Privacy Policy

1. Who we are

This Privacy Policy ("Policy") describes how Aploai Ltd (אפלו איי.אי בע"מ), registered in Israel under company number ח.פ. 517348058, with its registered office at HaHashmonaim St 103, Tel Aviv-Yafo 6713319, Israel ("aploai", "we", "us", or "our") collects, uses, discloses, and protects personal data.

Our primary website is https://app.aploai.com. Our product ("Service") is an AI-powered customer support platform that enables businesses ("Customers") to communicate with their own end-users ("End-Users") across messaging channels including WhatsApp, Telegram, and web chat.

Contact for privacy matters: privacy@aploai.com.

2. Scope of this Policy

This Policy applies to:

• Visitors to aploai.com and our marketing pages ("Visitors").
• Users of our mobile operator app, dashboard and administrative interfaces ("Users") - typically employees or agents of our Customers.
• End-Users whose messages are processed by our Service on behalf of our Customers.

Our Customers act as data controllers for End-User data that flows through their instance of the Service; aploai acts as a data processor on our Customers' behalf. A Data Processing Agreement is available as described in Section 7.3 of our Terms of Service; the applicable agreement governs once executed.

3. Personal data we collect

3.1 Visitor data

• Server logs: IP address, browser user-agent, pages requested, and referrer URL, collected as part of standard infrastructure and security logging.
• Contact form submissions: name, email, company, message content.
• Cookies: see Section 10.

3.2 User (dashboard) data

• Account data: name, email, and your authentication identity managed by Google Firebase Authentication (we do not store passwords ourselves).
• Organization / billing data: company name, billing address, VAT ID.
• Usage logs: dashboard actions, feature usage, API calls.
• AI sharing permission records: workspace or operator scope, the decision, disclosure version, time recorded, and whether a workspace permission was imported from a confirmation of prior permission.
• Sign in with Apple or Google: we receive the account identifier and the name and email address supplied by the sign-in service. Apple lets you use a private relay email address. We use this information for authentication and workspace access; we do not use Apple sign-in to collect app interactions for advertising.

3.3 End-User data processed on behalf of Customers

When a Customer connects their WhatsApp Business Account to aploai through Meta's Embedded Signup flow, and conducts conversations with End-Users, we process:

• Phone numbers of End-Users contacting the Customer.
• Message content: text, images, audio, video, documents, location, interactive elements, and reactions sent to or from the Customer's WhatsApp number.
• WhatsApp profile data exposed by Meta: display name, profile picture (when shared by the End-User), user identifier.
• Metadata: timestamps, message status (sent, delivered, read, failed), message template category (utility, marketing, authentication), conversation identifiers.
• Opt-in records: source of opt-in (website form, purchase receipt, in-store sign-up, etc.), timestamp, opt-out timestamp if applicable.
• AI processing outputs: classifications, extracted entities, suggested replies generated by our large-language-model subprocessors.

We do not request, store, or process End-User credit-card data; payment information for the Customer's messaging costs is handled by Meta directly.

Shopify data. When a Customer connects a Shopify store, we process order identifiers and numbers, totals, currency, fulfillment status, and order attributes used to link orders to support conversations and report commerce performance.

Customer imports and abandoned-checkout workflows can also process customer display names, email addresses, phone numbers, marketing-consent status, and abandoned-checkout links. These features are disabled by default for the aploai public Shopify app until the required protected-field access has been approved and enabled. They can be used with separately authorized custom integrations. We use this data on the Customer's behalf for customer support and the workflows they configure.

Shopify data-access and deletion requests are handled through customers/data_request, customers/redact, and shop/redact webhooks.

4. Sources of personal data

• Directly from Visitors and Users when they sign up, contact us, or use the Service.
• From the Meta / WhatsApp Business Platform when a Customer connects their WhatsApp Business Account via Embedded Signup and when End-Users message the Customer.
• From Meta Login for Business when a User authenticates to consent to Embedded Signup (we receive a Facebook user identifier and a business-scoped access token).

5. Legal bases for processing

Israeli law. Our processing is subject to the Israeli Protection of Privacy Law, 5741–1981, as amended (including Amendment 13), and applicable regulations. Where informed consent is required, a description of a business purpose or a reference to this Policy does not replace that consent. Information supplied by a business Customer must be collected and used lawfully and within the Customer's authority and instructions.

