Privacy Policy.
What information we collect, how we process it, and what rights you have — as a paying subscriber and as an end user — under the Israeli Privacy Protection Law, Amendment 13, and the EU GDPR.
01 · Introduction & scope
This Privacy Policy describes how BOTEN ("we", "the Company", "the service operator") collects, processes, stores, uses and protects personal information. The policy applies to two groups:
- Customers (subscribers) — business owners and private subscribers who purchase a subscription to BOTEN and run it on their own WhatsApp account.
- End users — event guests, business customers or anyone who messages a BOTEN subscriber's WhatsApp account.
This policy is aligned with the Israeli Privacy Protection Law, 5741-1981, Amendment 13 (in force as of August 14, 2025), the Privacy Protection (Information Security) Regulations, 5777-2017, and any other applicable Israeli data-protection law. Because the system's primary database is hosted in the European Union (Frankfurt, Germany), we also follow GDPR principles, including data minimisation, purpose limitation and accuracy.
02 · What information we collect
2.1 Information about the customer (business owner / private subscriber)
- Identifiers: full name, business name (if applicable), WhatsApp phone number, email address.
- Service details: business sector / event type, approved services, pricing, opening hours, custom messages.
- Subscription details: plan, signup date, payment history (without credit card details).
- Usage data: conversation count, settings changes, report views.
2.2 Information about end users
- Basic identifiers: name and phone number as shown in the user's WhatsApp profile.
- Conversation content: messages sent and received within the Service.
- Metadata: date and time of contact, conversation language, conversation length.
2.3 What we do not collect
We do not knowingly collect: credit card details (processed and stored only by Grow by Meshulam), location data, biometric data, genetic information, medical information, or any other particularly sensitive information as defined by Amendment 13.
03 · Why we use this information
- Delivering the Service: running BOTEN, routing messages, sending conversation summaries and performance reports, managing the subscriber account.
- Customer communication: notices about service changes, incidents, price updates, invoices, and technical support.
- Service improvement: analysing aggregate usage patterns (without personal identification) to improve system performance and answer accuracy.
- Legal compliance: retaining records for reporting obligations, responding to court orders, meeting regulatory duties.
- Abuse prevention: detecting and preventing fraud, unauthorised use, and breaches of the Terms of Service.
04 · Legal basis for processing
- Consent — the subscriber gives consent at signup.
- Contract performance — processing is necessary to deliver the purchased service.
- Legitimate interest — service improvement, fraud prevention, information security.
- Legal obligation — compliance with the Privacy Protection Law, Consumer Protection Law, and tax law.
05 · Sharing with third parties
BOTEN does not sell, rent or trade personal information about customers or end users. Information is shared only with the following parties, and only for the purposes listed:
- WhatsApp / Meta — to operate the Service through the WhatsApp Business API. Meta processes messages under WhatsApp's terms of service and privacy policy.
- Grow by Meshulam — for payment processing only. Grow handles payment details under PCI DSS standards.
- Anthropic (Claude AI) — for natural-language processing only. Per Anthropic's API policy, content sent through the API is not used to train models. Details: Anthropic Privacy Policy.
- Infrastructure providers (hosting, servers) — secure servers hosting service data. All providers are bound by Data Processing Agreements (DPAs).
- Law-enforcement authorities — only when required by court order, legal obligation, or to protect public safety.
06 · Storage, retention and security
6.1 Retention periods
- Conversation content: retained for 90 days, for reporting and support. Deleted automatically thereafter.
- Conversation summaries and aggregate reports: 12 months, after which they are deleted or moved to anonymous archive.
- Customer details and subscription data: retained for the lifetime of the subscription and up to 36 months afterwards (legal and tax obligations).
- Payment data: stored exclusively by Grow by Meshulam. BOTEN keeps only accounting records (amount, date, reference).
- After cancellation: 30 days of full access, archive up to 36 months, then final deletion.
6.2 Information security
- Encryption in transit (TLS 1.2+) and at rest.
- Role-based access controls (RBAC).
- Audit logs for access to data.
- Regular backups and disaster recovery plan.
- Periodic security testing.
07 · Your rights as a data subject
Under the Israeli Privacy Protection Law and Amendment 13, every individual (subscriber or end user) has the following rights:
- Right of access — to request and receive a copy of the personal information we hold about you. We respond within 30 days.
- Right of rectification — to ask us to correct inaccurate, incomplete or outdated information.
- Right of erasure — to request deletion of personal information, subject to legal limits (tax retention, court orders).
- Right to object — to object to processing for specific purposes.
- Right to portability — to receive the data in a structured, machine-readable format.
To exercise these rights, see the contact details in section 11.
08 · Cookies and tracking
BOTEN runs primarily through WhatsApp and does not use cookies. Web report pages (links sent over WhatsApp) may use only essential session cookies for the page to function, with no advertising or analytics tracking.
09 · International data transfers
Some of our infrastructure providers (Anthropic, cloud providers) may process data in jurisdictions that either have an adequate level of protection or where we have appropriate contractual safeguards in place. The primary database is hosted on Supabase servers in the European Union (Frankfurt, Germany), under GDPR. Anthropic (Claude AI) services run in the United States and are covered by a Data Processing Agreement (DPA) including Standard Contractual Clauses (SCCs).
10 · Minors
The Service is intended only for adults (18+). We do not knowingly collect personal information about minors. If we become aware that such information has been collected, it is deleted immediately. A parent or guardian may contact us if they believe their child has provided information.
11 · Contact and exercise of rights
- Service operator: Omer Levy
- Email: info@boten.biz
- Operational WhatsApp: +972 53-717-2151
- Data Protection Officer (DPO): Omer Levy, info@boten.biz
- Response time: up to 30 business days (or sooner, as required by law).
12 · Updates to this policy
BOTEN may update this policy from time to time. Material changes will be announced with 30 days' prior notice via WhatsApp and/or email. The updated version will carry the new last-updated date.
