Privacy policy

Alony AI Privacy Policy

Last updated: 7 August 2026
Effective: 7 August 2026

Alony AI is operated by Jack West trading as Spark Integrations (ABN 87 983 457 353), based in New South Wales, Australia. In this policy, "Alony", "we", "us" and "our" mean that business.

This policy explains what personal information we handle when you use Alony AI, why we handle it, who we share it with, how long we keep it, and what you can do about it. It applies to the Alony website at alony.ai, the Alony web application, and the Alony mobile apps for iOS and Android.

Alony AI provides AI voice agents that answer and make phone calls for businesses. That means we handle two very different kinds of personal information, and the difference matters for your rights. Section 2 explains it.

Contact for any privacy question, request or complaint: admin@alony.ai

1. Summary

This is a plain summary. It is not a substitute for the full policy below.

• If you are an Alony customer, we collect your name, business details, email address, phone number, plan and usage, and support requests.
• If you called a business that uses Alony, we handle a recording of that call, a transcript, your phone number, and any name or details you gave. We handle that on behalf of the business you called, not for our own purposes.
• We keep call recordings and transcripts for 12 months, then delete them.
• We do not use your call recordings, transcripts or business data to train AI models.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising.
• We use overseas service providers, mostly in the United States, to run the product.
• You can ask us for access to your information, correction, or deletion. Section 13 explains how.

2. Two roles, and why it matters

We handle personal information in two distinct roles.

2.1 As the business responsible (our customers)

When you sign up for Alony, we decide what to do with your account information: your name, business name, email address, phone number, billing details and how you use the product. For that information, we are the responsible entity. Under the GDPR the term is controller. You deal directly with us about it.

2.2 As a service provider (calls handled by your agent)

When an Alony agent answers or makes a call, we capture a recording, a transcript, the other person's phone number, and whatever they said. We handle that information on the instructions of the Alony customer whose agent took the call. They decide why the calls happen, what the agent asks, and what is done with the result. Under the GDPR we are a processor and the customer is the controller. Under the CCPA we act as a service provider.

This has a practical consequence. If you were a caller and you want your call recording deleted, the business you called controls that decision, not us. We will help you reach them, and we will act on their instruction, but we cannot unilaterally delete a record that belongs to their account. Section 13.5 explains what to do.

2.3 What Alony customers are responsible for

If you use Alony to handle calls, you are the responsible entity for those calls. You are responsible for:

• telling callers that the call is being recorded, and obtaining consent where the law requires it;
• having a lawful basis and your own privacy policy covering the calls your agent handles;
• what you instruct your agent to ask and record;
• how you use, export or disclose the call data in your account.

Section 6 covers recording consent in more detail. It is the single most important obligation you take on when you use this product.

3. What we collect

3.1 Account and business information

Collected when you sign up and while you use the product.

• Identity and contact — Your name, business or company name, email address, phone number
• Account — Password (stored only as a cryptographic hash, never in readable form), email confirmation status, time zone
• Subscription — Plan, account status, billing period, minutes and tickets used against your allowance, agent count
• Billing — Subscription status and payment history. Card numbers are handled by Stripe and never reach our systems.

3.2 Agent configuration

What you set up for each voice agent: agent name, the caller name it presents, description, greeting message, personality instructions, selected voice, assigned phone number, call direction, and any webhook address you configure for sending call results to your own systems.

3.3 Call information

Created every time one of your agents handles a call. This is the most sensitive category we hold.

• Call recording — An audio file of the conversation
• Transcript — A written record of what was said by both parties
• Caller phone number — The number of the person on the other end of the call
• Caller name — Where given or identified during the call
• Summary and outcome — An AI-generated summary, the call result, and the inquiry type
• Call metadata — Date, time, duration, direction, and which agent handled it

A call recording and transcript can contain anything the caller chose to say. That may include health information, financial details, or other sensitive information, depending on the business being called and what the caller volunteered. We do not ask for sensitive information and we do not target it, but we recognise that voice conversations can contain it, and we secure all call data on that basis.

3.4 Support requests

When you raise a support ticket: the issue title, description, type, status, your email address, submission date, and any call recording you attach to it. Support tickets are tracked in Linear, our issue-tracking system.

