Privacy Policy

bot67 is a service operated by Signals Mobile Marketing Ltd., a company registered in Israel ("the Company", "we"). bot67 gives businesses a platform for managing WhatsApp communication: an AI agent that answers leads, meeting scheduling, message broadcasts, automations and an API.

This policy explains what data we collect, how we use it, who it is shared with and how it can be deleted. It is written in accordance with the Israeli Protection of Privacy Law, the GDPR, the Meta Platform Terms and the Google API Services User Data Policy.

• "Personal data" — any information that can identify a person, including name, phone number, email, IP address and conversation content.
• "Customer" — a business or individual that opened a bot67 account.
• "End user" — a person who messages the Customer on WhatsApp (the Customer's lead or client).
• "WhatsApp data" — messages, files, metadata and delivery statuses originating from the Customer's WhatsApp account.
• "Meta" — Meta Platforms Inc. and its group companies, the provider of the WhatsApp platform.

A. Customer data (account owners)

• Identification: name, email, business name and password (stored hashed only).
• Subscription and billing: plan, payment status and customer identifiers at our payment processor. Card details are never stored by us.
• WhatsApp connection data: WhatsApp Business Account ID, phone number ID, business phone number, display name and the access token received through Meta's Embedded Signup.
• Agent settings: instructions, knowledge base, message templates, keyword rules and flows the Customer created.
• AI provider API keys entered by the Customer (stored encrypted).

B. End-user data (through WhatsApp)

• Phone number and WhatsApp display name.
• Content of messages and files sent and received, in order to show the conversation to the Customer and reply automatically.
• Metadata: timestamps, message direction and delivery status.
• Details the Customer adds about the lead: status, tags, score, notes and answers to questions.
• Booked meetings and opt-out requests.

C. Google data (only if the Customer connects it)

• Sign in with Google: name, email address and profile picture.
• Google Calendar: free/busy times, and creating events for meetings booked through bot67. We do not read the content of existing events.

D. Facebook data (only if the Customer connects it)

• Leads from the Facebook Lead Ads forms of the Page the Customer connected: name, phone, email and form answers.

E. Technical data

• IP address, browser and operating system, and access logs for security and operations.
• Strictly necessary cookies only (see section 8).

• Performance of a contract — to provide the service to the Customer.
• Legitimate interest — security, fraud prevention and service improvement.
• Consent — for connecting third-party accounts (Meta, Google) and for marketing messages to end users, which the Customer is responsible for obtaining.
• Legal obligation — keeping billing records and complying with competent authorities.

For end-user data, the Customer is the data controller and bot67 acts as a processor on its behalf.

• Receiving, storing and displaying WhatsApp conversations in the Customer's account.
• Replying automatically through the AI agent, keyword rules and flows the Customer configured.
• Sending messages and broadcasts, including templates approved by Meta.
• Booking meetings and syncing them with the calendar the Customer connected.
• Showing the Customer data and reports: leads, conversations, meetings and replies.
• Billing, subscription management and plan quota enforcement.
• Support, security, troubleshooting and abuse prevention.

We do not use Meta or WhatsApp data for targeted advertising, we do not sell it, and we do not build profiles from it for any purpose other than the service.

bot67's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar data is used solely to check availability and book meetings for the Customer who connected the calendar.
• We do not transfer Google data to third parties, except as necessary to provide the service, to comply with law, or as part of a merger or acquisition, with notice.
• We do not use Google data for advertising, and we do not use it to train AI models.
• No human reads a Customer's Google data, except with the Customer's explicit consent, for security purposes, or when required by law.

The Customer can revoke access at any time at myaccount.google.com/permissions.

