Privacy Policy

Last updated: 26 October 2026

GH Phone for Android privacy · Request GH Phone data deletion

GippsHost is operated by Aaron Patton (ABN 51 049 938 660). We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how GippsHost collects, uses, stores and discloses personal information when providing our services.

GippsHost provides services including:

• Web hosting
• Domain name registration
• Internet services (including nbn® internet)
• Website development
• IT support and consulting
• Related technology services

If you have any questions about this Privacy Policy, you can contact us at:

GippsHost

ABN 51 049 938 660

Email: support@gippshost.com.au

Website:

We may collect personal information including:

Contact Information

• Full name
• Email address
• Phone number
• Billing address
• Service address

Business Information

• Business name
• ABN or company details
• Domain registrant details

Account Information

• Customer account details
• Service subscriptions
• Support requests and communications
• Order and billing history

Technical Information

When you interact with our services we may collect:

• IP addresses
• Server logs
• Device and browser information
• Usage data relating to services provided

Payment Information

Payments are processed via secure third-party payment providers. GippsHost does not store full credit card numbers on its systems.

We collect personal information when you:

• Create an account with GippsHost
• Order or use our services
• Contact our support team
• Submit forms on our website
• Communicate with us via email or phone
• Interact with our website

We may also collect information from third parties such as:

• Domain registries
• Network and service-delivery partners
• Payment processors
• Fraud prevention services

We collect and use personal information to:

• Provide and manage services
• Process orders and payments
• Provide customer support
• Provision internet, hosting, or domain services
• Maintain network security and prevent fraud
• Communicate service updates or maintenance notices
• Comply with legal and regulatory obligations

We may disclose personal information where necessary to deliver our services.

This may include sharing information with:

Service Providers

• Web hosting infrastructure providers
• Domain registries and registrars
• Internet network operators
• Payment processors

Technical Providers

• Data centre operators
• Cloud infrastructure providers
• Security and monitoring services

Legal Requirements

We may disclose information where required by law, including:

• Court orders
• Law enforcement requests
• Regulatory compliance obligations

We will only share information that is necessary to provide the relevant service.

Some of our service providers or infrastructure providers may be located outside Australia.

Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled in accordance with Australian privacy laws.

Our website may use Google Analytics and first-party analytics tools to understand how visitors interact with our website.

Analytics may collect information such as:

• Pages visited
• Anonymous visitor and session identifiers
• Referral and campaign information
• Approximate location derived from an IP address
• Device and browser type

Our first-party analytics does not record information entered into forms. We honour browser Do Not Track signals for first-party analytics. You can configure your browser to disable local storage or cookies if you prefer.

GippsHost takes reasonable steps to protect personal information from:

• Misuse
• Interference
• Loss
• Unauthorised access
• Modification or disclosure

Security measures may include:

• Encrypted connections (SSL/TLS)
• Access controls
• Secure hosting infrastructure
• Monitoring and logging systems

However, no system can guarantee complete security.

You may request access to personal information we hold about you.

You may also request corrections if your information is inaccurate or out of date.

Requests can be made by contacting us at:

support@gippshost.com.au

We retain personal information only for as long as necessary to:

• Provide services
• Meet legal or regulatory obligations
• Resolve disputes
• Maintain business records

When information is no longer required it will be securely deleted or anonymised where practical.

If you believe your privacy has been breached, you may contact us.

We will investigate and respond to privacy complaints as soon as reasonably possible.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

We may update this Privacy Policy from time to time.

The latest version will always be available on our website.

We use Stripe to process card, PayTo and Australian BECS Direct Debit payments. Payment details entered in Stripe’s embedded form, including full card numbers, BSB and bank account numbers or a PayID, are submitted directly to Stripe. GippsHost does not store full card or bank account numbers entered through these forms, and does not collect your banking login credentials.

We retain information needed to administer your billing and authorisation, such as your name and contact details, payment-method type and masked details, Stripe customer and payment-method identifiers, mandate identifiers, authorisation evidence, invoice and transaction references, payment status and support correspondence. We use these records to collect authorised payments, prevent duplicate collection, reconcile invoices, resolve disputes and meet record-keeping obligations.

Relevant information is shared with Stripe, banks, payment networks and their service providers to establish and manage the payment agreement, process transactions and refunds, and prevent fraud. Stripe and its providers may process information outside Australia. See Stripe’s Privacy Policy for its processing and international-transfer information. The overseas-disclosure, security, retention, access and complaint provisions of this policy continue to apply.

Removing a saved payment method or cancelling a debit agreement does not automatically erase invoice, transaction or authorisation records that we reasonably need to retain. Contact support@gippshost.com.au about payment records or a privacy request.