3.5 Technical and diagnostic information

• Error reports. When the application encounters an error we send a diagnostic report to Sentry so we can fix i
• No social or third-party sign-in. Sign-in is by email address and password only.

The alony.ai marketing website is a separate system from the application and may use cookies or analytics. Section 16 covers that.

4. Where the information comes from

• From you, when you sign up, configure an agent, raise a support ticket, or contact us.
• From callers, when they speak to one of your agents.
• From our telephony providers, which supply the phone number, call direction and duration.
• From Stripe, which tells us whether a subscription is active, past due or cancelled.
• Generated by us, including transcripts, summaries, outcome classifications and usage totals.

5. Why we handle it, and our legal bases

• Providing the product: running your agents, handling calls, showing you call history and analytics — Performance of a contract
• Billing, invoicing and collecting payment — Performance of a contract
• Support, troubleshooting and responding to your requests — Performance of a contract, and our legitimate interest in supporting customers
• Security, fraud prevention, abuse prevention and rate limiting — Legitimate interests, and legal obligation
• Fixing faults and improving reliability — Legitimate interests
• Product announcements and service notices — Legitimate interests
• Marketing emails about Alony — Consent, which you can withdraw at any time
• Meeting legal, tax and record-keeping obligations — Legal obligation

Where we handle call information as a processor, our legal basis is our customer's instruction, and our customer is responsible for establishing their own lawful basis for the call.

Under the Australian Privacy Act, we collect personal information because it is reasonably necessary for our business of providing AI voice agents.

6. Call recordings and consent

Read this section if you use Alony to handle calls. It describes an obligation the law places on you, not on us.

Alony records and transcribes calls. That is what the product does. Australian law about recording a conversation is set at state and territory level, and it is not uniform:

• In some states and territories, all parties to the conversation must consent to it being recorded.
• In others, one party's knowledge is enough in some circumstances.
• The Telecommunications (Interception and Access) Act 1979 (Cth) applies on top of state law and restricts intercepting communications passing over a telecommunications system.
• Calls to or from other countries may be subject to that country's law. Several jurisdictions, including a number of US states, require the consent of all parties.

You are responsible for obtaining any consent the law requires, in every place you or your callers are located. In practice that usually means your agent's greeting must clearly state that the call is being recorded, before the conversation begins.

Alony gives you the tools to do this. You control the greeting message for every agent, and you can put a recording notice in it. We do not add a recording disclosure automatically, and we do not check whether yours is adequate. Configuring it is your decision and your responsibility.

If you make outbound calls, you are also responsible for complying with the Do Not Call Register Act 2006 (Cth), the Spam Act 2003 (Cth) where you send messages, and equivalent rules in any other country you call.

We may suspend an account if we reasonably believe it is being used to record or call people unlawfully.

7. Artificial intelligence and automated decisions

7.1 How AI is used

Alony uses AI to do the following:

• convert speech to text, to produce transcripts;
• generate the agent's spoken responses during a call, using a synthetic voice;
• summarise a call after it ends, and classify its outcome and inquiry type.

Calls are handled by an automated agent. A caller is talking to software, not to a person. We require our customers to be honest about that, and the agent identifies itself as an AI assistant where the law or the circumstances require it.

7.2 Automated decisions

The agent decides, within the instructions its owner configured, what to say next in a conversation, how to classify a call, and how to summarise it. These decisions are made by a computer program using information provided during the call.

The kinds of personal information used in these automated processes are: what the caller says during the call, the caller's phone number and name, and the agent configuration set by our customer. The kinds of decisions made are: what the agent says in response, how a call is categorised and summarised, and whether a call is escalated or routed according to the customer's configuration.

Alony does not make automated decisions about credit, employment, insurance, government benefits, or any other matter that determines a legal right or entitlement. If a caller wants a human being instead of an agent, they should ask, and the business they called is responsible for providing one.

8.1 Service providers

These providers process personal information on our behalf, under contract, only for the purposes we specify.

