Privacy policy

From business owners who sign up: your name, email address and profile picture from Google, or your name and email address from Microsoft (or just your email if you sign in with a link), your business details, and billing details, which are handled by Stripe. We never see your full card number.

From people who call a Lightspire number: the phone number they call from, what they say on the call, and anything they give the agent such as a name, email address or booking details. Calls are recorded and transcribed (see “Call recording” below).

From people who ask for a free demo on this website: the business name, website and industry, and the email address or mobile number you give us. We use them to build your demo from your business's public website, send you its link and follow up about it.

From visitors to this website: standard usage analytics (pages viewed, browser, rough location, and the ad or campaign that brought you, if any) and, if you try the demo call, the audio of that call while it is in progress. Demo calls in your browser are run by Cartesia in the United States, which turns your speech into text, has an OpenAI model write the replies and speaks them; we have Cartesia erase each demo call's audio and transcript straight after it ends. Demo calls are not recorded. After the demo call on the home page we ask for your mobile number, which you can skip: we keep it with when you tried the demo and how long you talked, text you once afterwards with a feedback link and a free-trial link, and keep any feedback you send. Reply STOP to that text and we won't text you again.

Cookies: this website uses cookies to keep you signed in and, unless you decline them in the cookie notice, for those usage analytics (PostHog) and to measure our own Google Ads. When you arrive from one of our ads, Google's advertising cookies (such as _gcl_au and _gcl_aw) record the click, so Google can tell us whether it led to a demo, a free trial or a paid subscription; our own cookie, ls_ad, keeps the ad click and campaign that brought you for 90 days, so we can count sign-ups for each campaign. The Google Ads tag runs on this website and in setup, never in the dashboard. Declining turns the analytics off in your browser, tells Google's tag not to store any cookies and removes the advertising cookies; sign-in still works.

• To answer calls and take bookings on behalf of the business you called.
• To show the business its calls, recordings, transcripts, customers and bookings.
• To bill subscriptions and top-ups.
• To send the emails and texts the business has turned on, such as a new booking alert.
• To find and fix problems with the service, and to check and improve the quality of calls.

If you sign in with Google, we receive only your name, email address and profile picture from your Google account (the openid, email and profile permissions). We use them to create your account, sign you in, and show your name and picture in your dashboard. Nothing else is requested from your Google account.

This information is stored in our database in Sydney, is not shared with anyone, and is never used for advertising or to train AI models. Lightspire's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Lightspire's access at any time in your Google Account under Security, and closing your Lightspire account deletes this information.

If you sign in with a Microsoft account (Outlook.com, Hotmail or a work or school account), we receive only your name and email address (the openid, email and profile permissions). We use them to create your account and sign you in. Nothing else is requested from your Microsoft account, and the same storage and sharing rules apply as for Google.

You can remove Lightspire's access at any time at account.microsoft.com under Privacy, Apps and services (or, for a work account, at myapps.microsoft.com), and closing your Lightspire account deletes this information.

We store your business's data, including call recordings, transcripts, summaries, bookings and caller details, in Sydney, Australia (Supabase, on Amazon Web Services in ap-southeast-2). The app and its servers run in Sydney too. The business sees this data in its dashboard; Lightspire can reach it too, to run and support the service.

To answer a call in real time, the call's audio and words are processed by our voice providers in the United States: Vapi runs the call, Deepgram turns speech into text, OpenAI writes the replies, Cartesia speaks them, and Google Gemini, through Vapi, summarises each call afterwards. Demo calls made in a browser on this website are run by Cartesia directly instead (see above). Telnyx carries calls to our Australian numbers. Vapi also keeps each call's transcript and technical logs in the United States until the call's recording or transcript is deleted, or for 30 days when the call has no recording, and we then delete Vapi's copy of the call.

