Privacy Policy

Last Updated: October 24, 2026

1. General

WhaleBiz ("WhaleBiz", "we", "us", or "our") takes your privacy seriously. We gather certain types of information about our users and we want to help you understand the terms related to the collection and use of the information we collect. This Privacy Policy discloses the types of information we gather, how we use it, and what choices you have regarding the collection of such information.

1.1 Scope of This Policy

This Privacy Policy applies to all products, services, websites, platforms, and applications owned, operated, or provided by WhaleBiz and its subsidiaries, affiliated companies, and related entities, including but not limited to:

• Websites: whale.co.il and any other websites owned or operated by WhaleBiz for itself. Websites and landing pages of our customers that we host for them are governed by the customer's privacy policy (Section 5.11)
• WhaleBiz Platform: Our cross-platform application at whalebiz.co.il (web, iOS, and Android) for business owners to manage their AI agents, access dashboards, communicate with AI assistants, and control their services
• AI Assistants and Chatbots: Text-based and voice-based AI chatbots deployed on our websites, within messaging platforms, or embedded on third-party websites
• Messaging Services: AI-powered communications via WhatsApp, Telegram, Facebook Messenger, Instagram, and other messaging platforms
• Audio Messages: Processing of voice messages (audio recordings) sent by users through messaging platforms such as WhatsApp or Telegram
• Customer Portals: Business dashboards, management interfaces, and client service areas
• Marketing Services: Preparing content and publishing it on the accounts of our business customers, running campaigns, performance reports, and hosting websites and landing pages for customers (Section 5.11)
• All Future Products: Any new services, products, or applications launched by WhaleBiz or its subsidiaries

References to "Services" throughout this Policy include all of the above.

BY USING OR ACCESSING ANY WHALEBIZ WEBSITE, PLATFORM, APPLICATION (INCLUDING WHALEBIZ), CHATBOT, MESSAGING SERVICE, OR ANY OF OUR SERVICES, YOU AGREE TO THE COLLECTION AND USE OF YOUR PERSONAL INFORMATION AS DESCRIBED IN THIS POLICY. On WhaleBiz's own channels (Section 1.2a), contacting us via WhatsApp, Telegram, or any messaging platform, as well as continued use of our Services, constitutes your consent to this Privacy Policy. On the channels of our business customers, the privacy policy of that business applies (Section 1.2b).

1.2 Consent Through Continued Use

Which consent mechanism applies, and which link appears in the agent's opening message, depends on who owns the database in the channel you are talking to. There are two distinct situations and they must not be conflated.

a. WhaleBiz channels - we are the database owner

On our own channels - the widget on whale.co.il and the official WhaleBiz WhatsApp and Telegram accounts - WhaleBiz is the owner of the database. When you initiate or continue a conversation with one of our AI-powered services, your continued interaction constitutes your acknowledgment and acceptance of this Privacy Policy. Such a conversation may begin with a notice stating:

"Please note: This chat is powered by artificial intelligence to help you quickly and efficiently. Continuing the conversation constitutes consent to use the chatbot in accordance with the Terms of Use and Privacy Policy: whale.co.il/privacy-policy"

b. An agent deployed for one of our customers - the customer is the database owner

When an AI agent runs for a business that is our customer, on that business's own channels (its WhatsApp number, its website, its page), that business is the owner of the database and WhaleBiz acts solely as a data processor on its behalf and on its documented instructions (see sections 7 and 24 below). In that situation:

• the agent's opening message links to that business's privacy policy, not to this Privacy Policy;
• the WhaleBiz Terms of Use do not apply to the end user and are not referenced in the message - the end user has no contractual relationship with us;
• requests to access, correct, delete data or unsubscribe are directed to that business as the database owner, not to us.

Sample opening message for a customer's channel:

"Please note: the first response in this channel is provided by an AI agent operating on behalf of {business name}. You can ask for a human representative at any point. Continuing the conversation constitutes consent to the privacy policy of {business name}: {link to the business's privacy policy}"

For our customers: a complete, ready-to-paste section for your own privacy policy, including the statement about processing via WhaleBiz, is available on the WhatsApp channel and AI agent notice page.

This mechanism applies to all AI agents, bots, and automated systems regardless of the platform on which they operate - with the link in the opening message determined by who owns the database in that channel.

1.3 Governing Law

WhaleBiz is the trade name of Whale Biz Ltd (Company No. 517351466), an Israeli company. All data processing is governed by Israeli privacy law, including the Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות, התשמ"א-1981) and applicable regulations, including Amendment 13 (תיקון 13 לחוק הגנת הפרטיות), which came into effect on August 14, 2025.

We may amend this Policy from time to time. A notification of any such amendment shall be posted on this page. Your continued use of our Services after any changes constitutes your acceptance of the updated Privacy Policy.

