Privacy Policy

Who is responsible for the data

For data about the people who sign up for the Service, team members, those who pay and visitors to the website, we are the controller of the database.

For data about the customers of the stores that use the Service - the messages they send and receive, their name, their phone number and their orders - each store is the controller, and we hold and process the data on its behalf. See Data about stores’ customers.

What data is collected, and where from

• Account and team: email address, name, role in the store, the store’s name and the interface language. If you sign in with Google, your name and email address come from Google. When a team member is invited, their email address and who invited them are kept.
• WhatsApp connection: the business phone numbers, the WhatsApp business name, the account’s identifiers at Meta, the quality rating, and the access key Meta issues (kept encrypted).
• Conversations: the customer’s phone number and WhatsApp profile name, the name saved for them in the phone’s contacts (if synced), the content of messages and files, delivery status, internal notes and which agent a conversation is assigned to. On first connection, up to 180 days of history can be synced from the phone.
• Connected store: the site’s address and name, and order details - number, status, amount, items, the customer’s name and phone number, dates, a link to the order in the store’s admin, and - where the checkout asked - whether the customer agreed to order updates and to offers on WhatsApp. On connection, orders from the past two years are sent, and after that every new order and every change.
• Payment: the payer’s name, phone number and email; the card’s reference (token) from Grow, its last four digits, type and expiry date; and the details of every charge - amount, date, result and approval number. The full card number and security code are entered on Grow’s page and never reach us.
• Usage and technical data: records needed for operation and security, such as IP address, browser type and access times, and usage counters, such as the number of messages sent and the size of files.
• Messages to us: what you write to us, and your contact details.

Do you have to provide the data

There is no legal obligation to give us data; providing it depends on your will and consent. However, without account details you can’t sign up, without connecting WhatsApp or a store the features that depend on them won’t work, and without payment details you can’t subscribe.

What the data is used for

• running the Service: showing conversations and orders, sending and receiving messages, and managing the team and permissions;
• writing reply drafts with AI when a rep asks for one - the draft is shown to the rep only, who decides whether to send it;
• summarising a conversation for the team with AI when a rep opens one that has new messages: what the customer wants, what the team promised and by when - shown to the team only, and nothing is sent to the customer;
• weekly suggestions for the bot: messages customers wrote that the bot did not recognise are read with AI, to suggest changes to the account owner;
• planning a campaign with AI when the account owner asks for suggestions: the store’s name, what the owner wrote that they want to offer, figures about the list and past campaigns, and the text of messages already approved are sent - no names, no phone numbers and no details of any customer. The suggestions are shown to the account owner only, who decides what is sent;
• sending the messages the store’s automations set up, on the store’s behalf and instructions - only to customers who agreed to them at the store’s checkout;
• signing in and security, including preventing abuse and fraud;
• taking payment, issuing receipts and keeping the records the law requires;
• sending service messages - sign-in links, team invitations and notices about the subscription;
• answering questions and providing support;
• improving the Service based on aggregate usage data;
• complying with the law and protecting our rights.

We won’t send you advertising without your consent, and we won’t use data about stores’ customers for any purpose of our own.

For users in the European Union: the legal basis for processing is performing our agreement with you (running the Service and taking payment), complying with a legal obligation (records and reporting), and our legitimate interest in security, preventing fraud and improving the Service.

Who receives the data

We don’t sell personal data. It is given only to providers who help us run the Service, and only as far as they need it:

• Supabase - the database, signing in, and file storage. Servers in Frankfurt, Germany.
• Vercel - hosting the website and the servers that run the Service. Servers in Frankfurt, Germany, with requests passing through Vercel’s global server network.
• Meta (WhatsApp) - carrying messages between the store and its customers, through the WhatsApp Business Platform. Meta processes messages in its own systems, including in the United States, and also acts under its own privacy policy.
• Resend - sending email, such as sign-in links and team invitations. Sent from the European Union.
• Google - signing in with Google, only for those who choose it.
• Grow - processing payments and keeping the card securely. Israel.
• Anthropic - writing reply drafts when a rep asks for one, summarising a conversation for the team when a rep opens it, and weekly suggestions for the bot: the conversation’s latest messages and its order, or messages the bot did not recognise, are sent to it for that. United States. Anthropic processes them under its data processing addendum, and its commercial terms don’t allow it to train models on this content.

A store’s data is shown to the team members the store invited, according to the permissions the store’s owner set.

Data will also be disclosed where the law requires it or under an order of a competent authority, or where needed to protect our rights. If the business is transferred to another entity, the data will be transferred to it subject to this policy, and we’ll tell you in advance.

