Privacy Policy
This policy explains what personal information Mella collects, why we collect it, who we share it with, and how you can access or correct it. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
1. Who we are
This service is operated by SixVM Pty Ltd (ABN 99 703 139 324, ACN 703 139 324).
In this policy, "we", "us" and "our" mean that entity. "You" means a person who creates a Mella account or whose personal information we handle.
Contact our Privacy Officer at [email protected] or 08 6731 8715.
2. What we collect
2.1 Account information
Your email address, password (stored only as a cryptographic hash, never in readable form), workspace names and the settings you configure.
2.2 Identity verification documents — sensitive information
Before a telephone number can be issued to a workspace, we must establish who is responsible for it. Depending on whether you apply as an individual or a business we collect:
- your full legal name, contact details and address;
- for individuals — a photographic identity document such as a driver licence or passport;
- for businesses — an ABN or ACN (or, outside Australia, your company or business registration number), an ASIC company extract, ABN registration record or your country’s equivalent, and the identity document of the person acting for the business (or a letter of authority);
- where the telephone carrier requires it — a proof of address such as a utility bill or ATO notice.
We store only the last four characters of any document number. The document image itself is held in a private storage bucket, reachable only through an authenticated administrator route, never by a public or shareable link.
This is sensitive information under the Privacy Act. We collect it only with your consent, only because it is reasonably necessary to issue a regulated telephone service, and we destroy it once the verification decision no longer needs to be supported.
Sharing with the telephone carrier. The rules in Australia and many other countries require the carrier that supplies a number to know who uses it. When you register for numbers in such a country we send our carrier, Twilio, the details and documents that country requires for its review: typically your name or business name, business registration number (such as your ABN), address, website, contact email and phone, identity and address documents, any further details that country asks for and, for an individual, the purpose of the number and your identity document number. That document number goes from the form straight to Twilio and is never stored by us. We send only the documents the carrier accepts, not everything on file. Twilio keeps what it receives to meet its own regulatory obligations, under its own privacy policy.
2.3 Call recordings and transcripts
Where you enable recording on an agent, we process the audio of calls to and from your numbers, machine-generated transcripts, call metadata (numbers, times, duration, outcome) and any information a caller provides during the call.
2.4 Contacts you upload
If you import a contact list, we handle the personal information of those people on your behalf. You are responsible for having a lawful basis to provide it to us and for their inclusion on any calling list.
2.5 Technical information
Server logs including IP address, browser type, pages requested and timestamps, kept for security and troubleshooting.
We use browser local storage to keep you signed in and remember interface preferences. We do not use advertising or cross-site tracking cookies.
3. Why we collect it
| Information | Purpose |
|---|---|
| Account details | To create and secure your account and provide the service |
| Identity documents | To verify who holds a telephone number before it is issued |
| Call audio and transcripts | To operate the AI agent, produce the summaries and extracted fields you configure, and let you review calls |
| Contact lists | To place the calls you instruct |
| Billing details | To charge for your plan, extra numbers and extra minutes, and to meet tax record-keeping obligations |
| Technical logs | Security, abuse prevention and fault diagnosis |
We do not sell personal information. We do not use your call content or contacts to train our own models.
4. Who we disclose it to, and overseas transfer
Mella is built on third-party providers. Operating the service necessarily discloses some information to them, and several are located outside Australia. Under Australian Privacy Principle 8 we take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, but you should understand that your information will be processed overseas.
| Provider | What it receives | Location |
|---|---|---|
| Twilio | Call audio, phone numbers, call metadata; for number registration, the identity details and documents described in section 2.2 | United States |
| Anthropic | Conversation text sent to the AI model | United States |
| ElevenLabs | Speech audio for transcription and synthesis | United States |
| Supabase | Account data, agent configuration, transcripts, documents | — stored in Singapore |
| Cloudflare | Network traffic in transit | Global network |
| Stripe | Billing name, email address, billing address and payment details. Card numbers are entered directly with Stripe and never reach us | United States |
We may also disclose personal information where required by law, to a court or regulator, or to protect the safety of a person.
5. Security
- All traffic is encrypted in transit using HTTPS.
- Passwords are hashed; provider credentials are held server-side and never sent to your browser.
- Identity documents sit in a private bucket served only through an authenticated administrator route.
- Agents can be configured to redact personal information from transcripts before anything is written down.
- Workspaces are private to their owner.
No system is perfectly secure. We cannot guarantee the security of information transmitted to us.
6. Data breaches
We comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If a breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable.
7. How long we keep it
| Information | Retention |
|---|---|
| Identity documents | 90 days after the verification decision, then destroyed |
| Call recordings and transcripts | 12 months, or until you delete them |
| Account records | While your account is open, then 12 months |
| Financial records | 5 years, as required by Australian tax law |
Under APP 11.2 we destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed, unless we are required by law to keep it.
8. Accessing and correcting your information
You may ask for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Write to [email protected]. We will respond within 30 days. We do not charge for a request, though we may charge a reasonable cost for supplying a large volume of material.
You can delete agents, recordings, transcripts and contacts yourself from within Mella at any time.
9. Complaints
If you believe we have mishandled your personal information, contact our Privacy Officer first at [email protected]. We will acknowledge within 5 business days and aim to resolve within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.
10. Children
Mella is a business service and is not intended for anyone under 18. We do not knowingly collect personal information from children.
11. Changes
We may update this policy. The current version is always at this address, with the date at the top. We will tell account holders about material changes before they take effect.