the greeting says so up front depends on the greeting the business sets.

Nimble’s receptionist is a computer program. During a call or text conversation it uses what the caller says — their name, phone number, address, the job or appointment they describe, and how urgent it is — to make some decisions without a person reviewing them at the time:

• whether to offer and book, move or cancel an appointment, and at what time;
• whether the requested work is something the business takes on, or is in an area it services;
• whether the call is urgent — for example a safety emergency — and should be transferred to a person or flagged to the business;
• whether a text reply means the person has asked not to be texted again.

The business sets the rules these decisions follow: its hours, services, service areas, booking rules and transfer settings. A caller can always leave a message for the business and, where the business has set up call transfers, ask to be put through to a person. The business can review every call in its dashboard.

The receptionist does not make decisions about credit, insurance, employment or eligibility for any benefit, and businesses must not configure it to.

Nimble does not set out to collect sensitive information as the Privacy Act defines it — for example health information, or details of someone’s racial or ethnic origin, political opinions, religion, sexual orientation or criminal record.

Because Nimble handles open conversations, a caller may still volunteer sensitive information, and it is then captured in the recording, transcript and summary along with everything else said on the call. If a business uses Nimble for health-related enquiries, callers may share health information. It is handled as sensitive information: it is used only to deal with the caller’s enquiry for that business, is subject to the same safeguards, sharing and retention as the rest of the call described in this policy, and is not used for any other purpose.

The receptionist is instructed never to ask for passwords, one-time codes, full payment card numbers, bank details, tax file numbers, Medicare numbers or other government identifiers. If a caller reads them out anyway, they will be in the recording and transcript.

Businesses must not configure Nimble to collect sensitive information from callers without their consent.

Callers do not have to give their name, and can ask general questions without identifying themselves. The phone network gives us the caller’s number unless they have blocked it. To book an appointment, arrange a callback or receive a text, a caller will need to give enough detail for the business to contact them.

You can try the homepage demo without giving your name, but it asks for your work email. A Nimble account needs a real email address and business details, because we need to be able to contact the account holder.

We use third-party providers to deliver the service. They receive the information they need to perform their function for us. Each is listed with the country where it processes or stores the information.

• Telnyx — phone numbers and call carriage; the AI assistant behind the built-in voices (speech-to-text, language model and speech), conversation storage and post-call analysis; call recordings; and text messages. United States (call audio may also pass through Telnyx’s network in Australia).
• Model providers used by Telnyx — the speech-to-text and language models that run the built-in voices inside Telnyx’s platform. The countries depend on the models Telnyx uses and may include the United States and other countries.
• OpenAI — real-time conversation for the OpenAI voices and the homepage demo; call summaries and analysis; reading business websites; suggested answers; and the in-app test of the receptionist. United States.
• Render — hosts the Nimble application servers and the database where account, call, transcript and customer records are stored, with its logs and disk snapshots. Singapore.
• Cloudflare — the network edge in front of our Render servers, which all traffic to them passes through. Global network, including Australia and the United States.
• Vercel — hosts the Nimble website and web app, passes app requests to our servers, and provides Vercel Web Analytics. United States and Vercel’s global edge network.
• Resend — all email: account verification, password resets and team invitations, and the notifications and daily digest sent to business owners, which can include callers’ phone numbers, names and call summaries. United States.
• OpenStreetMap Foundation (Nominatim) — finds the map position of the business location saved in Settings, once per address, so the dashboard can show the local weather. Only the business’s own location is sent, never anything about its customers. United Kingdom.
• MET Norway — the weather forecast shown on the dashboard. It receives only the business’s map position, rounded to about a kilometre. Norway.
• Stripe — processes subscription payments: the business’s billing name and email address, the plan and its invoices, and the card details you give Stripe, which Stripe holds rather than Nimble. United States.
• Twilio — may be used to send text messages instead of Telnyx, including the recipient’s number and the message content. United States.
• Google or Microsoft — calendar, only if the business connects a calendar. We read availability and write appointment details, including the customer’s name, phone number, address and job description. Stored in the provider’s own regions, which may be outside Australia.

We may also disclose personal information:

• To our professional advisers, such as lawyers and accountants, under a duty of confidentiality.
• Where we are required or authorised by law to do so, including in response to a court order, subpoena or a lawful request from a regulator or law enforcement agency.
• Where it is necessary to lessen or prevent a serious threat to someone’s life, health or safety.
• To a purchaser, as part of a sale or restructure of our business, subject to equivalent privacy protections.