• Supabase — Database, authentication and file storage. Holds account records, call records and recordings. — United States
• Vercel — Hosting and content delivery for the web application. — United States and global edge network
• Stripe — Subscription billing and payment processing. Handles card details directly; we never see them. — United States, Australia
• Twilio — Telephony. Carries calls and supplies phone numbers. — United States, Australia
• Retell AI — Voice agent orchestration and real-time call handling. — United States
• ElevenLabs — Speech synthesis, giving the agent its voice. — United States
• n8n — Workflow automation connecting the call pipeline to our database. — European Union
• Sentry — Error and fault reporting, configured to exclude personal information. — United States
• Linear — Support ticket tracking. — United States

We review this list as our systems change and update this policy when it does. If you need to know precisely which providers touch your data at a point in time, ask us at admin@alony.ai.

8.2 Other disclosures

• Between you and your callers. Call data in your account is visible to you, as the account holder, and to anyone you give access to.
• Our staff. A small number of authorised people can access customer and call data through an administrative console, for support, troubleshooting, billing and abuse investigation. Access is limited to those who need it, and it is not used for any other purpose.
• Legal requirements. We may disclose information if required by law, a court order, or a binding request from a regulator or law enforcement agency. Where we are permitted to tell you about such a request, we will.
• Protecting people. We may disclose information where we reasonably believe it is necessary to prevent a serious threat to someone's life, health or safety, or to investigate unlawful activity.
• Business transfer. If the business is sold or restructured, information may transfer to the new owner. It stays subject to this policy, or to a policy at least as protective, and we will tell you before it happens.

9. Sending information overseas

We are based in Australia, and most of our service providers are in the United States, with workflow automation in the European Union. Using Alony means your information, including call recordings and transcripts, is stored and processed overseas.

Under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles. We do this by contracting with established providers who commit to equivalent protections.

For transfers of personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where the UK GDPR applies. You can ask us for details at admin@alony.ai.

10. How long we keep it

• Call recordings and transcripts — 12 months from the date of the call, then permanently deleted
• Call metadata (date, duration, outcome, agent) — 12 months, deleted with the recording
• Account and business information — For as long as your account is open
• Agent configurations — For as long as your account is open
• Support tickets — 24 months from resolution
• Billing and tax records — 7 years, as required by Australian tax law
• Error and security logs — 90 days

When you close your account, we delete your account information, agent configurations and call data within 30 days, except where we are required to keep records for tax, legal or dispute purposes. Billing records are retained for the 7 years Australian tax law requires.

Deleted information is removed from our live systems immediately and from routine backups within 35 days, as backups age out on their normal cycle.

If you need call data kept for longer than 12 months, for example because of an industry record keeping obligation, contact us at admin@alony.ai before it expires. Export your data if you need a permanent copy.

11. How we protect it

• Encryption. Data is encrypted in transit using TLS, and encrypted at rest by our database and storage providers.
• Tenant isolation. Every customer's data is separated at the database level by row-level security policies, so one customer's account cannot read another's.
• Recording access. Call recordings are not publicly accessible. Playback requires a short-lived signed link, valid for five minutes, issued only after we verify the request comes from the account that owns the recording.
• Authentication. Passwords are stored as cryptographic hashes. Repeated failed sign-in attempts trigger a temporary lockout.
• Rate limiting. Sensitive operations are rate limited to resist automated attacks.
• Least privilege. Staff access to production data is limited to those who need it for their role.
• Security headers and transport policy. The application enforces HTTPS and a restrictive set of browser security headers.

No system is perfectly secure, and we will not claim otherwise. If you find a security problem, please report it to admin@alony.ai. We will acknowledge your report and we will not pursue anyone who reports a genuine vulnerability to us in good faith.

12. If there is a data breach

We maintain a response plan for data breaches.

If a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and every affected individual as soon as practicable, as the Notifiable Data Breaches scheme requires.

Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach where required, and notify affected individuals without undue delay where the risk to them is high.

Where we hold information as a processor for one of our customers, we will notify that customer without undue delay so they can meet their own obligations.

13. Your rights

13.1 Everyone

Whatever country you are in, you can ask us to:

• tell you what we hold about you and give you a copy;
• correct anything inaccurate, out of date or incomplete;
• delete your information, subject to our legal retention obligations;
• stop sending marketing, at any time, with no effect on your service.

Email admin@alony.ai. We respond within 30 days. We do not charge for a reasonable request. We may need to verify your identity first, and we will only ask for what is necessary to do that.

