Privacy policy

This policy explains what personal information Monolith Agents collects, why we collect it, where it goes and what rights you have. It covers this website and the systems we build and operate for our clients.

1. Who we are

Monolith Agents ("Monolith", "we", "us", "our") is an online agency based in Melbourne, Australia. We design, build and manage AI and automation systems for businesses worldwide. We operate entirely online and have no public physical address. All correspondence goes to hello@monolithagents.com.

Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to us, we comply with them. We also voluntarily apply those privacy standards across our operations and client engagements, wherever the client or their customers are located.

2. What this policy covers

Two categories of information:

• Website information. What you give us through this site (enquiry forms, the free check, email).
• Client service information. What we handle when building and running systems for our clients: their business data and their customers' details, calls and messages.

Where we process information on a client's behalf (their customers' names, numbers, bookings, call recordings and message threads), the client decides why and how that information is collected. We act on their instructions as a service provider. Their own privacy policy governs what they collect from their customers. This policy explains how we handle that information while it is in our systems.

3. What we collect

Through this website

• Your name, email address, business name and phone number (phone is optional)
• Whatever you write in the enquiry or message field
• Your answers in the free check diagnostic

Through our services

• Caller and messenger details: name, number, handle, message content
• Call audio, transcripts and summaries generated by the systems we run
• Booking and customer records handled by those systems
• Business configuration data a client gives us to make a system answer correctly: prices, services, rules, staff names and escalation contacts
• Sensitive information. Callers sometimes describe symptoms, treatments, injuries or health conditions, particularly to health and dental practices. Where health information reaches our systems, we handle it only to deliver that client's service, under the same protections as everything else, and never for any other purpose

From other sources

• Business contact details (name, role, work email, work phone) gathered from public sources, referrals and business-contact data providers, where we are permitted by law to use those details for relevant business-to-business communications
• Referral details from partners and mutual contacts

Every commercial email we send identifies us and carries an unsubscribe link, actioned within 5 business days. Replying with "stop" or writing to us works just as well.

Collected automatically

Standard server logs from our hosting provider: IP address, browser type, pages requested and time of request. This is used for security and troubleshooting. It is not linked to any advertising profile.

4. What we do with it

• Answer enquiries and send written follow-up
• Build, test, operate and support the systems you engage us for
• Bill for work and keep the records the law requires
• Keep the services secure, prevent misuse and troubleshoot problems
• Improve our services using aggregated, de-identified performance information
• Send relevant business-to-business communications where we have consent or may lawfully infer consent (every commercial email identifies us and carries an unsubscribe mechanism)
• Meet our legal obligations

Three commitments worth stating plainly:

• We do not sell personal information.
• We do not use client or customer data to train AI models, ours or anyone else's.
• We do not share one client's data with another client.

5. AI processing

The systems we build use third-party AI services for speech recognition, language understanding and speech output. Audio, transcripts and text are sent to those providers only to produce the result being asked for (the answer, the booking, the summary), under agreements that prohibit them from using that data to train models.

Automated decision-making: we do not make decisions about individuals that significantly affect their rights or interests using automated processing alone. Where a System we operate contributes to a decision for one of our clients (whether to accept a booking, what to quote), the client remains the decision-maker and their privacy policy explains their process.

The AI providers and other sub-processors we use can change over time. A current list is available on request at any time.

6. Calls and messages we handle for clients

When a system we operate answers a call or a message, it does so as a service provider to the business being contacted. Recording and disclosure rules depend on where that business and its customers are (Australian federal and state surveillance and interception law, US state law, UK and EU data protection and ePrivacy law and similar).

The client is responsible for the notices and consents their law requires. We configure systems to make the appropriate disclosures (the system identifies itself as automated and states when a call is recorded) and we give reasonable assistance in getting this right.

7. Where it is stored and who else sees it

Information is stored and processed with cloud providers: website hosting, email delivery, databases, workflow automation, telephony carriers and AI services. Their servers are in Australia, the United States and Germany (the European Union), and may be in other countries where our providers operate. Where we send personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles.

We only disclose personal information to:

• The sub-processors needed to run your system (as in section 5)
• Professional advisers (legal, accounting) under confidentiality
• Anyone the law requires, with notice to you where we are allowed to give it
• A successor if the business is ever sold, under confidentiality

8. Cookies

We use Google Analytics 4 from Google and Microsoft Clarity from Microsoft to understand how visitors use this site. Google Analytics sets cookies and records pages viewed, traffic sources, device type and approximate location. Microsoft Clarity sets cookies and records session replays and heatmaps, which include clicks, scrolling and mouse movement. Vercel Web Analytics counts page views anonymously without cookies. Neither provider builds advertising profiles for us and we do not track visitors across other sites. Both Google and Microsoft are based in the United States and process the data there. Some page resources (fonts and images) load from third-party providers, which receive your IP address in the process. Our hosting and network providers may set strictly necessary security cookies. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on, and Microsoft provides opt-out options for Clarity on its website.

9. Security

We take reasonable steps to protect information: encryption in transit, access to each client's information limited to the people and systems working on that engagement, managed credentials held in environment variables and secret stores rather than in code, and client environments kept separate wherever the tooling allows. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that affects your personal information, we will notify you and the Office of the Australian Information Commissioner as the law requires.

10. How long we keep it

Information	Retention
Website enquiries	Until the enquiry is resolved, then up to 24 months for follow-up
Call recordings and transcripts	90 days by default, unless the client sets a different period
Client business and system data	For the engagement, then per section 17 of the Terms of service on termination
Financial records	7 years (Australian tax law)
Server logs	Up to 12 months
Business outreach contacts	Up to 24 months after last contact, or until you unsubscribe, plus a minimal suppression record so we do not contact you again

11. Your rights and choices

You can ask us for access to the personal information we hold about you, and to correct it if it is wrong. That right applies under the Australian Privacy Principles wherever you are. You can opt out of commercial email at any time (the unsubscribe link in every email, or a reply) and we action it within 5 business days.

If you are in the United Kingdom or the European Economic Area, where the UK GDPR or the EU GDPR applies to our processing we comply with the applicable requirements. Our lawful bases are contract, legitimate interests, consent and legal obligation, and you have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, and the right to complain to your local supervisory authority.

Send requests to hello@monolithagents.com. We respond within 30 days. If the information is held for one of our clients (you called or messaged one of their systems), tell us which business it was and we will pass your request to them or direct you to them.

12. Children

Our website and services are not marketed to children under 16 and we do not knowingly solicit their personal information for our own purposes. Systems we operate for clients may process information about minors where that is part of the client's lawful business (a dental practice booking for a teenager, for example). That information is handled under section 2, with the client responsible for the lawfulness of their own collection.

13. Complaints

Write to hello@monolithagents.com and we will respond within 30 days. If you are in Australia and are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). Elsewhere, you can complain to your local data protection authority.

14. Changes to this policy

When this policy changes we update the date at the top of this page. Material changes are emailed to active clients before they take effect.

15. Contact

Monolith Agents, Melbourne, Australia (online only, no public physical address). Email: hello@monolithagents.com.