GippsHost Phone, also called GH Phone, is the Android calling app provided by GippsHost for an existing GippsHost Voice or Hosted PBX service. Your account or phone-system administrator creates your extension outside the app. The app does not create a new customer account, and downloading or uninstalling it does not start or cancel a paid phone service.

Information used for calling and support

To authenticate your extension, connect calls, provide notifications, troubleshoot faults and prevent abuse, the app and our voice platform process extension and account identifiers, display names, phone and SIP addresses, authentication information, IP addresses, device or installation identifiers, call audio, call history, call-quality diagnostics and service/security logs. Caller information is supplied to the other party and to service providers as necessary to deliver a call. We do not use GH Phone data for advertising or sell it.

Permissions and optional contact directories

Microphone permission is needed to speak during calls. Notification and phone-integration permissions support incoming calls and device call handling. Camera permission is optional and is used to scan a setup QR code; the camera image is processed on the device rather than uploaded for scanning.

Contact permission is optional. The app uses your device address book to look up and call contacts; enabling this permission alone does not upload your address book to GippsHost. If you separately configure a CardDAV or LDAP directory, directory identifiers, authentication information, contact details and search queries may be transmitted to that chosen server for synchronisation or lookup. CardDAV can also save contact changes to that server when you choose that address book for new contacts. Use only a directory you trust and are authorised to access. Its operator is responsible for its own handling and retention of data.

Encryption and notifications

The updated GH Phone Android app requires HTTPS for CardDAV and provisioning, verified StartTLS for LDAP, and server-certificate verification. It blocks unencrypted HTTP directory requests, including a downgrade from HTTPS, and does not allow directory TLS or call encryption to be switched off. An old insecure CardDAV configuration is paused until you supply a valid HTTPS address; downloaded contacts remain on your device.

The connection from the app to GippsHost's voice gateway uses TLS for signalling and mandatory SRTP for call audio. This protects the app-to-gateway connection; it is not a claim of end-to-end encryption through a telephone carrier, the other party's network, email delivery or the recipient's device.

Google Firebase Cloud Messaging supplies Android incoming-call wake-up notifications. Google processes a Firebase installation/device registration identifier and technical messaging information. Incoming-call notification data may include the caller display name, phone or SIP identifier and call identifier. Google and other service providers may process data outside Australia. See Firebase's privacy information. The GH Phone Android build does not include Firebase Analytics or advertising identifiers, and Crashlytics is disabled. Service call-quality diagnostics used for support are separate from advertising analytics.

Voicemail, recordings and retention

Live audio is processed to deliver calls. Voicemail and any recording depend on your service settings and an authorised user's recording action; automatic recording is off by default. For Voicemail to Email, the voice platform retains a temporary copy for email retries and deletes that copy after the receiving mail server accepts delivery. Acceptance does not prove that the recipient read the message. Copies in the recipient's mailbox are controlled by that recipient and their mail provider.

For a stored voicemail mailbox, messages remain until an authorised user deletes them or the service's retention rules apply. A mailbox can fill to its configured capacity and reject new messages. Locally saved call history, contacts, recordings, settings and diagnostic logs remain on the device until removed, rotated or the app's storage is cleared. GH Phone credentials and recordings are excluded from Android cloud backup and device transfer.

We retain service call records, security diagnostics, support correspondence and account information only for as long as reasonably needed to deliver the service, resolve faults or disputes, prevent fraud and meet applicable legal or business record-keeping requirements. Required records are not automatically erased when you remove an extension from the app. Requests to delete these records are handled as described below, including any lawful retention exceptions.

You can request deletion without reinstalling GH Phone or signing in to the app. Email support@gippshost.com.au with the subject GH Phone data deletion request. You may also raise the request with GippsHost Support through Nexus.

1. Tell us the phone number or extension and the customer or business it belongs to. Describe whether you want particular data deleted, the app's extension access revoked, or the underlying customer/service account closed. Do not send passwords, voicemail PINs or setup QR codes.
2. We verify your identity and authority, including with the phone-system administrator for a business-managed extension. We confirm the scope, any effect on shared business records or service access, and the expected handling time before making a destructive change.
3. We delete or anonymise information that is no longer required and address relevant copies held by service providers on our behalf where applicable. If some information must be retained for legal, security, fraud-prevention, billing or dispute reasons, we explain which records, why, and the retention period or criteria that apply. We confirm the outcome when the request is complete.

A deletion request does not itself cancel your phone service, port or release a phone number, delete other people's records, or remove copies held by call recipients or your chosen directory/email provider. If you also want to cancel a service, say so explicitly; we explain the separate cancellation process and any required retained records.

To remove local app data from your Android device, use Android Settings → Apps → GH Phone → Storage → Clear storage, or uninstall the app. This removes app-owned local data and settings; it does not delete contacts in your device address book, exported files, server voicemail, service records or your directory provider's data. Ask us or the relevant provider to deal with those copies. Removing local data means the app must be set up again.