Privacy Policy

1. Who we are

Paletix ("Paletix", "we", "us") is operated by Paletix Technologies Ltd., 29 HaMaccabim St., Sderot, Israel. Paletix builds and runs AI digital workers for businesses. For example, PAL is a digital booking rep that answers a business's new leads on WhatsApp, asks the business's qualifying questions and books a meeting in its calendar.

This policy explains what personal data we process, why, who helps us process it, how long we keep it and what rights you have. Questions: hello@paletix.ai.

2. Our role

• For our business customers' leads and contacts (the people a business talks to through a Paletix worker), the business is the controller and Paletix is its processor. We process that data only on the business's instructions, under a data processing agreement.
• For our own website, our business customers' account users and our own sales contacts, Paletix is the controller.

3. What we collect

• Business details: business name, country, time zone, contact person, work email and phone, billing details, and the settings and content the business gives its worker (services, qualifying questions, approved answers).
• Account users: name, email, role and an audit log of actions taken in the Paletix console.
• Calendar data, when a business connects its Google Calendar: the email address of the connected Google account, the list of its calendars, busy and free times on the calendars the business chooses, and the meetings Paletix itself created. See section 10.
• Lead and contact details: name, phone number, the answers a lead gave on the business's form, the content of WhatsApp messages exchanged with the worker, message metadata (time, delivery and read status), booking details (time, meeting type, and the address for a meeting at the lead's place) and opt-out status.
• Website visitors: details you submit in our forms (name, phone, email, business type) and basic technical data (IP address, browser, pages visited) used to run and secure the site.

We do not ask for and do not want sensitive data such as health information. Workers are set up not to ask medical questions and to hand such topics to a person at the business.

4. Why we use it

• To provide the service: answer leads, qualify them, offer times and book meetings on behalf of the business.
• To hand a conversation to a person at the business when needed, and to show the business its conversations, drafts and results.
• To keep the service safe and reliable: logging, abuse prevention, debugging and quality checks.
• To bill customers and meet legal obligations.
• To answer people who contact us and to tell business contacts about our service. You can opt out at any time.

Legal bases (where GDPR applies): performance of a contract, our legitimate interests in running and securing the service, compliance with legal obligations, and consent where it is required. For lead data, the business is responsible for having a lawful basis and, where required, the lead's consent to be contacted on WhatsApp.

We do not sell personal data, do not use it for advertising, and do not use customer conversations to train AI models.

5. Who processes it with us

We use a small number of service providers (sub-processors), each bound by contract to protect the data:

• Meta Platforms (WhatsApp Business Platform): sending and receiving WhatsApp messages.
• Language model provider (currently Anthropic): understanding incoming messages and drafting replies. Data sent to the model provider is not used to train its models.
• Hosting and database (currently Vercel and Supabase): running the application and storing data.
• Background job scheduling (currently Inngest): timing follow-ups and reminders.
• Google (Google Calendar), connected by the business: checking free times and creating, moving and cancelling the meetings Paletix books. See section 10.
• Email and workflow tools: sign-in emails, notifications and internal automation.

We may also disclose data when the law requires it, or as part of a merger or acquisition under the same protections.

6. International transfers

We store data in the European Union where possible. Some providers process data in other countries, including the United States. Where data leaves the EEA or Israel, we rely on adequacy decisions or standard contractual clauses.

7. How long we keep it

• Lead and conversation data: for as long as the business uses Paletix, or a shorter period the business sets. When a business ends its service, we delete its lead and conversation data within 90 days, unless the business asks us to return it first.
• Account and billing data: for the life of the account, and afterwards as long as tax and accounting law requires.
• Website form submissions: up to 24 months after our last contact.
• Security logs: up to 12 months.

When a person asks to stop receiving messages (for example by replying "stop"), we keep only their phone number and the opt-out date, so we never message them again.

8. Security

Data is encrypted in transit and at rest. Each business's data is isolated at the database level, access is limited by role, and actions in the console are logged. Access tokens for WhatsApp and Google Calendar are stored encrypted, and API keys are stored only as hashes.

9. Data from WhatsApp and other Meta platforms

When a business connects its WhatsApp Business account to Paletix, we receive messages and related data through the WhatsApp Business Platform. We use this data only to provide the service to that business: to reply, qualify, book and hand off to a person. We do not use it for advertising, do not sell or share it with data brokers, do not combine it with data from other businesses, and do not use it to train AI models. We follow Meta's Platform Terms and the WhatsApp Business Policy.

You can ask us to delete data we received about you through Meta platforms at any time. See Data deletion for how.

10. Data from Google Calendar

A business can connect its Google Calendar so that PAL books meetings into it. The owner signs in with Google and approves the access on Google's own screen. Paletix asks only for what booking needs:

• Free and busy times on the calendars the business chooses, so PAL offers only times that are really free. Paletix sees that a time is busy, not what the event is.
• The list of the business's calendars, so the owner can choose where meetings go and which calendars block time.
• Creating, moving and cancelling events on calendars the business owns. Paletix writes only the meetings PAL booked (the lead's name and phone, the meeting type and place, and a link to the conversation), and reads back only those events, to learn when the business moved or cancelled one.
• The email address of the Google account, to show which account is connected.

Paletix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google Calendar data only to provide and improve the booking feature the business set up, and only for that business.
• We do not transfer it to others, except as needed to provide that feature (our hosting and database providers in section 5), to comply with the law, or as part of a merger or acquisition with the same protections.
• We do not use it for advertising, do not sell it, and do not use it to train AI models, including generalized models.
• People at Paletix do not read it, unless the business asks us to for support, it is needed for security or to investigate abuse, or the law requires it.

Google tokens are stored encrypted. The business can disconnect its calendar at any time in the Paletix console or in its Google Account under third-party connections. When it does, we revoke our access and delete the stored tokens; meetings already booked stay in the business's calendar, because they are the business's.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• have your data deleted;
• restrict or object to processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• complain to a supervisory authority.

GDPR (EU/EEA and UK): you can complain to the data protection authority in your country.

Israel: under the Protection of Privacy Law, 5741-1981, and its regulations, you have the right to review the information held about you and to ask for it to be corrected or deleted. You can complain to the Privacy Protection Authority.

To use any of these rights, email hello@paletix.ai. If your data came to us through a business that uses Paletix, we will pass your request to that business or handle it on its behalf. We answer within 30 days.

12. Children

Paletix is a service for businesses and is not directed at children under 16. We do not knowingly collect their data.

13. Changes

We will post any changes on this page and update the date above. If a change is significant, we will tell our business customers in advance.

14. Contact

Paletix Technologies Ltd., 29 HaMaccabim St., Sderot, Israel. Email: hello@paletix.ai.