Nimble’s database and servers are in Singapore, and call audio, transcripts, summaries and callers’ details are also processed by the providers above in the United States. Information may also be processed in other countries where Cloudflare’s and Vercel’s edge networks, the model providers used by Telnyx, or Google or Microsoft (if a calendar is connected) operate. Nimble does not currently keep personal information only in Australia.

We choose providers that offer data protection terms for their business customers. Under APP 8 and section 16C of the Privacy Act, we remain accountable for how these overseas providers handle the personal information we send them.

An overseas recipient may be subject to the laws of the country it operates in, and those laws may allow access to information in ways Australian law does not.

On our homepage you can enter a business website address and talk to a temporary receptionist built from it. The demo cannot book appointments, send messages or contact any real business, and it is not linked to any Nimble account.

• Your voice. We don’t record the demo. Your microphone audio goes directly from your browser to OpenAI in the United States over an encrypted connection, and is processed live to produce the receptionist’s replies. Nimble does not receive or store the audio. OpenAI handles it under its own terms, which may include keeping API data for a limited period to detect abuse. Please don’t share personal details in the demo that you wouldn’t want processed this way.
• The website you enter. We read up to a few public pages of that site (we do not check the site’s robots.txt file) and send what we find about the business to OpenAI to brief the receptionist. The text we read is removed when the demo ends, or at our next clean-up once the demo is 15 minutes old.
• Your email address. We save the email you give us, with the website address and the business name the demo used, so we can follow up with you about a Nimble trial, and to see whether you went on to create an account. We only use it to contact you about Nimble, and keep it until you ask us to delete it (email support@nimbleai.com.au).
• Your IP address and the website address. We keep these with the demo session to limit how many demos one visitor can run (three an hour, one at a time). They are deleted about an hour after the demo starts, at our next clean-up, which runs when someone next starts a demo — so occasionally a little later.
• How the demo went. For 90 days we keep a record of each demo without your IP address: the website’s domain, the business name used, whether the call connected, how long it lasted, how it ended, any problem such as a blocked microphone, and a general device type.
• Server logs. Our hosting providers’ logs may also record your IP address and the address you entered, for example if a scan fails.

We have not yet started deleting call data on a schedule. Until we do, and we update this policy to say so:

• Call recordings, transcripts, summaries, customer records, bookings and text conversations are kept while the business’s account is open, and for 30 days after its plan ends, as set out below.
• Text opt-out records (a phone number, the business and the time) are kept, as evidence under the Spam Act 2003 that we stopped texting when asked.
• Billing and payment records are kept for as long as tax law requires, generally five years.
• Some records expire automatically: support snapshots after 30 days, and demo records as set out in The homepage demo.

When a plan ends

A business’s plan ends when a cancellation takes effect at the end of its paid period or free trial, or if the plan is otherwise ended. Nimble then stops answering the business’s calls, and we email the owner to say the plan has ended, with the date the business will be deleted. For 30 days the owner can still sign in to view the business’s data, ask us for a copy of it, and restart a plan to restore everything, including the business’s Nimble number. After 30 days the business, its data and its Nimble number are permanently deleted or released, as described below.

A failed payment does not end a plan: after Stripe’s retries the account is suspended until the amount is paid.

When the owner closes the account

The owner can close a business’s account in Settings, under Account. Closing takes effect straight away: the plan is cancelled, the business’s Nimble number is released immediately and cannot be recovered, we ask Telnyx to delete the business’s call recordings and stored conversations, we withdraw Nimble’s access to a connected calendar, and alerts, customer texts and reminders stop. For 30 days the owner can still sign in to download a copy of the business’s data. After 30 days the business is deleted, as described below.

When a business is deleted

A business is deleted 30 days after it closes: when its plan ends, when its owner closes the account, or when we close it at the owner’s request. We then delete the business’s data from our database — its calls, transcripts, customers, bookings, messages and settings, the owner’s login and the team’s access to the business — and, if that was not already done when the account was closed, ask Telnyx to delete the business’s call recordings and stored conversations, and release its Nimble number. If a Google calendar was connected we withdraw Nimble’s access to it.

Some records remain after a business is deleted:

• text opt-out records, for the Spam Act reason above;
• billing and payment records, which tax law requires us to keep, and Stripe’s own records;
• our log of administrator actions, in which the owner’s email address is replaced with a one-way code;
• records our providers keep under their own terms, such as Telnyx’s call and billing records and the email and text-message logs of Resend, Telnyx and Twilio;
• appointments already written into the business’s own calendar;
• anything we are required by law to keep.

Backups

Our hosting provider takes a daily snapshot of our database disk and keeps each snapshot for 7 days, so deleted information can remain in a snapshot for up to 7 days.

