Last updated 1 October 2026

Privacy policy

Heelo is an AI receptionist for Australian trade and service businesses. It answers the calls a business owner misses, books jobs and takes messages. This policy explains what personal information Heelo handles, why, who it goes to, and how to get at it or have it removed. It's written to meet the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Heelo is run by Adrien Kee Foong Chu Chung Chuck (ABN 87479917564), "we" in this policy. For anything privacy-related, email adrianchucc@gmail.com.

Who this covers

Business owners

What we collect: your name, business name, trade, services, service area, work days and booking times, quote policy and anything else you tell the assistant to know; your mobile number; the voice and greeting you pick; and the Heelo number we issue you. We send a one-time code to your mobile to prove it's yours. We keep a scrambled (hashed) form of the code only until it's used or expires.

Why: to answer your calls the way you've set up, to log you in (your mobile is your login, so there's no password), to text you bookings and messages, and to contact you about your account.

Texting your customers back: when you reply to a caller or a customer's text from your dashboard, we send it from Heelo's number to the number they rang or texted from, and keep it with that message or call (in your data download, and deleted with your account).

A second mobile: you can add one more mobile, such as a partner's or your office's, to get the same booking and message texts you do, including the morning text. We text that phone a code first, and nothing is sent to it until its holder confirms the code. We keep the number (and a name for it, if you give one) with your account until you remove it or delete the account. It never gets login codes or texts about your account, and whoever holds it can reply STOP at any time.

Your bookings calendar: if you turn on the calendar link in your dashboard, your bookings (with callers' names, numbers and addresses) are published at a private address that your calendar app, such as Google or Apple Calendar, fetches. Anyone with the link can see them, so keep it to yourself; making a new link or turning it off stops the old one working straight away.

Callers

When Heelo answers a call, the assistant always says up front that it's an AI.

What we collect: the number you're calling from (as your phone company passes it on), and what you choose to tell the assistant to book a job or leave a message: usually your name, a contact number, the address of the job and what the job is.

Why: to pass your booking or message to the business you rang, and, if you booked from a mobile, to text you the booking details and a reminder the afternoon before. If you ring back to change or cancel a booking, the assistant finds it by the number you're calling from, and only ever reads out bookings made from that number. Your details go to that business. Heelo holds them on the business's behalf. The business decides what it does with them next, such as calling you back or quoting the job.

Booked by the business itself: if a business that uses Heelo books you in directly and asks Heelo to text you, we text the mobile number the business gives us: a booking confirmation and a reminder the afternoon before, plus a text if the business moves or cancels it. Those texts name the business and give its number.

Transcripts: we keep a written transcript of each call, and a one-line summary of it, for the business you rang. The assistant tells you this at the start of the call, and carrying on with the call is agreeing to it. The business reads both in its dashboard. They're deleted after 90 days, or straight away if the business deletes its account. We don't keep the audio: your voice is processed live, by the speech providers listed below, to hold the conversation and write the transcript. Calls to our demo line aren't transcribed. Our server logs mask callers' numbers.

Voicemail: if Heelo's assistant is unavailable, you may be asked to leave a voicemail after the beep instead. That recording is stored by Twilio, our phone provider, and played back to the business you rang. It's kept as long as the business's account is open, like any other message, unless you or the business asks us to delete it.

Our demo line: if you ring the number we publish so people can hear Heelo, we keep the number you called from and may contact you about Heelo. Ask us and we'll stop.

Replying to a text: if you reply to a text from us about your booking, or to a business that texted you through Heelo, we pass your reply on to the business that texted you last. It shows up with their bookings and messages, and we text it to them.

Texts from the business: a business can text you back from its Heelo dashboard after you've rung it or texted it. The text comes from Heelo's number, names the business, and only goes to the number you rang or texted from, never one you read out on a call. We keep what they sent with your message or call, for that business, for as long as we keep the message or call: it's in the copy of its data a business can download, and deleted with its account. Reply STOP and we won't text you again.

Businesses we contact about Heelo

We find businesses that might want Heelo from public sources: business listings (such as Google Maps) and the business's own website. We keep the business's name, trade, suburb, phone number, website and any email address it publishes for enquiries, along with notes on our contact with you. Every text and email we send says who it's from and how to opt out. If you reply to one of our texts, we keep your reply with our notes and pass it to the person who contacted you. If you opt out, we keep your number or address only to make sure we never contact you again.

Opting out of texts

Every text from Heelo comes from one number. Reply STOP to any of them, or tell us in your own words ("unsubscribe", "stop texting me"), and we stop texting that number straight away. The only exceptions are a login code you ask for, and notices to a business owner about their own account, such as a failed payment or a change to their login. We keep the number on a do-not-text list so it stays that way. Reply START to undo it.

Who we share it with

We don't sell personal information or use it for advertising. Callers' bookings and messages go to the business they rang. Otherwise we only share information with the service providers that make Heelo work, and only what each one needs:

Most of these providers are based in, or process data in, the United States and may use other countries too. We choose providers that commit to protecting the data and not using it for their own purposes beyond providing the service. We may also disclose information where the law requires it.

The browser demo call uses your browser's own speech recognition, which may send your audio to your browser's maker (for example Google, for Chrome).

Cookies

We use one cookie: a login cookie that keeps you signed in. There are no analytics or advertising cookies.

Keeping it safe

Data travels encrypted between your device, our servers and our providers. Access is limited to the people who run Heelo. Login codes are stored hashed, login sessions can be ended from your dashboard ("Log out everywhere"), and the endpoints that send texts or cost money are rate-limited against abuse. Calendar links use long random addresses that can't be guessed, and can be replaced at any time.

How long we keep it

We keep your account details, bookings, messages and call log while your account is open, so you can see them. If your subscription ends and you don't resubscribe, we delete your account and all of that 12 months after it ended, and text you a month before. Delete your account from the dashboard and they're deleted straight away, along with any voicemail recordings; or email us and we'll do it within 30 days. Either way, copies in our backups are deleted as those backups expire, within 30 days. We only keep anything longer where the law requires it. Server logs are kept for a limited time to run and secure the service.

Call transcripts and their summaries are the exception: they're deleted 90 days after the call, even while the account is open, and they aren't copied into our backups.

Seeing, fixing or deleting your information

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email adrianchucc@gmail.com. Business owners can do all three from the dashboard at any time: change their details, download everything we hold about their business, or delete their account. If you were a caller, we may need to check with the business you rang, because the booking or message is theirs. We'll reply within 30 days.

Complaints

If you think we've mishandled your information, email adrianchucc@gmail.com and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy, we'll update the date at the top. If the change matters to how we use your information, we'll tell business owners by text or email first.