Building Flow DigitalBuilding Flow Digital

Privacy

Privacy policy

Last updated: 19 August 2026

1. Who we are

Building Flow Digital ("we", "us", "our") is an Australian business responsible for this website and the AI-driven inbound-lead service Building Flow.

We are bound by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What we collect

When you submit a form on this website (including the Try Gary demo form), we collect:

  • Your first name
  • Your mobile phone number
  • Your email address
  • The campaign attribution parameters (UTM source, medium, campaign) that brought you to the page
  • The version identifier of the consent wording you saw at the time of submission, and the timestamp of submission
  • If you receive a callback from Gary, the audio recording and transcript of that call
  • Standard server log data: your IP address, browser type, and the pages you viewed on our site

We do not collect financial information, health information, or other sensitive information defined under the Privacy Act.

3. How we use your information

We use the information you provide to:

  • Place the Gary demo callback you requested
  • Send a single follow-up email summarising the call, if you agree
  • Respond to enquiries you send us
  • Improve the Gary voice agent by reviewing call transcripts (audio is reviewed by humans only when needed to fix a specific issue, never for general training of third-party models)
  • Comply with our legal obligations under the Australian Consumer Law, the Spam Act 2003, and the Do Not Call Register Act 2006

4. Automated callbacks and AI voice agents

When you submit the Try Gary demo form, you authorise us to place an automated outbound voice call to the mobile number you provide. That call is made by an artificial-intelligence voice agent we call "Gary".

Specifically:

  • Gary will identify himself as an AI agent within the first sentence of the call. This is non-negotiable and is how we comply with the Australian Consumer Law section 18 (misleading or deceptive conduct) and the Voluntary AI Safety Standard transparency principle.
  • The call is recorded. The audio file and a text transcript are stored in our infrastructure for up to 12 months from the date of the call, then deleted.
  • You may receive one or more SMS messages in connection with the callback (a pre-call confirmation, and optionally a follow-up).
  • You can opt out at any time by replying STOP to any SMS we send you, or by emailing privacy@buildingflowdigital.com. Opt-outs are honoured within 24 hours.
  • If you ask us to delete your call recording and transcript at any time, we will do so within 30 days unless we are legally required to retain it.

5. Cookies and tracking

We do not currently use analytics cookies, advertising cookies, or any third-party tracking on this website. Two third-party scripts load only where they are functionally necessary:

  • On our homepage lead form, GoHighLevel's own form-embed scripts, which render and submit that form.
  • On the Try Gary form, Cloudflare Turnstile: a privacy-preserving bot check that confirms you are a real person before we place a call. Turnstile does not use tracking cookies and is not used to profile you.

If we add analytics in the future, we will update this section and the "Last updated" date.

6. Data retention

  • Contact records (name, phone, form submissions): retained while you are an active customer or prospect, and for 7 years thereafter for tax and dispute-resolution purposes.
  • Call recordings and transcripts: 12 months from date of call, then deleted. Earlier deletion on request.
  • Server logs: 90 days.

7. Your rights under the Privacy Act

Under the Australian Privacy Principles you have the right to:

  • Access the personal information we hold about you (APP 12)
  • Ask us to correct that information if it is inaccurate, out-of-date, incomplete or misleading (APP 13)
  • Ask us to delete it
  • Make a complaint about how we have handled your information

To exercise any of these rights, email privacy@buildingflowdigital.com. We will respond within 30 days.

8. Third parties we share data with

We share the minimum information necessary to deliver our service, and only with these providers:

  • GoHighLevel: our CRM and form host. Stores contact records.
  • Twilio: the telephony provider that places the outbound call and sends SMS.
  • Supabase: database hosting for call transcripts and operational records.
  • Cloudflare: provides the Turnstile bot check on the Try Gary form; it receives your IP address and interaction signals to confirm you are human before we place a call.
  • Building Flow (internal): our own AI-orchestration platform that runs Gary.

We do not sell your personal information. We do not share it with advertisers or data brokers.

9. Complaints

If you are unhappy with how we have handled your personal information, please email privacy@buildingflowdigital.com in the first instance. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated to active customers by email.