We share data only with providers required to run the service:

• Meta Platforms — WhatsApp data is transmitted to and processed by Meta under the WhatsApp Business terms and Meta's privacy policy.
• Alternative WhatsApp connection provider (Green API) — for Customers who chose the quick QR connection instead of Meta's official connection.
• AI providers — Anthropic and/or OpenAI, as chosen by the Customer. Conversation content is sent to them only to generate the reply.
• Google — for sign-in and calendar sync, only for Customers who connected it.
• Hosting and infrastructure — Vercel (application hosting) and Neon (database in the European Union).
• Payments — SUMIT, for payment processing and invoicing.
• Transactional email — Resend, for verification and password-reset emails.

We do not sell personal data to third parties.

In a merger, acquisition or change of control, data may be transferred to the acquirer, subject to prior notice.

We disclose data to authorities only under a valid legal request (see section 15).

bot67 uses strictly necessary cookies only: a sign-in cookie for session management and a language-preference cookie. We do not use third-party advertising or tracking cookies.

Blocking the necessary cookies in your browser will prevent signing in.

Data is stored in a database in the European Union. Some of our providers (Meta, Vercel, the AI providers) also process data in the United States.

These transfers rely on the safeguards the providers offer, including Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework, where applicable.

• All communication with the service is encrypted with HTTPS/TLS.
• Passwords are stored hashed only.
• Sensitive tokens and keys (AI keys, Google tokens, webhook secrets) are stored encrypted with AES-256-GCM.
• Customer API keys are stored as a hash only and shown once at creation.
• Tenant isolation: every data access is limited to the signed-in user's organisation.
• Inbound webhooks are signature-verified, and outbound webhooks are signed with HMAC.

If a security incident affects personal data, we will notify affected Customers and authorities as required by law.

• Account data, leads and conversations — kept while the account is active, or until the Customer deletes them.
• After account closure — data is deleted within 90 days, unless the law requires us to keep it.
• Billing records and invoices — 7 years, as required by Israeli law.
• Technical logs — up to 12 months.

A Customer can delete a lead, conversation or file at any time from within the product. An end user can request deletion from the Customer or directly from us.

Under the GDPR and the Israeli Protection of Privacy Law, you are entitled to:

• Access your data and receive a copy of it.
• Correct inaccurate data.
• Delete your data (the "right to be forgotten").
• Restrict or object to processing.
• Receive your data in a portable format.
• Opt out of messages — sending "STOP" (or "הסר") on WhatsApp unsubscribes you automatically.
• Not be subject to a solely automated decision with legal effect.

To exercise these rights, contact info@signals.co.il. We handle requests within 30 days.

Detailed instructions for removing the app from your Meta account and requesting full deletion of your data from our servers are on the Data Deletion Instructions page: bot67.com/en/data-deletion

bot67 operates as a WhatsApp Business Tech Provider and is committed to:

• The Meta Platform Terms and the WhatsApp Business terms.
• The WhatsApp Business Messaging Policy, including the opt-in requirement and honouring opt-out requests.
• Using Meta data solely to provide the service to the Customer who connected their account.
• Not using Meta data for targeted advertising and not selling it to third parties.
• Deleting Meta data on the Customer's request or when the app is disconnected.

• Legality — we do not disclose personal data to authorities except under an official request with a valid legal basis, such as a court order.
• Protecting the user — we review every request and object to requests that are overbroad or lack a legal basis.
• Minimisation — we disclose only the minimum data required.
• Transparency — where the law allows, we inform the Customer of the request.
• Record keeping — every request is documented, including what was disclosed.

The service is intended only for businesses and for individuals over 18. We do not knowingly collect data from minors; if we learn that such data was collected, we will delete it.

We may update this policy. For material changes we will give 30 days' notice by email to active Customers and by a notice on the website. Continued use after the change takes effect constitutes acceptance of the updated policy.

Signals Mobile Marketing Ltd.

Email: info@signals.co.il

Phone: +972-52-578-7657

Address: 25 Nofar St., Yavne, Israel

You may lodge a complaint with the Israeli Privacy Protection Authority. EU residents may contact the supervisory authority in their country of residence.