Privacy Policy

Last updated: 19 September 2026

1. Who we are and our role

1.1. Whapiz, company no. 301535670, 65 Herzl St. / Rishon LeZion (the "Company") operates Whapiz — a CRM for business messaging.

1.2. Two roles: (a) towards business customers and their users (account details, billing, website usage) the Company is the data controller; (b) towards the information a customer enters and receives through the Service (its contacts, conversations, files) the customer is the controller and the Company processes that information on the customer's behalf, under its instructions, the agreement and this policy.

1.3. This policy applies under the Israeli Protection of Privacy Law, 5741-1981 and the Protection of Privacy Regulations (Data Security), 5777-2017, and — where relevant — the GDPR for data subjects in the EU.

2. What we collect

2.1 Customer and user data (account holders): name, business email, phone, business name, password (one-way hashed), role, interface language, IP address, browser/device type, login times, admin audit logs, billing details (last 4 card digits, card type, invoices — full card details are stored only by the payment provider). 2.2 Data the customer processes through the Service (on its behalf): contacts and their details (name, phone, email, tags, notes), message content on every channel (text, media, files, voice notes), AI transcripts and insights, forms, orders and payments the customer collects from its own customers, call logs (if enabled). 2.3 Data received from platforms: user identifiers and public profile data from Meta (WhatsApp/Facebook/Instagram), Telegram, Google (Gmail/Calendar), Microsoft (Outlook), according to the permissions the customer grants when connecting. 2.4 Cookies and local storage: login tokens, preferences (language, display mode) and basic usage metrics. No third-party advertising cookies .

2.5 Google user data (Limited Use). A business can connect its Google account to Whapiz in two separate ways, and each one asks only for what it needs:

• Google Calendar (the business's availability, its calendars' basic properties such as the time zone, and events on calendars it owns, plus the account's email address):
  • Whapiz reads the calendar's busy times at the moment it offers appointment times. Busy times are not stored.
  • Whapiz creates, updates or cancels events only for appointments booked in Whapiz.
  • We store only those appointments: the event's ID, its time and the customer's details.
• Gmail inbox (read and modify, send, plus the account's email address):
  • Whapiz imports the mailbox's messages, including attachments and labels, into the business's shared inbox as conversations, and keeps them in sync with Gmail.
  • When the business's staff label, archive, move to trash or mark a conversation as read in Whapiz, or create, rename or delete a folder, Whapiz applies the same change in Gmail.
  • Replies written by staff are sent from the business's Gmail address.

We use this data only to provide these features to that business. We do not sell it and do not use it for advertising.

It is shared only as needed to provide the service:

• Mobile notifications: sent to the business's staff, they show the sender's name and a short preview, such as the subject line, through Firebase Cloud Messaging and Apple Push Notification service.
• The AI provider: when the business uses AI features, as described below.
• Transfers the business configures itself.
• Where the law requires.

AI features.

• Email: the business's AI assistant may process email content only to help that business, for example with suggested replies, summaries, highlighting key issues and organizing its inbox. It does so only when the business's staff use these features, through the AI provider configured for the business's account (OpenAI).
• Calendar: for appointment booking, the assistant receives only the free appointment times calculated from the calendar's busy times and the link of a meeting Whapiz created. It does not receive calendar event details.
• No training: we do not use Google user data to develop, improve or train generalized AI or machine-learning models. The AI provider receives it only to produce the result for that business.

Whapiz staff do not read Google user data, except with the business's permission (for example, to help with a support request), for security purposes, or to comply with the law. Access tokens are stored encrypted.

The business can disconnect at any time from Whapiz settings, or at https://myaccount.google.com/permissions.

• Disconnecting the calendar deletes the connection and its tokens.
• Disconnecting the Gmail inbox stops all access, and its tokens are no longer used.
• Imported emails stay part of the business's conversations until the business deletes them or closes its account, as described in section 7.

Whapiz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Why we use it

• Providing the Service: sending and receiving messages, managing conversations, automation, notifications (including push notifications to devices).
• AI features: analysing messages for automatic replies, classification, transcription and insights — only when the customer enables them.
• Billing, invoicing, fraud prevention and collection.
• Security, error monitoring, audit logs.
• Support and service communication; service updates. Marketing email only with consent, with an opt-out in every message.
• Compliance with the law and lawful requests.

4. Who receives data (sub-processors)

We do not sell personal data. Disclosure to authorities happens only as required by law.

5. Transfers outside Israel

Some providers operate outside Israel. Transfers are made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001, based on the controller's (customer's) consent, the providers' contractual commitments and an adequate level of protection.

6. Security

Encryption in transit (TLS), encryption of access tokens at rest, logical separation between customers (tenant isolation), role-based access control, audit logs, daily backups, monitoring and a host firewall. No system is completely secure; a serious security incident is handled and reported as required by law and by the customer agreement.

7. Retention

• Account data: for the duration of the agreement and up to 30 days after it ends, then deleted, except billing records kept for 7 years under tax law.
• Customer content: per the customer's settings; deleted with account deletion ("Delete account" in settings), subject to legal limits.
• Technical logs: up to 90 days.
• Backups: a 30-day cycle.

8. Data-subject rights

Access, rectification, deletion, objection to marketing, and portability (export) — by contacting support@whapiz.com. Where data is processed on behalf of a business customer (section 1.2(b)) we refer the request to that customer or help it respond. We answer within 30 days.

9. Minors

The Service is not intended for anyone under 18 and we do not knowingly collect data from minors as customers. A customer's conversation content may include data about various data subjects; the customer is responsible for the lawfulness of that collection.

10. Changes to this policy

A material update is announced on the website or by email 30 days in advance. The last-updated date appears at the top of this document.

11. Contact

Privacy officer: the Whapiz team · support@whapiz.com · 65 Herzl St. / Rishon LeZion · +972509177229