If we refuse a request, we will tell you why in writing, and tell you how to complain.

13.2 Australia

Australian Privacy Principles 12 and 13 give you the right to access and correct your personal information. Sections 13.1 and 15 describe how to exercise those rights and how to complain.

You can also deal with us anonymously or under a pseudonym where it is lawful and practicable, although we generally cannot provide the product without an email address for your account.

13.3 European Economic Area and United Kingdom

If the GDPR or UK GDPR applies to you, you also have the right to:

• restrict how we handle your information while a dispute about it is resolved;
• object to handling based on our legitimate interests, and to direct marketing at any time;
• portability: receive information you gave us in a structured, machine-readable format, and have it sent to another provider where technically feasible;
• withdraw consent at any time, where we rely on consent;
• not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. As section 7.2 explains, Alony does not make decisions of that kind.

You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office.

13.4 California

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to delete it, to correct it, to opt out of sale or sharing, and to limit the use of sensitive personal information. You also have the right not to be discriminated against for exercising these rights, and we do not.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months, including for anyone we know to be under 16.

Where we act as a service provider for one of our customers, direct your request to that business.

You may use an authorised agent, with written proof of authorisation.

13.5 If you called a business that uses Alony

If an Alony agent answered your call, or called you, and you want your recording accessed or deleted:

Contact the business you called. They control that data and they decide. It is their record of their conversation with you, held in their account.

If you cannot identify or reach them, email admin@alony.ai with the phone number you called from and roughly when. We will identify the relevant customer and pass your request to them, and we will act on their instruction. We will tell you what happened.

We will always act on a valid legal requirement regardless of a customer's instruction.

14. Children

Alony is a business product. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

An agent may take a call from a child, because a child may telephone a business. That is call information handled on behalf of the business being called, and section 2.2 applies to it.

If you believe we hold information about a child that should be deleted, email admin@alony.ai and we will deal with it promptly.

15. Complaints

If you are unhappy with how we have handled your personal information, tell us first. Email admin@alony.ai with "Privacy complaint" in the subject line and describe what happened.

We will acknowledge your complaint within 5 business days and give you a written response within 30 days.

If you are not satisfied with our response, you can escalate:

• Australia: Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.
• United Kingdom: Information Commissioner's Office, ico.org.uk.
• European Economic Area: your national data protection authority.
• California: the California Privacy Protection Agency, or the California Attorney General.

You do not have to complain to us first, but it is usually faster.

16. Cookies and the website

The Alony application uses browser storage only for what it needs to work: keeping you signed in and remembering your preferences. These are strictly necessary and there is no advertising or tracking cookie in the application.

The alony.ai marketing website is built on a separate platform and may set cookies for analytics and to remember your preferences. Where required, you will be asked to consent before any non-essential cookie is set. You can clear or block cookies in your browser settings, though parts of the site may then not work properly.

We do not respond to browser "Do Not Track" signals, because there is no agreed standard for what they mean. We do honour Global Privacy Control signals as an opt out of sale or sharing where the law requires it. As noted above, we do not sell or share personal information in any case.

17. The mobile apps

The Alony apps for iOS and Android show the same application in a native wrapper. Everything in this policy applies to them.

Points specific to mobile:

• The apps do not request access to your microphone, camera, contacts, photos or location.
• The apps contain no advertising or analytics SDKs and do no tracking as Apple defines it, so we do not present an App Tracking Transparency prompt.
• Subscriptions are managed through our website using Stripe, not through in-app purchase.
• Your device operating system may collect its own diagnostic information. That is governed by Apple's or Google's privacy policy, not ours.

18. Changes to this policy

We update this policy when the product or the law changes. The "last updated" date at the top always reflects the current version.

If a change materially affects your rights or how we handle your information, we will tell you by email, or by a notice in the application, at least 14 days before it takes effect. Continuing to use Alony after that means you accept the updated policy.

We keep previous versions. Ask at admin@alony.ai if you want one.

19. Contact us

Jack West trading as Spark Integrations
ABN 87 983 457 353
New South Wales, Australia

Privacy enquiries, requests and complaints: admin@alony.ai

We respond to privacy requests within 30 days.