Compliance & privacy

workmylist handles real contacts' phones and legal obligations. This is the operator reference: what gets recorded, what the AI says at the start of every call, how DNCR and calling hours work, and how to handle deletion requests.

What gets recorded

Every call is recorded in audio and transcribed. Both are tied to the conversation and visible on the lead card — recording player, transcript, and a compliance summary.

Audio recording (.wav) — every call, full duration. Stored in a private encrypted bucket; retained for 12 months, then purged automatically.
Transcript — every call, turn by turn. Kept for as long as the agency account is active (audit trail for outcomes and captured fields).
Captured fields — motivation, timing, outcome, and the verbatim quote that made the lead hot.
Audit log — every AI decision affecting a contact (bookings, opt-outs, branch advances). 7-year retention for the December 2026 ADM obligation.

The disclosure (what the AI says)

Every outbound call opens by disclosing that it is an AI assistant and that the call is recorded. Example wording:

Typical opener

“Hey, it's Billy from Bulimba Property — I'm an AI assistant, just calling about [the reason]. The call's recorded for our records.”

After every call we automatically verify both the AI identity line and the recording linelanded in the opening turn. If either is missing, the call is flagged for review — you'll see it on the lead's compliance panel and in quality flags.

Not configurable

You can set the agency name and the AI's first name in Settings, but you cannot turn off the AI or recording disclosure. The product won't ship that config.

Where to see it in the app

Leads — open any lead with a completed call. The Compliance panel shows whether disclosure was delivered, when the call happened, and any quality flags. The opening AI turn gets a ✓ badge when both lines landed.
Account → Compliance register — download a CSV of every call in a date range (disclosure, consent, recording retention, quality flags, audit trail). Use this when a regulator or privacy officer asks for your compliance records.
Contacts — flip Do not call on any contact who asks to be removed. Takes effect immediately across every list and campaign.
Account — the master kill switch stops all outbound calling instantly.

Exporting for a compliance request

Go to Account and use Download CSV under Compliance register. Pick the date range (defaults to the last 12 months), and you get one row per call with:

Whether AI + recording disclosure was delivered in the opener
Recording stored and retention-until date
Consent trail (affirmed / declined / ambiguous)
Quality flags and audit decisions for that call
Prompt version for attribution

No paywall

Available on every plan, including trial — your compliance records are yours to export any time.

DNCR (Do Not Call Register)

Before every outbound call, we check the Australian Do Not Call Register. The check is invariant — it runs on every dial and cannot be disabled.

Exempt: existing-client relationship calls — past buyers, sphere contacts, appraisal follow-ups. These can proceed even if the number is on the register.
Blocked: number is on DNCR and the call is not exempt — the dial is aborted before it connects. Logged in the audit trail.
Customer says “stop calling me” during a call — the contact is flagged do-not-contact across your tenant. Future outbound to that number is blocked regardless of exemption.

Calling hours

Independent of DNCR. No outbound calls before 9am or after 8pm in the contact's timezone (not yours). No Sunday outbound. Public holidays follow the configured Australian holiday calendar.

Deletion requests (APP 13)

Under APP 13 of the Australian Privacy Act, a contact can ask for their data to be deleted. The flow:

Contact makes the request — to you, or on a call (captured as a quality flag and opt-out).
You act on it — mark Do not call on the contact, and email privacy@workmylist.com for a full purge (recordings, transcripts, eval-set entries derived from their calls).
Audit log entries are retained per the ADM obligation (the fact a decision was made, with PII redacted) — but the underlying conversation is removed.

Your CRM is separate

We propagate deletion through workmylist. Your CRM customer records are your data — deletion there is on you, via your CRM or its API.

December 2026 ADM rules

From 10 December 2026, businesses using automated decision-making must disclose AI involvement and keep an audit trail. workmylist was designed against this from day one:

Disclosure on every call — no exceptions.
Audit log captures every AI decision, tagged with the conversation and prompt version. 7-year retention.
A privacy policy template for your agency website, disclosing AI use, recording, retention, and sub-processors.

We're not lawyers — your published privacy policy is your responsibility — but we ship the audit trail and the template you need.