Privacy policy

M.S. Project Zeus CY Limited (trading as GreaseTrapQuotes, HE 430641, Cyprus) operates greasetrapquotes.com and the services described below ("Service"). This policy explains what personal data we collect, why, how we use it, and what rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR), the Cyprus Data Protection Law (125(I)/2018), and the Australian Privacy Act 1988 (Cth) for users located in Australia.

1. What we collect

When you submit a quote request, we collect:

• Your name, business name, mobile number, and email address
• The venue address, suburb, postcode, and approximate GPS coordinates
• Trap size, access type, service frequency, and last-service date
• Optional photos you upload of the trap or kitchen access
• UTM parameters and referrer (where you came from)
• Your preferred contact method and time

When you sign in as a contractor, we additionally collect your ABN, EPA licence number, public liability insurance certificate, postcodes served, and bank-card payment metadata from Stripe (we do not store the card number).

When you call us on 02 8880 5992, we collect: the audio of the call, a written transcript of the call, your caller ID (the number you dial from, unless you withhold it), and any details you give to capture a quote request (business name, address, trap details, contact information). See the dedicated AI-receptionist section below.

We log technical data automatically: IP address, browser type, pages visited, and timestamps of actions, for security and abuse prevention.

2. Why we collect it (legal bases)

• Contract performance. Matching you with three licensed contractors is the service you requested.
• Legitimate interest. Fraud prevention, abuse detection, service improvement.
• Legal obligation. Retaining transaction records for the period required by Cyprus and Australian tax law.
• Consent. Sharing your contact details with up to three contractors. You give this consent explicitly via a tick-box at the end of the quote form.

3. Who we share it with

• Up to three licensed contractors serving your postcode, after you submit the quote form. Contractors receive: your name, mobile, email, venue address, and trap details. They are bound by our Contractor Agreement to use this data only to contact you about the quoted job.
• Service providers we rely on, each contracted with us for confidentiality and data protection: Supabase (database, ap-southeast-2 / Sydney), Vercel (hosting), Google Maps and Mapbox (autocomplete + satellite tiles — you can opt out in your browser settings), Amazon SES (transactional email delivery), Twilio (SMS delivery), Stripe (contractor payments), Zadarma (inbound telephony and the AI voice receptionist), OpenAI (the language model inside the AI receptionist, accessed via Zadarma), Plausible Analytics (cookie-less analytics) and Google Analytics 4 (cookie-based analytics).
• Regulatory authorities if compelled by court order or applicable law.

We never sell your personal information. We never share it for marketing by third parties.

4. Phone calls and the AI receptionist

Our published phone number 02 8880 5992 is answered by an automated AI receptionist provided by Zadarma (Estonia, EU) using OpenAI's language models. The receptionist greets you, lets you choose between a venue quote, a contractor enquiry, or general questions, and — for quote requests — collects the same information the website form collects, then submits it to our matching system.

You are told you are speaking with an automated system at the start of every call. You can ask to speak with a human at any time and the call will be routed to Mario directly, or a callback will be arranged. You can also email hello@greasetrapquotes.com instead of calling if you prefer to avoid AI altogether.

What we record:

• Call audio (the recording of both sides of the conversation)
• A written transcript of the call generated by speech-to-text
• Structured fields the AI extracts from the conversation (business name, address, trap details, contact information, etc.) so it can submit a lead on your behalf
• Caller-ID metadata (the number you dial from, call start and end time, duration)

Where it goes: audio and transcripts are processed by Zadarma in the European Union and by OpenAI in the United States. Extracted lead data is then stored in our Supabase database (Sydney). See section 5 for cross-border details.

How long we keep it: call audio recordings and transcripts are retained for 90 days for quality, dispute resolution and lead-recovery purposes, then deleted. Structured lead data extracted from a call follows the same 24-month retention as a web-submitted quote (section 6).

Automated decision-making: the AI receptionist captures information; it does not make decisions about you that have legal or significant effects. The decision to match you with three specific contractors is made by our matching system based on postcode, contractor capacity, and licence status — not by the AI. You can request human review of any lead routing by emailing the contact address above.

What the AI does not do: it does not store voice prints or use any voice biometric techniques. It does not train on your conversations (Zadarma's and OpenAI's terms with us exclude training use). It does not transfer your call content to any party other than the processors listed above.

5. International transfers

Because we are a Cyprus company operating an Australian-facing service, your data crosses borders. Specifically:

• Quote, lead and contractor data is hosted in Australia (Supabase ap-southeast-2 / Sydney) under EU and Cyprus controllership for low-latency Australian access.
• Phone calls — audio and transcripts — are processed by Zadarma in the European Union (Estonia) and by OpenAI in the United States for the language-model step.
• Transactional email is processed by Amazon SES in the United States(us-east-1); SMS by Twilio in the United States; payments by Stripe in Ireland and the United States.
• Analytics data is processed by Google Analytics 4 in the United Statesand by Plausible Analytics in the European Union (Germany). Both receive aggregate page-traffic data only.

EU-to-Australia and EU-to-US transfers rely on the European Commission's adequacy decisions where they apply, and on Standard Contractual Clauses (SCCs) plus supplementary measures where they do not. We have an Australian Privacy Principle 8 cross-border framework in place for users in Australia.

6. How long we keep it

• Quote requests: 24 months after submission (so you can reorder)
• Phone-call audio recordings and transcripts: 90 days, then deleted
• Contractor profiles: until you ask us to delete your account, then anonymised within 90 days
• Stripe transaction records: 7 years (Cyprus accounting law and AU tax record-keeping)
• Marketing opt-ins: until you unsubscribe
• Server logs: 90 days

7. Your rights

Under GDPR (if you're in the EU/EEA), the Cyprus Data Protection Law, and the Australian Privacy Principles, you can:

• Access the personal information we hold about you, including call recordings and transcripts
• Correct it if inaccurate
• Ask us to delete it ("right to be forgotten")
• Object to processing for direct marketing
• Request a portable copy of your data
• Request human review of any decision made about you, including matching decisions and how the AI receptionist handled your call
• Refuse the AI receptionist by emailing us instead of calling, or by asking for a human on the line
• Lodge a complaint with the Cyprus Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy) or the Office of the Australian Information Commissioner (oaic.gov.au)

To exercise any of these rights, email hello@greasetrapquotes.com. We aim to respond within 30 days.

8. Cookies and analytics

We set a single first-party cookie strictly for authentication (Supabase session).

For audience measurement we use two analytics tools that sit alongside each other:

• Plausible Analytics: cookie-less, does not track you across sites, aggregates page-level traffic only. No personal data collected.
• Google Analytics 4 (GA4): sets first-party cookies named _ga and _ga_*. We have configured GA4 with IP anonymisation on, Google Signals off, and ad-personalisation signals off, so the data we collect is aggregate page-traffic only and is not used to build a personalised advertising profile of you. GA4 cookies expire after up to 24 months.

We do not use Facebook Pixel, retargeting pixels or any third-party advertising trackers. We do not sell analytics data to anyone.

9. Security

Database connections are encrypted with TLS. Passwords are hashed with bcrypt. Payment card data never touches our servers (handled by Stripe). Production access is restricted to named company personnel with multi-factor authentication.

10. Changes

If we materially change this policy we will email registered contractors and post a notice on the homepage at least 14 days before the change takes effect.

11. Contact

Data controller: M.S. Project Zeus CY Limited, Margarita Court 5, Tafoi ton Vasileon 118, 8015 Paphos, Cyprus
Registered in Cyprus (HE 430641)
Email: hello@greasetrapquotes.com