Privacy Policy

Galaxera Pty Ltd ("Galaxera", "we", "us") provides an AI-assisted operations workspace for trade and field-service businesses in Australia and internationally. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

By creating an account or using Galaxera, you agree to this Policy. If you use Galaxera on behalf of a business, you are responsible for ensuring you have a lawful basis to load your customers' information into the product.

• Account holders: owners and staff who sign in to Galaxera.
• End customers: people who contact your business by phone, SMS, email, or web forms; their details appear in your workspace because you (or your integrations) added them.

• Account data: name, email address, authentication identifiers, business membership, and settings you configure in Setup.
• Operational data: messages, call notes, call recordings and transcripts, jobs, quotes, invoices, attachments, and scheduling data you create or sync through connected channels.
• Connected channel data: when you connect email, calendar, telephony, or messaging providers, we receive the data needed to display threads, send approved outbound messages, and propose time slots (see Google integrations below).
• Usage and technical data: feature usage, device/browser type, approximate location at city level derived from IP when you sign in (we do not store raw IP addresses in product analytics where avoidable), and security logs.
• Payment data: billing is handled by our payment processor; we store subscription status, not full card numbers.

If you choose to connect Google services in Setup → Connections, Galaxera's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Gmail (send): we send email only for outbound messages you approve or automations you enable in Galaxera. Connecting Gmail does not give Galaxera access to read your mailbox; inbound email reaches Galaxera only when you set up forwarding.
• Google Calendar (read): using read-only access, we read your existing events and busy/free times to propose available booking slots, avoid double-booking (according to the operating rules you set), and display your existing events inside Galaxera as read-only. We do not modify anything under read-only access.
• Google Calendar (write): we create, update, and cancel events for the jobs and bookings scheduled in Galaxera, including bookings the receptionist makes on a call when you have switched booking on. When you confirm a booking request, a customer who gave an email is added as a guest so Google sends them the invite. These are the only calendar events we write.
• Disconnect: you can disconnect Google at any time in Connections; we revoke tokens and stop API access. Historical records already stored in your workspace remain until you delete them or close your account.

• Provide, secure, and improve Galaxera (including AI-assisted drafting, triage, and scheduling).
• Send transactional notices (account, security, billing).
• Comply with law and respond to lawful requests.
• Generate de-identified or aggregated analytics that cannot reasonably identify you.

AI processing: we use third-party AI providers (such as Anthropic and/or OpenAI) to generate drafts and summaries. Content you submit for drafting is sent to those providers under their terms. We configure services not to use your content to train public models where those controls exist. You must review AI-generated customer-facing content before sending. We do not use Google Workspace data (Gmail or Google Calendar) obtained through Google APIs to develop, improve, or train generalized and/or non-personalized AI and/or machine-learning models.

Depending on your location, we rely on contract performance (to deliver the service), legitimate interests (security, product improvement), and consent (where required, e.g. certain marketing or optional integrations). Australian users: we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

We do not sell personal information. We share data only with:

• Infrastructure and hosting providers (e.g. Vercel, Supabase).
• AI inference providers (e.g. Anthropic, OpenAI).
• Communications providers (e.g. Twilio for calls and texts, Resend for email delivery).
• Address lookup and maps (e.g. Google Maps Platform, OpenStreetMap).
• Services you choose to connect (e.g. Xero, Microsoft Outlook, Facebook and Instagram).
• Payment processing (e.g. Stripe).
• Monitoring and security tools (e.g. Sentry for error tracking).
• Analytics tools described under Cookies (e.g. Google Analytics, Microsoft Clarity).
• Professional advisers or authorities when required by law.

A current list of categories is available on request at privacy@galaxera.com.au.

• Needed to work: keeping you signed in and remembering your language and your cookie choice (gx_consent). These are always on.
• Google Analytics (only if you press Accept): counts visits on our public website and shows which pages people read and where they came from. Sets cookies such as _ga and sends data to Google, which may process it outside Australia.
• Microsoft Clarity: records how people move, scroll and click so we can fix screens that confuse people. On our public website it runs only if you press Accept. In the signed-in Galaxera app (not the staff portal) it runs for every signed-in user unless you pressed Reject on our website. In the app, text, images and the addresses of phone, email and map links are masked in your browser before anything is sent, so Clarity does not receive your customers' names, phone numbers, addresses or amounts. Sets cookies such as _clck and _clsk and sends data to Microsoft, which uses your IP address to estimate your location and may process data outside Australia.
• No advertising cookies: we do not use cookies to show you ads.

Google Analytics runs only on our public website, never in the signed-in Galaxera app. You can change your choice at any time with the Cookies link at the bottom of any page on our website. If you press Reject, we remove the analytics cookies we can reach and stop loading those tools, in the app as well.

We retain account and workspace data while your account is open. After you delete your account, we delete or anonymise tenant data within approximately 30 days, except where we must retain records for legal, tax, or dispute purposes. Backup systems may retain copies for up to 90 days before purge.

We use encryption in transit, access controls, and tenant isolation appropriate to a business SaaS product. No method of transmission or storage is 100% secure; notify us promptly if you suspect unauthorised access to your account.

• Access and export: sign in and use Account to download a copy of your data.
• Correction: update details in the app or contact us.
• Deletion: request account deletion from Account settings or email us; we will confirm before irreversible deletion.
• Marketing: opt out of promotional email via unsubscribe links.

If you are in the EU/UK or other regions with additional rights, contact us and we will respond within applicable timeframes.

We may process data in Australia and other countries where our providers operate. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

Galaxera is a business product not directed at children under 16. We do not knowingly collect personal information from children.

We may update this Policy from time to time. We will post the new version on this page and update the "Last updated" date. Material changes may be notified by email or in-app notice.

Privacy enquiries: privacy@galaxera.com.au
General support: hello@galaxera.com.au
See also our Terms of Service.