Information you choose to provide. Unless we identify a specific legal obligation when requesting information, you are not legally required to provide account, contact, or workspace setup information. Without the information necessary to identify and authenticate you, we cannot create or provide access to your account. Without contact details and the substance of a support request, we may be unable to respond. Without connecting a messaging channel and supplying the relevant messages, the corresponding messaging and AI features cannot operate. Optional information may be omitted; the associated optional features may be unavailable.

Information collected from End-Users. The business Customer determines the purpose and circumstances of collecting information from its End-Users and is responsible for providing the applicable collection notice, including whether provision is mandatory or voluntary, the consequences of declining, recipients and purposes, and access and correction rights. Aploai's identity and contact details appear in Sections 1 and 16; requests concerning information controlled by a business Customer are addressed in Section 11.1.

If another jurisdiction's data-protection law applies, the legal basis and any additional rights must be assessed under that law. Contract performance or legitimate interests under the GDPR are not presented here as independent, general permissions to process personal data under Israeli law.

6. How we use personal data

• Operate, maintain, and secure the Service.
• Route inbound WhatsApp messages to the correct Customer's instance and deliver outbound messages via the Meta Cloud API.
• Generate AI-driven responses and suggestions, including automatic replies where configured by the Customer.
• Enforce the 24-hour WhatsApp customer-service window, template opt-in rules, and opt-out handling required by the WhatsApp Business Policy.
• Detect abuse, spam, and violations of our Terms of Service.
• Communicate with Users about their account, billing, security, and product updates.
• Comply with legal obligations and respond to lawful requests.

We do not sell personal data. We do not use WhatsApp message content to train general-purpose AI models; AI processing supports the Customer's workspace, including replies, summaries, retrieval, and operational diagnostics and evaluation.

6.1 AI processing and operator access

Who uses the app. The Aploai mobile app and web dashboard are help-desk tools for a Customer's authorized administrators and operators. End-Users communicate with the Customer through connected channels; they do not need to install the operator app for their information to be processed.

What is sent and why. To generate replies, summarize conversations, and retrieve relevant information, our backend sends AI providers the current message, relevant conversation history or summaries, and selected business knowledge. Depending on the enabled workflow, prompts and tool results may also contain customer or order information from connected integrations. Names, email addresses, phone numbers, and other personal information included in this material may therefore be sent to the AI provider. Responses may be sent automatically or handled by an operator, depending on the conversation and workspace settings.

Who receives it. AI processing uses OpenAI and Google (Gemini). The selected model and workflow determine which provider receives a request; a request is not necessarily sent to every provider. Processing takes place through our backend even when initiated from the mobile app.

Business responsibilities and permission. Customers are responsible for providing appropriate notices to their End-Users and establishing the permissions or other lawful basis required for the data they supply. Administrator authorization to use a service is distinct from an End-User's consent where that consent is required. This Policy explains processing; reading it, signing in, or accepting cookies does not by itself constitute a separate permission to share personal data with an AI provider.

Your choice and withdrawal. New workspaces require an administrator's explicit workspace permission during onboarding before AI features can be enabled. Each operator is separately asked for permission before initiating AI features in the dashboard or mobile operator app. You may decline; the affected AI features remain unavailable. An operator-initiated request requires both workspace and operator permission. Background AI workflows require workspace permission.

You can review, grant or withdraw your operator permission in Settings → AI data sharing. Administrators can also grant or withdraw workspace permission there. Withdrawing operator permission blocks subsequent AI provider requests initiated by that operator; it does not turn off other operators' permissions or the workspace's background workflows. Withdrawing workspace permission blocks subsequent AI provider requests for that workspace, including background workflows. A request already sent to a provider cannot be recalled, and withdrawal does not automatically delete data already processed or records that must lawfully be retained. Permissions can be granted again in Settings. For assistance or other privacy requests, contact privacy@aploai.com.

Previously obtained workspace permission. Existing workspaces may have a workspace permission recorded based on the service owner's confirmation that permission was previously obtained. Such records identify the imported source and the import time, rather than inventing an earlier permission date. They do not grant or imply permission for individual operators, and administrators can withdraw the workspace permission in Settings.

AI diagnostics. We use Braintrust Data, Inc. for operational diagnostics. Our application sends only selected, bounded operational counts, such as token and tool-call counts and request duration where available, together with fixed operation labels and failure indicators. It does not send prompts, messages, replies, tool inputs or outputs, raw error text, or customer, operator, workspace or conversation identifiers to Braintrust. Content capture is disabled across the application, and direct model callbacks to Braintrust are disabled.

7. Subprocessors

We share personal data with a limited set of subprocessors who process data on our behalf under written contracts:

A current list of subprocessors is available on request from privacy@aploai.com; this table is updated before new subprocessors are engaged.

Protection by service providers. Third parties processing personal data on our behalf are required to provide the same or an equivalent level of protection as described in this Policy, including confidentiality, appropriate security safeguards, limited processing purposes, and support for applicable data-subject rights. OpenAI API processing is governed by its Services Agreement and incorporated Data Processing Addendum. We use Gemini through a billing-enabled Google project; the Paid Services terms incorporate Google’s Data Processing Addendum for Products Where Google is a Data Processor.

8. International transfers

Aploai is based in Israel. Our cloud hosting, AI, messaging and diagnostic providers may process information outside Israel, including in the United States. Applicable locations depend on the provider and service configuration; see Section 7.

Transfers from Israeli databases must comply with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761–2001. This includes an applicable basis for transfer under those Regulations and the recipient's written commitment required by Regulation 3 to take adequate measures to protect the privacy of the people concerned. Where the transfer involves outsourcing, the requirements of Regulation 15 of the Protection of Privacy Regulations (Data Security), 5777–2017 also apply. Those requirements address the permitted processing, access, confidentiality, security, further providers, and the end of the engagement.

Where European or other transfer rules additionally apply, the relevant safeguards must also be in place. A European adequacy decision concerning Israel does not itself authorize onward transfers from Israel to another country.

Contact privacy@aploai.com for information about the safeguards applicable to your workspace.

9. Data retention

• Message content and metadata: retained for 24 months from the date of the message, then deleted or anonymized. AI-generated conversation summaries are cleared once the underlying messages are deleted. Customers may configure shorter retention in their workspace settings.
• Opt-in records: retained for the duration of the Customer's subscription plus 24 months, to demonstrate lawful basis for messaging.
• Billing and tax records (invoices, payments, VAT-relevant data): retained for up to 7 years, as required by Israeli bookkeeping and VAT law.
• Other account data: deleted on account termination, as described in our Terms of Service.
• Embedded Signup session logs: 24 months (required by Meta).
• Security and audit logs: 12 months.

Data is permanently deleted on Customer account termination, subject to the retention periods required by law.

10. Cookies

aploai uses a small set of first-party cookies and similar local-storage entries:

• Strictly necessary - session management and authentication (Google Firebase Authentication). These are always active because they are required for you to sign in and use the service.
• Preference - language and theme settings you choose. These are stored on your device only with your consent.
• Marketing - the Meta Pixel (Meta Platforms), which we use to measure the effectiveness of our own advertising on our public marketing pages. It is loaded only with your consent and is never loaded inside the signed-in application. Data collected by the Meta Pixel is processed by Meta under its own privacy policy.

When you first visit, we show a cookie consent banner. Preference and marketing cookies are set only if you accept them; if you decline, your language and theme choices still work for the current session but are not saved between visits, and no marketing tracking occurs. You can change your choice at any time through the Cookie settings link in the site footer, or by viewing, managing, or deleting cookies through your browser settings; blocking strictly necessary cookies may prevent you from signing in.

Apart from the consent-based Meta Pixel described above, we do not use advertising cookies, third-party analytics cookies, or cross-site tracking of any kind.

11. Your rights

Rights under Israeli law. Subject to the conditions and exceptions in the Protection of Privacy Law, you may request access to personal information about you held in a database under Section 13. Under Section 14, you may request correction or deletion of information that is incorrect, incomplete, unclear, or outdated. These provisions do not create an unconditional right to erase all records or a general right to data portability.

Additional deletion, restriction, objection, portability or withdrawal rights may apply under other applicable laws or in particular circumstances, including the Israeli rules concerning information transferred from the European Economic Area where applicable. Withdrawal of consent affects processing that relies on that consent; it does not necessarily require deletion of records that must lawfully be retained.