Transfers outside Israel

The data is kept on servers in Germany, and some providers, such as Meta, Google and Anthropic, also process data in the United States. Transfers are made under the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 - to countries where the European Union’s data protection rules apply, and to providers that have undertaken by contract to keep and protect the data.

Data about stores’ customers

When a customer writes to a store on WhatsApp, or places an order in a store connected to the Service, the data about them reaches the Service on the store’s behalf. The store decides what the data is used for, and is responsible for notifying its customers of the collection under section 11 of the Privacy Protection Law, obtaining their consent to receive messages as the law and WhatsApp’s policies require, and not sending them advertising without express prior consent, as section 30A of the Communications Law requires.

We process the data only to provide the Service to the store, under our agreement with it (Processing data on the store’s behalf, in the Terms of Use).

A store’s customer who wants to see, correct or delete data about them should contact the store. If the request reaches us, we’ll tell the requester whether we hold data about them, give them the store’s name and contact details, and pass the request on to the store.

Data security

• All communication with the website and the Service is encrypted (HTTPS).
• The database and file storage are encrypted at rest by the hosting provider, and a connected store’s key is kept on our side only as a hash.
• Each store’s data is separated at the database level, and a team member sees only the stores they belong to.
• Files from conversations are kept in private storage, and open only through the Service, for the store’s team members, through a temporary link.
• Card details are entered on Grow’s payment page and never reach our servers.
• Access to our systems is limited to people on our behalf who need it.

No system is completely immune. If a security incident involving the data occurs, we’ll act under the Privacy Protection (Data Security) Regulations, notify the stores whose data was affected, and report to the Privacy Protection Authority where the law requires.

How long the data is kept

• Account details, conversations and orders are kept as long as the account exists - also after the subscription or the trial ends, so the store can come back and pick up where it left off. The store’s owner can ask at any time for the account and its data to be deleted.
• A team member removed from a store loses access immediately. Their name stays next to the messages and notes they wrote, so the conversations’ history stays complete.
• Payment records are kept for at least seven years from the end of the tax year they relate to, as the Income Tax (Bookkeeping) Instructions require.
• Technical and security records are kept for as long as needed for operation, security and compliance with the law.

The store’s owner can ask for it themselves, in Settings, under “Delete the account”. The request stands for seven days and can be called off at any moment; after that the account and everything in it is deleted automatically, the files you sent and received included.

After a deletion request, we’ll delete the data within 30 days, except data we must keep by law - the payment records alone, which hold nothing about your customers. Backup copies are deleted afterwards, in the ordinary backup cycle.

Your rights

Under the Privacy Protection Law, you are entitled to see the data about you kept in the database (section 13), and to ask to correct or delete data that is not accurate, complete, clear or up to date (section 14). You can also ask us to delete the account and its data.

You can send the request to us using the contact details at the end of this page. We’ll answer a request to see data within 30 days, and if we refuse it we’ll tell you within 21 days; we’ll answer a request to correct or delete data within 30 days. Access is given in Hebrew, Arabic or English. Before giving out data, we’ll verify that it is yours.

If you’re not satisfied with how your request was handled, you can contact the Privacy Protection Authority at the Ministry of Justice.

Users in the European Union also have their rights under the GDPR - including restricting processing, objecting to processing and data portability - and we’ll answer within one month. You can also complain to the data protection authority in your country.

Cookies

The website uses only cookies it needs to work. It has no analytics, tracking or advertising cookies.

• Sign-in cookies (sb-…) - keep you signed in to your account. Kept for up to 400 days.
• signed_in - lets the website show “Open inbox” instead of “Sign in” to someone signed in. Kept for up to 400 days.
• unbi_shop - remembers which store you’re working in, if you belong to more than one. Kept for up to 400 days.
• NEXT_LOCALE - remembers the website’s language. Deleted when you close the browser.

Outside services load only when they’re needed, and may then keep cookies of their own, under their own policies: Meta’s window when you connect a WhatsApp number, Grow’s payment page when you pay, and Google when you sign in with it.

You can block or delete cookies in your browser’s settings, but without the sign-in cookies you can’t sign in to your account.

Minors

The Service is intended for people 18 and older, and we don’t knowingly collect data about minors who sign up. Stores’ customers may include minors; handling data about them is the store’s responsibility.

Changes to this policy

We’ll update this policy when the Service or the law changes. We’ll give advance notice of a material change, by email or in the Service. The date at the top of this page shows when the policy was last updated.

Privacy questions

For any question or request about privacy, contact us using the details at the end of this page. If it concerns a store’s data, please include the store’s name.