How we handle
your information.

Calso is operated by Calso Pty Ltd (ABN 68 843 826 983), based in Melbourne, Australia. When this policy says "Calso", "we", "us", or "our", it means Calso Pty Ltd.

Calso is an AI business assistant that helps small businesses manage day-to-day operations. We provide tools for voice interaction, task management, inventory, reservations, staff scheduling, document processing, and third-party integrations.

Account information. When you sign up, we collect your name, email address, and a password. If you sign up on behalf of a business, we collect the business name, type, and location.

Business data you provide. This includes documents you upload (invoices, menus, contracts), information you enter (inventory, contacts, reservations, staff schedules), and instructions you give Calso via text or voice.

Voice data. When you use Calso's voice feature, audio is streamed to our voice processing partner (ElevenLabs) for real-time transcription and response. We store transcripts of conversations. We do not store raw audio recordings.

Third-party integration data. If you connect services like Google Calendar, Google Drive, Dropbox, Xero, or Square, we access data from those services as authorised by you during the OAuth connection. This may include calendar events, files, invoices, sales data, and reviews. We only access the scopes you approve.

Usage data. We collect standard web analytics: pages visited, features used, browser type, device type, and IP address. We use this to improve the product.

Communication data. If you email us or use in-app messaging, we keep those communications to provide support.

We use your information to:

• Provide and operate the Calso service
• Process your documents and generate AI-powered summaries, actions, and insights
• Sync data between your connected third-party services
• Send you transactional emails (account confirmations, action notifications, daily briefings)
• Respond to your support requests
• Improve and develop new features
• Detect and prevent fraud or abuse

We do not use your business data to train AI models. Your invoices, staff rosters, and customer information are never fed into general model training.

We do not sell your data. Period. We share information only with:

• Service providers who help us operate Calso: Supabase (database and authentication), Vercel (hosting), Anthropic (AI processing), ElevenLabs (voice), Resend (email), and Sentry (error tracking). Each provider only receives the minimum data needed for their function.
• Third-party services you connect — data flows both ways as authorised by you. If you disconnect a service, we stop accessing it.
• Law enforcement if legally required. We will notify you unless prohibited by law.

We never share your data with other businesses, advertisers, or data brokers.

Your data is stored on servers in Australia (Supabase's ap-southeast-2 region in Sydney) and the United States (Vercel edge network, Anthropic API). Voice processing occurs on ElevenLabs servers in the US and EU.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database backups are encrypted and retained for 30 days.

When you connect a third-party service (Google, Dropbox, Xero, Square), you go through that provider's standard OAuth authorisation flow. We store the access tokens securely in our database to maintain the connection.

We request only the permissions needed:

• Google — Calendar (read/write events), Drive (read files), Business Profile (read reviews), and your email address for identification
• Dropbox — Read file metadata and content
• Xero — Read invoices and transactions
• Square — Read orders, payments, and inventory

You can disconnect any integration at any time from your dashboard. When you disconnect, we delete the stored tokens and stop accessing that service. Previously imported data remains in your Calso account unless you delete it.

We keep your data for as long as your account is active. If you delete your account, we delete all your business data within 30 days, except where we're legally required to retain it (e.g. billing records).

Voice transcripts are retained for 12 months, then automatically deleted. Usage analytics are aggregated and anonymised after 90 days.

You can:

• Access your data — export everything from your dashboard or email us
• Correct your data — edit it directly in the dashboard
• Delete your data — delete your account from Settings, or email us
• Disconnect third-party services at any time
• Opt out of non-essential emails

If you're in the EU, you also have rights under GDPR including data portability and the right to object to processing. If you're in Australia, the Australian Privacy Principles (APPs) under the Privacy Act 1988 apply.

To exercise any of these rights, email admin@calso.com.au.

We use essential cookies for authentication (keeping you logged in) and session management. We do not use advertising cookies or third-party tracking cookies.

We use Sentry for error monitoring, which may set a cookie to track error sessions. This is purely functional.

Calso is not designed for anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

If we make material changes, we'll notify you by email at least 14 days before the changes take effect. Non-material changes (typo fixes, clarifications) may be made without notice.

Questions, concerns, complaints — we want to hear them.

Email: admin@calso.com.au

Post: Calso Pty Ltd, Melbourne, VIC, Australia

If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC).