Privacy Policy

This Privacy Policy explains what personal data Dror Kedem, Osek Patur (Israeli VAT-exempt sole proprietor) no. 307863720, registered at Rokach St. 21, Apt. 9, Ramat Gan 5253511, Israel, trading as HishoAgent ("we," "us"), collects, why, and how it's handled, both for the businesses that subscribe to our Service, and for the callers whose calls our Service answers on a subscribed business's behalf. We are the data controller for account and business data, and act as a data processor on behalf of the subscribed business for call data (see Section 3).

1. Data we collect

Account and business data: your email, business name, and the business information you provide us (hours, services, FAQ, tone). This is read to callers on your behalf.

Call data: the caller's phone number, an audio recording of the call, a transcript, and any lead details the AI captures (name, callback number, reason for calling). This data is shown to the subscribed business in their dashboard.

Payment data: handled entirely by Paddle.com, our merchant of record. We do not receive or store your card number; we only receive confirmation of your subscription status from Paddle.

Google Calendar data: if you connect your Google Calendar to enable appointment booking, we access your calendar's free/busy times to find available slots and create calendar events for confirmed bookings, using Google's calendar.events OAuth scope. We do not read event details beyond what is needed to check availability, and we do not access any other Google data. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. Our legal basis for processing

• Account, business, and call data: processed as necessary to perform our contract with you (delivering the Service).
• Call quality and Service improvement: processed under our legitimate interest in operating and improving a reliable Service, balanced against your and your callers' privacy.
• Billing data: processed as necessary to perform our contract with you and to comply with our legal obligations (tax, accounting).

We do not currently send marketing communications; if that changes, we will rely on your consent and give you a clear way to opt out.

3. How we use this data

• To operate the Service: answering calls, capturing leads, and showing them in your dashboard.
• To bill your subscription and communicate about your account.
• To improve the accuracy and quality of the AI voice agent.
• To respond to support requests.

4. Who we share data with

We share data with the infrastructure providers necessary to run the Service, each acting as a data processor on our behalf:

• Twilio: telephony, call routing, and call recording.
• Google Cloud (Vertex AI / Gemini): AI voice processing of call audio.
• Google Calendar API: checking availability and creating events, only for businesses that choose to connect a calendar for appointment booking.
• Supabase: database storage and account authentication.
• Paddle: billing, payment processing, and tax/VAT collection (as merchant of record).
• Resend: transactional emails (e.g. account confirmation).
• Vercel: web application hosting.

We do not sell personal data to third parties.

5. Cookies

We use strictly-necessary cookies required to keep you signed in (via Supabase authentication). With your consent, given through the cookie banner, we also use analytics (PostHog) to understand how visitors use this site, and the Meta pixel (Facebook and Instagram) to measure the performance of our ads. These load only after you click Accept; if you decline or ignore the banner, they do not run. Meta receives information about your visits and actions on this site, such as pages viewed and signing up for a trial, in accordance with Meta's own privacy policy.

6. International data transfers

We are based in Israel. Depending on which country a phone number is activated in, call data may also be processed and stored in a different country than the caller or the subscribed business, since this follows from where Twilio, Google Cloud, and Supabase host their infrastructure for the relevant region. Where personal data of EU/UK residents is transferred outside the EU/UK, we rely on our processors' own compliance mechanisms (such as Standard Contractual Clauses) for that transfer.

7. Data retention

We retain call recordings, transcripts, and lead data for as long as your account is active, so you can review your call history. If you close your account, we will delete or anonymize this data within a reasonable period, except where we're required to keep records for legal, tax, or billing purposes.

8. Your rights

If you are located in the EU/UK, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure ("right to be forgotten"); restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing relies on it. You also have the right to lodge a complaint with your local data protection supervisory authority. If you are located elsewhere, we will honor equivalent rights available to you under your local law. To exercise any of these rights, contact us at the email below.

9. Security

We rely on our infrastructure providers' security controls (encryption in transit, access controls, and industry-standard hosting practices) to protect personal data. No system is completely secure; if we become aware of a data breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.

10. Children

The Service is intended for business use and is not directed at children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date.

12. Contact

Questions about this policy or a data request: support@grizzlyagents.co.il