2. Information We Collect

We collect the following types of information:

2.1 Information You Provide Directly

• Contact Information: Name, email address, phone number, company name, and any other information you provide when filling out contact forms, subscribing to our newsletter, or requesting our services.
• Communication Content: Messages, inquiries, and any content you send to us through our website forms, email, WhatsApp, Telegram, or any other communication channel.
• Chat Transcripts: Complete records of conversations with our AI chatbots and agents, including all messages, questions, and responses.
• Audio Messages: Processing of voice messages (audio recordings) sent by users through messaging platforms such as WhatsApp or Telegram. These recordings are transcribed for the purpose of understanding and responding to the user's request, and are not used to create voice profiles or biometric identifiers.
• Account Information: If you create an account (including on WhaleBiz), we collect login credentials, profile information, and account activity.
• Media and Files: Any images, documents, audio, or video files you share through our Services.

2.2 Information Collected Automatically

• Device Information: IP address, browser type and version, operating system, device type, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, time spent on pages, click patterns, navigation paths, referring URLs, and exit pages.
• Location Data: Approximate geographic location based on IP address.
• Cookies and Similar Technologies: Information collected through cookies, web beacons, pixels, and similar tracking technologies (see Section 8 for details).

2.3 Information from Third Parties

• Social Media Platforms: If you interact with us through WhatsApp, Telegram, Facebook Messenger, or Instagram, we receive information from these platforms including your profile information and message content.
• Analytics Providers: We receive aggregated and individual analytics data from services like Google Analytics.
• Marketing Partners: We may receive information about you from our marketing and advertising partners.

3. Use of Artificial Intelligence (AI) in Communications

Important Notice: Our Services extensively utilize artificial intelligence technologies. When you interact with our chatbots on our website (both text and voice modes), via WhatsApp, Telegram, or any other messaging platform, please be aware that:

• Responses are generated using language models from leading AI providers and, where needed, also using models developed or operated by WhaleBiz (see Section 16).
• Your messages and inputs are processed by these models to generate responses.
• The model providers process the content in order to produce the response and are not permitted to use it to train their models (see Section 5.4).
• AI-generated content is not guaranteed to be accurate, complete, or suitable for your specific situation and should not be considered legal, medical, financial, or professional advice.

By continuing to communicate with our AI-powered services, you acknowledge and consent to this processing. You are not required to provide personal data to receive general information or answers.

4. Messaging Services (WhatsApp, Telegram, and Other Platforms)

WhaleBiz operates AI-powered chatbots and customer service solutions on various messaging platforms including WhatsApp, Telegram, Facebook Messenger, and Instagram. When you contact us through these channels:

• Message Collection: We collect and store all messages exchanged between you and our bots or representatives.
• Profile Information: We may access your public profile information as provided by the messaging platform (name, profile photo, phone number for WhatsApp, username for Telegram).
• Phone Numbers: For WhatsApp communications, we collect and store your phone number.
• Conversation History: Complete chat history is stored in our systems and is used to provide the service, to improve it, and for analytics, subject to Sections 5.4 and 9.
• Media Files: Any images, documents, or other files you share through these platforms are collected and stored.

CONSENT BY CONTINUED USE: By initiating or continuing a conversation with WhaleBiz's own channels on WhatsApp, Telegram, or any messaging platform, you consent to the collection, storage, and processing of your communications as described in this Privacy Policy. If you do not agree to these terms, please discontinue the conversation.

4.1 Compliance with Meta Requirements as a Tech Provider

WhaleBiz operates as a Meta Verified Tech Provider and connects to the WhatsApp Business Platform, Facebook Messenger, and Instagram through the official APIs only, subject to Meta's terms and policies:

• Explicit Opt-In: In accordance with Meta's messaging requirements, businesses using our platform are required to obtain explicit user consent before sending business-initiated messages via WhatsApp and other Meta platforms.
• Meta Terms: Our use of Meta platforms is subject to Meta's business terms and data processing terms. Each customer's WhatsApp Business account sits in the customer's own Meta account.
• Message Template Compliance: All message templates undergo Meta's review process and comply with Meta's messaging policies for Marketing, Utility, and Authentication categories.
• Encryption in Transit: Messages sent via WhatsApp Business API are encrypted in transit, and the business account is protected. This is not end-to-end encryption, because the system must read each message to reply to it and to record it. Message metadata (phone numbers, timestamps, IP addresses) may also be processed by Meta for service improvement and security purposes.
• Data Retention: The retention and deletion periods for our business customers' data are set out in Section 9.

For more information about Meta's data practices, please refer to WhatsApp's Privacy Policy and Meta's Privacy Policy.

4.2 WhatsApp Account Connection (Meta Embedded Signup)

Our platform allows you to connect your WhatsApp Business account using Meta's Embedded Signup interface.