Emails are sent through Resend and product analytics run on PostHog, both in the United States. Google Ads, in the United States, measures whether our ads lead to sign-ups: it receives the pages its tag runs on, your browser's usual details (such as its IP address), its advertising cookies and a note when a demo, trial or paid subscription follows an ad click, never your name, email address, phone number or anything from your calls. In the dashboard, PostHog never receives what's on the screen, and phone numbers are removed from everything it receives. Payments are processed by Stripe. Anthropic, in the United States, reads the text of a business's website and of the documents it uploads, to draft its setup and its voice agent's facts, and checks the quality of calls from their transcripts so we can fix the AI voice agent's mistakes; it never uses any of it to train its models.

We are likely to disclose personal information to recipients in the United States. Before doing so we take reasonable steps under Australian Privacy Principle 8 to make sure they handle it consistently with the Australian Privacy Principles, through contracts that limit their use of it to providing our service.

If a business connects another service (a calendar, job system, CRM or webhook), the details sent there are handled by that service in the place it operates.

Our sub-processor list names every provider, what it receives, where it processes and stores it, and for how long.

On each call, the AI voice agent decides from the conversation whether to make a booking, take a message or put the caller through to a person, and writes a summary of the call for the business. To decide, it uses what the caller says, the number they call from, and the business's own details, such as its opening hours, services and free times.

Nothing it decides has a legal or similarly significant effect on the caller. Every outcome is shown to the business in its dashboard, and a caller can contact the business to have it reviewed or changed.

• We don't sell personal information, and we don't share it with advertisers. The one advertising service we use, Google Ads, only measures our own ads (see Cookies above) and never gets your name, email address or phone number.
• We don't contact a business's callers ourselves. Only the business can, through its own tools.

Calls to a Lightspire number are answered by an AI voice agent on behalf of the business you called. These calls are recorded and transcribed. We use the recording and transcript to provide the service, such as taking messages, making bookings and writing a summary of the call for the business, and to check and improve the quality of calls.

We may also use recordings and transcripts to improve Lightspire, including to test, evaluate and train the AI models and speech systems that power the service. Where practical we remove or mask details that identify people (such as names and phone numbers) first. We never sell recordings or transcripts, and we don't use them for advertising.

Recordings and transcripts can be accessed by the business you called and by Lightspire. We don't share them with anyone else, except the service providers listed above that store or process them for us.

Recordings are kept for 12 months, unless the business chooses 30, 90 or 365 days in its settings (Settings, then Privacy), and are then deleted. The business can also delete any call's recording, or its transcript and summary, sooner, and every recording is deleted when the account is closed.

Each business using Lightspire is responsible for telling its own callers that calls are recorded where the law requires it. Recording laws differ by state and territory. If you called a business and want a recording or a transcript deleted, contact that business (it can delete a call's recording, and its transcript and summary, from its Lightspire dashboard), or email us and we'll work with the business to deal with your request.

A business can connect Lightspire to its own systems: webhooks, the Lightspire API or Zapier. When it does, details of its calls, messages, bookings and customers (such as a caller's name, number, email and a summary of the call) are sent to the destinations that business chooses. Call recordings are never sent; transcripts only when the business asks the API for one.

Those destinations are chosen and controlled by the business, and their own privacy terms apply to what they receive. Events we send are kept for 30 days so failed deliveries can be retried, then deleted.

While a business has an account, its calls, transcripts, customers and bookings stay available to it. Recordings are kept for the time the business chooses (12 months unless it picks 30, 90 or 365 days). When an account is closed, we delete its calls, recordings, customers and bookings, except billing records we must keep under Australian tax law (five years).

The account's owner can close it at any time in Settings, then Account. Closing it stops billing, gives up its phone numbers and deletes the account's data and sign-in straight away, and its call recordings (with our voice provider's copy of each call) within a day.

What people give us before they are customers is kept for 12 months, then deleted: demo requests from this website, the mobile number and feedback from the home page demo, and messages sent through our contact forms. A demo we built from a business's website is deleted 12 months after it ends, unless that business went on to open an account.

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Email support@lightspire.ai and we'll reply within 30 days. If you're not happy with our answer you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If this policy changes in a way that matters, we'll email account holders before it takes effect. The date at the top is the date of the current version.