Privacy Policy
Last updated: 20 May 2026
1. Who We Are
NightShift (operated by Orbyx) provides an AI-powered after-hours call answering and job booking service for trade businesses in Australia and internationally (“Service”). References to “we”, “us”, or “our” in this Policy mean Orbyx.
For privacy enquiries, contact us at privacy@orbyx.cc.
2. What Data We Collect
Account data
Email address and hashed password when you create an account.
Business settings
Business name, timezone, and your personal mobile number (used only to send you SMS alerts in Confirm mode).
Call records
For every call handled by Sarah, we store: the caller’s name, phone number, service address, issue description, requested appointment time, call type (Emergency / Non-Emergency / Enquiry), and booking status. We also record whether the recording disclosure was made at the start of the call.
Call recordings are processed by Retell AI and transcripts are analysed by OpenAI solely to extract the above structured data. We do not store the raw audio or full transcript text after extraction.
Payment data
Payment card details are collected and stored exclusively by Stripe, Inc. We store only a Stripe customer ID and subscription ID — never raw card numbers.
Technical data
Standard server logs (IP address, browser/OS, pages visited) retained by Vercel for up to 30 days for security and debugging purposes.
3. Why We Collect It (Legal Bases)
- Contract performance — to provide the call answering and booking service you have subscribed to.
- Legitimate interests — fraud prevention, security, service improvement, and to send you transactional notifications about your account.
- Legal obligation — to comply with Australian tax law, financial regulations, and call recording disclosure requirements under the Telecommunications (Interception and Access) Act 1979.
4. Call Recording Disclosure
Sarah (our AI agent) discloses at the start of every call that the call is being recorded. This is required under the Telecommunications (Interception and Access) Act 1979 (Cth) and relevant state surveillance legislation. We record whether this disclosure was successfully delivered for each call.
Callers who do not consent to recording may end the call. Continued participation constitutes implied consent in accordance with applicable law.
5. Third-Party Processors
We share personal data with the following sub-processors, each under a data processing agreement and applicable data protection law:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database & authentication | USA |
| Retell AI | AI voice agent & call handling | USA |
| OpenAI | Transcript analysis & data extraction | USA |
| Stripe, Inc. | Payment processing | USA |
| Twilio | SMS notifications (Confirm mode) | USA |
| Vercel | Application hosting & CDN | USA / Global |
6. International Data Transfers
Our servers and sub-processors are located in the United States. By using the Service, you acknowledge that your personal data will be transferred to and processed in the USA.
Australian users: We take reasonable steps to ensure overseas recipients handle your data in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
EU/EEA users: Transfers to the USA are subject to the Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46(2)(c).
7. Data Retention
- Call records are retained for 24 months from the date of the call.
- Account data is retained until you delete your account, plus an additional 90 days for legal and backup purposes.
- Payment records are retained for 7 years as required by Australian tax law.
- Server logs are retained by Vercel for up to 30 days.
8. Your Rights
Australian users (Privacy Act 1988)
You have the right to access and correct your personal information. Contact us at privacy@orbyx.cc and we will respond within 30 days. If you believe we have breached the APPs, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
EU/EEA users (GDPR)
You have the right to: access your data (Art. 15), rectify inaccuracies (Art. 16), erasure in certain circumstances (Art. 17), restrict processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21). You may lodge a complaint with your local supervisory authority. Contact us to exercise any of these rights.
California users (CCPA / CPRA)
You have the right to know what personal information we collect and why, to delete your personal information, and to correct inaccurate information. We do not sell or share your personal information with third parties for cross-context behavioural advertising. We do not discriminate against you for exercising any CCPA rights.
To exercise any of the above rights, email privacy@orbyx.cc with the subject line “Privacy Request”. We will verify your identity before processing the request and respond within 30 days.
9. Security
We use industry-standard measures including TLS encryption in transit, bcrypt password hashing, row-level security on our database, and cryptographic webhook signature verification. No system is completely secure; if you believe there has been a security incident, contact us immediately at privacy@orbyx.cc.
10. Cookies
We use a single session cookie to keep you signed in. We do not use advertising, tracking, or analytics cookies. No third-party cookies are set by NightShift.
11. Children
The Service is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
12. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date at the top. Continued use of the Service after the effective date constitutes acceptance.