Privacy Policy

1300.ai (“we”, “our”, or “us”) operates the website 1300.ai and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform. By using 1300.ai you agree to the practices described in this policy.

We are committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information We Collect

Information you provide directly

• Account registration: full name, email address, password (stored as a bcrypt hash — we never store your plain-text password).
• Business listings: business name, address, phone number, email, website, ABN, description, photos, and category information.
• Enquiries: name, email, phone number, and the message content you send to a listed business.
• Reviews: your name, email address (optional), star rating, and review text.
• Course enrolments: your name and email are passed to our learning management partner (Coursebox) to create your learner account.
• Payment information: billing details are processed directly by Stripe. We do not store card numbers on our servers — only the Stripe customer ID and subscription ID.

Information collected automatically

• Usage analytics:page views, enquiry clicks, phone clicks, website clicks, and AI avatar chat events are recorded per business listing for the business owner’s analytics dashboard.
• Log data: IP address, browser type, pages visited, and timestamps may be retained in server logs for security and debugging purposes.
• Cookies and session tokens: we use secure, HTTP-only cookies to maintain your authenticated session via Supabase Auth.

2. How We Use Your Information

• To create and manage your account and business listing.
• To deliver enquiries you send (or receive) through the directory to the relevant business owner’s email address.
• To process subscription payments and issue receipts via Stripe.
• To provide business owners with analytics on listing performance (views, enquiries, etc.).
• To enrol you in courses and track your learning progress.
• To train the AI avatar for a business listing — the knowledge base you enter is sent to Unith and used solely to answer customer questions on that listing.
• To send transactional emails (enquiry notifications, claim verification links, welcome emails) via Resend.
• To detect and prevent fraud, spam, and abuse.
• To comply with our legal obligations.

3. Sharing Your Information

We do not sell, rent, or trade your personal information. We share data only as follows:

• Business owners: when you send an enquiry, your name, email, phone number, and message are shared with the business you contacted.
• Service providers: we use the following sub-processors under data processing agreements:
  • Supabase — database and authentication (servers in Australia/US).
  • Stripe — payment processing (PCI DSS Level 1 certified).
  • Resend — transactional email delivery.
  • Unith — AI avatar hosting for Platinum business listings.
  • Coursebox — online course hosting and learner management.
• Legal requirements: we may disclose information if required by law, regulation, court order, or to protect the rights and safety of 1300.ai, our users, or the public.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or financial compliance (e.g. payment records retained for 7 years under Australian tax law).

Enquiries and reviews may be retained even after account deletion as they form part of a business’s record; however, your email address will be removed from our active systems.

5. Security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, row-level security on all database tables, and regular security reviews. Access to the database is role-scoped — business owners can only access data belonging to their own organisation.

Despite these measures, no internet transmission is 100% secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect unauthorised access to your account.

6. Your Rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or out-of-date information.
• Delete your account and associated personal data (subject to legal retention obligations).
• Opt out of non-essential communications (you can unsubscribe from marketing emails at any time using the link in any email we send).

To exercise any of these rights, email us at privacy@1300.ai. We will respond within 30 days.

7. Cookies

We use strictly necessary cookies to maintain your session after login. We do not use third-party advertising cookies or cross-site tracking. You can disable cookies in your browser, but doing so will prevent you from logging in.

8. Children’s Privacy

1300.ai is not directed at children under 15 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

9. Third-Party Links

Business listings may include links to external websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top and, for material changes, notify registered users by email. Continued use of 1300.ai after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

For privacy enquiries or complaints, contact our Privacy Officer at:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).