Privacy Policy

Last updated: 29 October 2026

This policy explains how Aphileon Pty Ltd ("we", "us", "our"), based in Melbourne, Victoria, Australia, handles personal information across our managed device plans, our B2B wholesale supply, and the Aphileon software panel. It covers this website and the services we provide to businesses. We aim to handle personal information consistently with the Australian Privacy Principles.

Information we collect

• Enquiry and quote details — the name, business name, email address, phone number and fleet details you give us when you ask for a quote or contact us.
• Account and business details — the details of a trade account or software tenant, including the people authorised to use it.
• Managed device plan records — for handsets we supply and manage: the device model, storage, colour and IMEI or serial number, who it is assigned to, and its service and repair history (what was reported, what we did, parts fitted and warranty).
• Billing information — plan and subscription details and payment status. Card and bank details are handled by our payment provider; we do not store full card numbers.
• Communications — messages you send us and transactional messages we send you, including email and SMS about your account, devices and repairs.
• Website technical information — when you visit, our hosting provider records the pages you view, the referring page, an approximate location derived from your network (country/city), and your browser and device type.

How we use your information

• To respond to your enquiry and prepare a quote.
• To supply, provision, repair, replace and recover devices, and to arrange loaner handsets.
• To open and administer trade accounts, including credit limits and invoicing.
• To provide, secure, support and improve the software and the services.
• To send you transactional messages about your account, orders, invoices and repairs.
• To keep records of work performed, honour warranties and meet our accounting and record-keeping obligations.
• To operate our voice AI assistant: answering and routing calls, transcribing them and keeping a record of the conversation so we can follow up.

Cookies and analytics

Our website does not set advertising or cross-site tracking cookies. Where we measure traffic on a site we operate, we use a cookieless beacon: a visitor is identified only by a salted, one-way hash of IP address, user-agent and day, so the raw IP address is never stored. We self-host our assets rather than pulling them from third-party services, so your visit isn't shared with a font or script network.

The Aphileon panel sets a single strictly-necessary session cookie when our team or a tenant signs in (fsr_session). It holds a random identifier only, is sent only over encrypted connections, is not readable by scripts, and expires eight hours after sign-in. We use no other cookies on the panel.

Disclosure to service providers

We do not sell your personal information. We use trusted providers who process limited information on our behalf:

• Cloudflare — website hosting, security, databases, file storage and email routing.
• Revolut — card payments for our plans and devices.
• Pushover — internal alerts to our team (for example, when a device needs attention).
• Email providers — sending and receiving our transactional email.
• SMS providers — sending transactional text messages about repairs and accounts.
• AI providers — where AI features are enabled, to process the text, call audio or call transcripts you or our team submit (for example, to draft or categorise content or to answer calls). These providers are not permitted to use the content for their own purposes. Some of these providers may process information on servers located outside Australia (such as in the United States).

We may also disclose information where required or authorised by law, or to protect our rights.

AI features

Some features use AI to draft content, categorise documents or answer questions about our own records. Where your information is included in a request, it is sent to the configured AI provider only to generate that result. Output may be inaccurate and is reviewed by a person before it is used for a decision about you.

Voice AI assistant. Where enabled, our voice AI assistant may answer calls on our business lines. During such a call we collect the caller's number (caller ID), the audio of the call and a transcription of the conversation. This is used to answer your enquiry, route the call and keep a record so we can follow up. The call may be recorded and transcribed by our AI provider; continuing the call after the greeting is your consent to this. Call recordings and transcripts are kept for up to 90 days and then deleted, unless we need them to resolve a dispute or a repair or warranty claim. The AI provider may process call audio and transcripts on servers located outside Australia (such as in the United States), under safeguards we have arranged with that provider.

Managed devices and MDM

Phones we supply under a managed plan run mobile device management (MDM) software while they are on the plan. MDM lets us set up and secure the device, see its enrolment status, model and software version, and see which apps are installed. It also lets us remotely lock a device and, if a device is lost or its lease ends, wipe our work setup from it. If device location is used, it is only for finding a lost device and only while the device is on the plan. We do not use MDM to read messages, photos or browsing history, and we cannot see the content of personal accounts signed in on the device.

If your business assigns a device to an employee, your business is responsible for telling that employee that the device is managed and what the MDM does, and for obtaining any consent needed for personal use of the device. MDM software and device services may process device information on servers outside Australia (such as in the United States or Europe), under safeguards we have arranged with those providers.

Data security and retention

We take reasonable steps to protect information from misuse, loss and unauthorised access, including access controls, encrypted transport and least-privilege access to our systems. We keep information only as long as we need it to provide the services, honour warranties and meet our obligations. Call recordings and transcripts are kept for up to 90 days and then deleted, unless we need them to resolve a dispute or a repair or warranty claim. Raw website traffic events are aggregated and pruned after 14 days; the aggregated totals contain no personal information. We also keep backups, used only to recover lost data: a copy of our databases in Cloudflare's storage, kept for up to 12 months, and a further copy of our databases and stored files on a secured server in Sydney, Australia, whose long-term history is encrypted and kept for up to 7 years; call recordings, call transcripts and raw traffic events from this website are never kept in these backups.

Accessing or correcting your information

You can ask to access the personal information we hold about you, ask us to correct it, or ask us to delete it. Email hello@aphileon.com and we'll help. We'll respond within a reasonable time.

Complaints

If you have a concern about how we've handled your information, contact us first and we'll work to resolve it. If you're not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Children

Our services are provided to businesses and are intended for people aged 18 and over. We don't knowingly collect information from children.

Changes to this policy

We may update this policy from time to time. The current version will always be on this page, with the date it was last updated.

Contact us

Aphileon Pty Ltd · Melbourne, Victoria, Australia · hello@aphileon.com