Privacy Policy

OpenDebt is operated by Whispa Operations Pty Ltd, an Australian company. We provide an AI agent that calls and texts people about overdue accounts on behalf of creditors and collection agencies (our clients).

This Privacy Policy covers:

• calls and text messages our AI agent makes or answers for our clients;
• the public website at opendebt.ai and the demonstration calls you can request on it; and
• people who contact us about our services or work for our clients.

When our agent contacts you about an account, we act on behalf of the client that holds or manages it. That client decides why your information is collected and is responsible for your account. We handle your information on its instructions and as this policy describes. We aim to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

All personal information about accounts, calls and messages is stored and processed in Australia. We do not sell personal information, and we do not use advertising trackers on this website.

Our agent tells you at the start of each call that it is an AI and that the call is recorded. When it calls or texts you about an account, we collect and use:

• the account details our client gives us, such as your name, telephone numbers, email and postal address, date of birth, and the account, balance and payment history;
• the call recording and transcript, and what you tell the agent, including answers to identity questions;
• the outcome of the call, such as a payment arrangement, a request to be called back, a dispute, or signs of financial hardship or vulnerability that the client needs to know about; and
• the text messages you agree to receive, such as payment links, and their delivery status.

We use this information to:

• check that we are speaking to the right person before discussing the account;
• discuss the account, arrange payment and send the messages you ask for;
• give our client an accurate record of the call, including anything that needs a person to follow up; and
• check the agent’s calls for quality and compliance, and fix problems.

We do not use your information to train AI models, and we do not allow our AI providers to do so. We do not use it for marketing.

While you are on a call, three kinds of provider work together to let the agent hear you, decide what to say and speak:

• Language model. The model that runs the agent’s side of the conversation is provided by SCX.ai and hosted in Australia. SCX.ai does not keep the conversation after it has answered.
• Speech. Speech recognition and the agent’s voice are processed in Australia by specialist speech providers.
• Storage. Call recordings, transcripts and account records are stored on Amazon Web Services in Sydney.

Every part of the call, including identity checks, is stored and processed in Australia. The full list of providers that process personal information for us is on our Trust Center.

Before you choose, PostHog does not capture website events. If you decline analytics, PostHog records limited cookieless measurements such as page views and selected interactions. It creates a temporary, daily-changing identifier on its servers using the request’s IP address, user agent and hostname. PostHog strips the source IP before storing the event and does not store a visitor identifier in your browser.

If you accept analytics, PostHog can store a first-party identifier so we can understand return visits and can record a privacy-masked replay of how the public pages were used. You can change your choice at any time.

Depending on your choice, website analytics may include:

• pages viewed, referring page and campaign parameters;
• browser, device category and website performance information;
• interactions such as booking clicks, audio demonstration plays, demonstration-call requests (the country and scenario, never the details you enter) and career-application clicks; and
• privacy-masked session replay after analytics has been accepted.

We do not intentionally send names, email addresses, telephone numbers, debt information or account information to PostHog. Text entered into form fields is masked, and sensitive URL parameters are redacted before analytics events are sent.

We use website analytics to:

• understand which pages and outreach campaigns are useful;
• find broken interactions and confusing journeys;
• measure interest in demonstrations and careers; and
• improve the clarity and performance of the website.

All personal information we handle for our clients, including account records, call recordings, transcripts, the AI processing of calls and the text messages we send, is stored and processed in Australia, and our providers are contractually bound to keep it there.

The only exception is website analytics. PostHog provides them from its United States cloud region, and we take reasonable steps to make sure it protects that information consistently with the Australian Privacy Principles. You can read the PostHog privacy notice.

Booking links take you to Calendly, and career-application links open your email application. Those services handle information under their own privacy terms once you leave this website.

Your analytics choice is saved in browser storage so the website can remember it. If you accept analytics, PostHog also uses first-party browser storage to connect visits. If you decline, PostHog does not store an analytics identifier in your browser.

If you arrive through a link that carries campaign parameters, they are kept in your browser for that tab only, so a booking you make after moving to another page still tells us which link brought you here. They describe the link, not you, and they are removed when you close the tab.

We retain website analytics only while it remains useful for the purposes above, subject to the retention settings applied to our PostHog project.

We keep call recordings, transcripts and account records for as long as the client we act for instructs, and then delete them.

Our information security management system is certified to ISO/IEC 27001. Information is encrypted in transit and at rest, and access is limited to people who need it. No method of processing is completely secure.

You can ask the Autonomous Collector to call your mobile from this website. The account it calls about is fictional. To place the call we collect and use:

• your name, mobile number, address and, for Australian numbers, date of birth, which the collector asks you to confirm on the call;
• the scenario you chose, the consent wording you agreed to and when, and your IP address and browser, kept as the record of your request;
• a text with a verification code, so only the holder of a number can ask us to call it; and
• the recording, transcript and summary of the call.

We use these details to place the call, to keep a record of the demonstration and to contact you about OpenDebt. Our team can listen to the call while it happens. The code and the call are carried by Twilio, and the call is processed by the AI providers described above. Demonstration calls to Australian numbers are stored and processed in Australia, and calls to United States numbers in the United States. We do not sell these details. You can ask us to delete them at any time using the contact details below.

Whispa Operations Pty Ltd, doing business as OpenDebt, sends account notifications by text on behalf of the creditor that holds your account, only after you agree to receive them on a recorded phone call. The messages confirm a payment arrangement you agreed on that call and carry a secure payment link. The Terms & Conditions describe the program, message frequency and how to opt out.

For this program we collect and use:

• the mobile number on your account, used only to send the messages you asked for;
• your consent, the date and time you gave it and the call recording and transcript in which you gave it, kept as the record of your opt-in;
• the content of each message sent and its delivery status, kept with your account record; and
• any STOP or HELP reply, used to honour your choice and to respond.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Messages are delivered through a telecommunications provider acting on our instructions, which is not permitted to use your information for its own purposes. We keep SMS records for as long as the related account record is retained, and we restrict access to people who need it.

You can ask for access to the personal information we hold about you, ask us to correct it, or complain about how we have handled it. We may need to verify your identity first. If your request concerns an account we handle for a client, we will work with that client to respond, and we may refer you to it.

We aim to acknowledge complaints within 7 days and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner. A complaint about the debt itself is best made to the business that holds your account, which can also tell you about its external dispute resolution scheme.