The steps we take include:

• Encrypting data in transit using TLS, between browsers, our servers and our providers.
• Storing passwords only as salted one-way hashes (PBKDF2-SHA256).
• Two-step sign-in with an authenticator app, available to every account (Settings, Security) and required before Nimble staff can use any administrator access.
• Limiting repeated sign-in, password-reset and code attempts.
• Checking on our server, for every request, that the signed-in user belongs to the business whose data they are asking for, so one account cannot read another account’s calls or customers.
• Encrypting calendar connection tokens and two-step sign-in secrets in our database, and storing single-use links and codes only as hashes.
• Logging sign-in security events and the actions of Nimble administrators.

Apart from the items above, Nimble does not add its own encryption to stored data. No system is completely secure, and we cannot guarantee that personal information will never be accessed without authorisation. Nimble does not hold any security certification.

To support a business, a Nimble administrator can open that business’s account in a support mode and see what the owner sees, including calls, recordings, transcripts and customer records. Only Nimble administrators can do this, and:

• their accounts must use two-step sign-in before any administrator tool works;
• administrator sessions end 12 hours after sign-in;
• starting and ending a support session, every change made during it, and administrators’ views of customer data are logged.

We access account data only to provide support, keep the service running, investigate misuse or security issues, or meet a legal obligation.

From your Nimble account you can:

• Switch call recording on or off, on the Receptionist page.
• Change your greeting. While recording is on, it must tell callers the call is recorded.
• Disconnect a connected calendar, which stops Nimble reading or writing to it. For Google, we also withdraw Nimble’s access at Google. For Microsoft, remove Nimble in your Microsoft account settings as well. Appointments already written stay in your calendar.
• Edit or remove answers in the knowledge base built from your website.
• Invite and remove team members, in Settings, under Team.
• Turn on two-step sign-in, in Settings, under Security.
• Download a copy of your business’s calls, transcripts, customers, bookings, texts and notes, as spreadsheets, in Settings, under Account.
• Close your account, in Settings, under Account, as described in How long we keep it.

In Conversations you can also delete one caller’s conversation: their calls, recordings and transcripts, texts, emails, photos, notes and customer record. We also ask Telnyx to delete the recordings and transcripts it holds, and keep retrying for a few days if it can’t right away. Some things stay: bookings, with the name and number on them; the emails themselves in your own mailbox; a record that they opted out of texts, if they did; answers you saved to your knowledge base from their questions, without their details; and, so your plan’s usage still adds up, each call’s time, length and our phone provider’s reference for it, without their number or what was said. A few short-lived system logs clear themselves within 90 days. Deleting a single call or recording is not yet available in the dashboard, so contact us and we will do it for you.

Because you control these settings, you are also responsible for what they mean for the people who ring you.

If you are a Nimble account holder

Much of your information is visible in the dashboard, and you can correct your business details there. You can also ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing support@nimbleai.com.au. The account owner can also download a copy of the business’s data in Settings, under Account; anything else we prepare by hand. We will respond within a reasonable period, and in any event within 30 days of an access request, in line with APP 12.

We may need to verify your identity before acting on a request, and there are limited circumstances in the Privacy Act where we may refuse access or correction. If we refuse, we will tell you why in writing and explain how to complain.

If you called a business that uses Nimble

The business you rang controls the recording and transcript of your call. The quickest way to have it corrected or deleted is to contact that business directly.

You can also contact us at support@nimbleai.com.au. We will help you reach the business and, where it is appropriate and we are permitted to do so, act on your request ourselves. Please tell us the phone number you called from, the business you called and the approximate date and time, so we can find the right record.

If we suspect a data breach, we assess it promptly. If it is likely to result in serious harm to anyone, we notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act requires. Where a breach involves call data, we also tell the business concerned.

If you think we have mishandled your personal information or breached the Australian Privacy Principles, please tell us first at support@nimbleai.com.au. Set out what happened and what you would like us to do. We will acknowledge your complaint and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC), the independent regulator for privacy in Australia. Their complaint process and current contact details are at oaic.gov.au.

Nimble is a business tool. You must be at least 18 years old to hold a Nimble account. We do not knowingly market to or collect account information from children. A child may of course ring a business that uses Nimble, in which case their call is handled the same way as any other call.

We update this policy as the product and the law change. The date at the top of this page shows when it was last updated. If a change materially affects how we handle your personal information we will give you at least 30 days’ notice by email or in the app before it takes effect.

For any privacy question, request or complaint:

• Email: support@nimbleai.com.au
• ABN: 47 795 081 403

This policy sits alongside our Terms of Service and Acceptable Use Policy.