Who we are
Rewind ("Rewind", "we", "us") is a contact-centre, call-recording and reporting service for Microsoft Teams. Rewind is a product of NUBLOCK GROUP PTY LTD (ABN 55 696 503 661). Our ACN is 696 503 661, and our address for notices and privacy requests is Level 10, 50 Queen St, Melbourne VIC 3000. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Contact us about privacy at hello@rewindcx.au; our privacy officer answers those messages.
Two roles: our customers' data and our own
Most personal information in Rewind belongs to our customers — the organisations that subscribe. When a customer uses Rewind to handle calls and chats, it decides what is recorded and kept, and we handle that information on the customer's behalf and on its instructions. The customer is responsible for telling its callers and staff about recording and for any consent the law requires. If you called or chatted with one of our customers, contact that organisation first; we will help it respond.
We are directly responsible for the information we collect for ourselves: the people who sign up, administer and use a Rewind account, visitors to rewindcx.au, and anyone who contacts us.
What we collect
Through the service, for our customers
- Call and chat records: phone numbers, caller names where known, times, queues, the agent who answered, wait and talk times, dispositions, notes and callback requests.
- Call recordings: audio of calls the customer chooses to record, including Microsoft Teams compliance recording where the customer enables it.
- Transcripts and AI analysis: text transcripts made from recordings, and analysis derived from them, such as sentiment, summaries, topics and quality flags.
- Chat content: messages exchanged through the Rewind web chat and the Teams chat bridge, and transcripts a visitor asks to be emailed.
- Agent information: agents' names, Microsoft Entra (work account) identifiers, Teams presence, status changes, away reasons and performance statistics.
For ourselves
- Account information: name, work email, organisation and Microsoft tenant identifier of people who sign in, and the role they hold.
- Billing information: billing contact email, plan, how the organisation is billed (direct invoice or Microsoft commercial marketplace) and usage (users and minutes). We do not take or store card details; marketplace purchases are paid to Microsoft.
- Website and enquiries: the work email you give to open the guided demo and messages you send us.
- Usage analytics, only with consent: pages viewed and product features used, through PostHog. The website and the app ask before loading it, and it never receives call, chat, recording or transcript content.
- Security and operational logs: sign-ins, configuration changes, recording playback and errors.
We do not ask for sensitive information. A recording or transcript can contain anything a caller says, including sensitive information; customers control which calls are recorded and agents can pause recording (for example while card details are read out).
How we collect it
From our customers' use of the service (Microsoft Teams, Azure Communication Services and the Rewind web app), from you when you sign up, sign in or contact us, and automatically through logs and, if you agree, analytics. We collect information only by lawful and fair means (APP 3).
How we use it
- To provide the service: route calls and chats, record and store calls, produce transcripts and analysis, show wallboards and reports.
- To run our business: manage accounts, trials and billing, provide support, and keep the service secure.
- To improve the product, using analytics you have agreed to and aggregated usage statistics.
- To meet legal obligations.
We do not sell personal information, do not use customer recordings or transcripts for advertising, and do not use them to train AI models. AI analysis of a customer's recordings is done for that customer only.
Who we disclose it to
We use service providers (sub-processors) to host and run Rewind. The current list, what each does and where it processes data, is on our sub-processors page. The main ones are Microsoft (Azure, Microsoft 365/Teams and Azure AI Speech and Language), Cloudflare for this website and, with your consent, PostHog for analytics. Each is bound by contract to protect the information and use it only to provide its service to us. We may also disclose information when the law requires it, or to protect someone's life, health or safety.
Where it is stored, and overseas disclosure
Customer data — call records, recordings, transcripts, chats and configuration — is stored and processed in Microsoft Azure's Australian regions. Azure Communication Services resources are created with an Australian data location, and new organisations outside Australia are not offered signup until we serve their region.
Some information leaves Australia (APP 8):
- PostHog (United States) receives website and product usage analytics if you agree to it. It does not receive call, chat, recording or transcript content.
- Cloudflare serves this website from a global network, so your browser's request may be handled outside Australia.
- Microsoft may access data from outside Australia to support and secure its services, under its own data-protection terms.
Before disclosing information overseas we take reasonable steps, including contractual terms, so the recipient handles it consistently with the APPs.
Where AI processing happens
Transcription and sentiment analysis run on Microsoft Azure AI services in Australia East, and summaries are produced inside Rewind. Any generative AI inference we add will be preferenced to Microsoft's Australian regional or data-zone deployments, and may extend to Microsoft's Asia Pacific deployments where a model is not available in Australia. A customer that requires Australian data residency stays on Australian deployments only: ask us at hello@rewindcx.au and we will set it for your organisation.
How long we keep it
- Recordings and their transcripts (with the AI summary and sentiment drawn from them): for the retention period the customer sets on each queue (90 days unless changed), then deleted automatically, unless the customer has placed the interaction on legal hold. The basic call record (time, queue, agent, duration, outcome) stays for reporting.
- The recording access log (who played, downloaded or read a recording, and every legal hold): kept for as long as the subscription is active.
- Call and chat records, configuration and account data: for as long as the customer's subscription is active.
- When a customer leaves: we delete its recordings, transcripts and database records in our offboarding process. Encrypted backups expire on their own schedule, within 35 days.
- Demo and enquiry emails: until you ask us to delete them, or when they are no longer needed.
How we protect it
Data is encrypted in transit and at rest. Each customer's data is separated by tenant, and every request is limited to the signed-in user's own organisation. Access uses Microsoft Entra sign-in with roles; the database accepts only Entra-authenticated connections; secrets are kept in Azure Key Vault. If we have a data breach that is likely to cause serious harm, we will notify affected customers and individuals and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.
Access and correction
You can ask for the personal information we hold about you, and ask us to correct it (APPs 12 and 13). Email hello@rewindcx.au. We will confirm your identity, respond within 30 days and not charge you for making the request. If the information is held for one of our customers (for example a recording of a call you made to them), we will pass your request to that customer, who decides how to respond. If we refuse a request, we will tell you why and how to complain.
Anonymity
You can browse rewindcx.au without telling us who you are, and decline analytics. To use the service, or to get a reply from us, we need your name and work email.
Cookies and analytics
This website and the Rewind app load PostHog analytics only after you choose Allow on the analytics prompt. If you choose Decline, no analytics script is loaded. To change your choice later, clear this site's stored data in your browser and you will be asked again. The app also stores your sign-in session in your browser; that is required for the service to work.
Complaints
If you have a concern about how we handled your personal information, email hello@rewindcx.au. We will acknowledge it within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We will update this policy when our practices change and show the date at the top. We tell customers' administrators about significant changes before they take effect.