Send requests to privacy@aploai.com. We may ask for information reasonably necessary to verify your identity and locate the relevant records. We handle requests within the time limits required by the applicable law and explain any lawful refusal or restriction. End-User requests concerning a business Customer are addressed in Section 11.1. You may also contact the Israeli Privacy Protection Authority or another competent supervisory authority.

In-app account deletion. In the mobile app, choose Settings → Delete account. The option is also available on the account setup screen before a workspace is linked. After confirmation and identity verification, we delete your Firebase sign-in account, workspace memberships, device registrations, notification preferences and personal AI permissions, and remove account attribution from shared records. For an account linked to Apple, Apple authorization is also revoked. You do not need to contact customer support to delete your sign-in account.

If deletion cannot finish immediately, the request is saved, account access is blocked and cleanup retries every minute. The app distinguishes a pending request from completed deletion. A record containing a hash of your account identifier is retained briefly after completion to prevent reuse of an old session.

Shared customer conversations, business knowledge, training content and financial records remain with the workspace under the retention periods above; deleting an operator account does not close the business account. If the last administrator deletes their account, workspace AI permission is revoked and automations are paused. Account deletion does not cancel workspace billing. Backups and logs remain subject to their applicable retention periods.

11.1 End-User requests

End-Users who wish to exercise rights over data processed by aploai on behalf of a Customer should contact the Customer first. If the End-User cannot reach the Customer or their request relates to our processing activity directly, they may contact privacy@aploai.com or use our self-serve deletion form at https://app.aploai.com/data-deletion.

11.2 Meta-initiated deletion (business admins)

aploai implements the Meta Data Deletion Callback at https://api.aploai.com/webhooks/meta/data-deletion. This callback is invoked by Meta when a business admin who authenticated to aploai via Meta Login for Business (as part of WhatsApp Embedded Signup) subsequently:

• removes the aploai app from their Facebook Business Manager,
• revokes the business-integration token issued to aploai, or
• deletes their Facebook account.

On receipt of a signed request from Meta, we locate the WhatsApp Business Accounts and associated records tied to that business admin, anonymize or delete the associated WhatsApp conversation data retained on the business customer's behalf, notify the business customer of the revocation, and return a confirmation URL where the deletion status can be tracked.

This callback does not fire when an End-User messages a business via WhatsApp - End-Users have no Facebook-to-aploai connection. End-Users wishing to exercise deletion rights should use the direct channels described in §11.1.

11.3 California residents

If aploai accepts California customers, this section will be expanded to provide a Notice to California Residents as required by the California Consumer Privacy Act and California Privacy Rights Act (Cal. Civ. Code §1798.100 et seq.), including categories of personal information collected, sources, purposes, sharing disclosures, and the right to opt out of sale/sharing.

12. Security

We implement industry-standard technical and organizational measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 envelope encryption for secrets, database-level encryption).
• Role-based access control with row-level security for tenant isolation.
• Principle of least privilege for employee access.
• Audit logging of administrative actions.
• Regular security reviews and penetration testing.
• Incident response procedures, including breach notification within the timeframes required by law.

13. Children

The Service is not directed at children under the age of 16. We do not knowingly collect data from children. If you believe a child has provided personal data to us, contact privacy@aploai.com and we will delete it.

14. WhatsApp-specific disclosures

In connection with the WhatsApp Business Platform:

• We process End-User data only to operate messaging services requested by our Customers, not for our own marketing or advertising purposes.
• We do not sell or license WhatsApp-sourced data, and we do not use it to build user profiles across unrelated businesses.
• We do not share End-User data with Meta beyond what is necessary for message delivery via the Cloud API.
• We require Customers to obtain lawful opt-in from End-Users before sending marketing-category template messages, and we log opt-in and opt-out events as required by the WhatsApp Business Policy.
• Customers are contractually obligated to comply with the WhatsApp Business Policy and the WhatsApp Commerce Policy.

15. Changes to this Policy

We may update this Policy. Material changes will be announced in the dashboard and via email to Users at least 30 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

16. Contact

• Email: privacy@aploai.com
• Postal: Aploai Ltd, HaHashmonaim St 103, Tel Aviv-Yafo 6713319, Israel
• Response time: we acknowledge privacy inquiries within 5 business days and resolve them within 30 days.