• Information Collected: During the Embedded Signup process, we receive unique identifiers from Meta, including your WhatsApp Business Account ID (WABA ID), Phone Number ID, business name, and WhatsApp business profile details.
• Message Content: We process and store message content (text, files, voice recordings, and conversation metadata) sent and received through your connected WhatsApp number, in order to display them in the CRM system and power the AI agents.
• Data Transfer: Account details and conversation content are transmitted to Meta's servers to send messages, and are not shared with any other third party except our sub-processors (Section 6.1), who are subject to data protection and confidentiality obligations.

5. How We Use Your Information

We use the information we collect for the following purposes:

5.1 Service Provision

• To provide, operate, and maintain our Services
• To respond to your inquiries and provide customer support
• To process and fulfill your requests for our products and services
• To send you service-related communications
• To manage your account on WhaleBiz and other platforms

5.2 Marketing and Communications

• To send newsletters, promotional materials, and marketing communications (with your consent)
• To personalize content and advertisements
• To conduct targeted advertising campaigns and retargeting
• To send follow-up communications after you've contacted us
• To segment audiences and create lookalike audiences for advertising
• To re-engage users through email, SMS, WhatsApp, or other channels

The uses in Section 5.2 apply only to visitors to our websites, to our business customers, and to people who contact WhaleBiz itself, and never to the end users of our business customers.

5.3 Analytics and Improvement

• To analyze usage patterns and improve our website and Services
• To conduct research and development
• To measure the effectiveness of our marketing campaigns
• To monitor system performance and troubleshoot issues

5.4 Service Improvement and AI Models

• 5.4.1 No training on identifiable data: We do not train artificial intelligence models on the content of conversations, voice messages, files, or knowledge base content of our business customers and their end users in identifiable form.
• 5.4.2 Model providers: The model providers we work with (Section 16) are bound by their commercial terms not to use the content we send them to train their models.
• 5.4.3 Aggregated and de-identified data: The business customer authorizes WhaleBiz, as part of the processing operations permitted to it, to derive from the data aggregated data and data that has been de-identified, so that neither the customer, its end users, nor any other person can be identified from it with reasonable effort, and to use such data to operate, secure, and improve the service, including to develop and improve WhaleBiz's own models and systems. Such data is not personal data and is owned by WhaleBiz.
• 5.4.4 Sensitive data: Information of special sensitivity as defined by law, including information about a person's state of health, will not be used to develop models, even after de-identification, except with the customer's explicit and separate consent.
• 5.4.5 Request not to use: A customer may notify us in writing, at any time, that its data is not to be used to develop models under Section 5.4.3. The notice takes effect within 30 days and does not apply to aggregated data required to operate the service and for billing.
• 5.4.6 Improving the customer's agent: The WhaleBiz team may review the conversations of a customer's agent in order to configure it, improve its answers, and fix faults, as part of providing the service to that customer.

5.5 Data Integration and Synchronization

• CRM Systems: Your information may be synced with customer relationship management (CRM) systems for unified customer profiles
• Cross-Platform Data: Data collected from different platforms (website, WhaleBiz app, messaging platforms) may be consolidated to provide you with a seamless experience
• Third-Party Integrations: Your data may be shared with integrated third-party services to enable connected workflows and automations
• Business Intelligence: Aggregated data may be used for business analytics, reporting, and strategic decision-making

5.6 Legal and Security

• To comply with legal obligations
• To protect against fraud and unauthorized access
• To enforce our terms and conditions
• To protect our rights, property, and safety, and those of our users

5.7 Legal Basis for Processing

We process your information based on the following legal grounds:

• Consent: Where you have given explicit consent for specific purposes (e.g., newsletter subscription, marketing communications).
• Contract Performance: Where processing is necessary to fulfill our contractual obligations to you.
• Database Owner's Authorization: On the channels of our business customers, processing is carried out under the authorization of the customer as the database owner (Section 24).
• Legitimate Interests: For purposes such as service improvement, security, fraud prevention, and marketing (where permitted by law).
• Legal Obligations: Where processing is required to comply with applicable laws.

5.8 Data Minimization and Privacy by Design

While we collect comprehensive data to provide you with the best possible service, we adhere to data minimization principles where appropriate:

• Purpose Limitation: We collect data for specific, explicit, and legitimate purposes and do not process it further in ways incompatible with those purposes.
• Avoidance of Unnecessary Sensitive Data: You are not required to provide sensitive personal information such as health data, credit card numbers, or government IDs through our chatbots unless specifically requested for a particular service.
• Pseudonymization: Where feasible, we may replace identifying information with pseudonymous identifiers for analytics purposes and to produce de-identified data under Section 5.4.
• Privacy by Design: We incorporate privacy considerations into the design and development of our Services from the outset.

5.9 Google Calendar Integration (Calendar Sync)

If you choose to connect your Google Calendar account to our services, we will collect and process the following information from your Google account:

• Information Collected: Free/busy times, event details (event name, time, participants, description), and the calendar owner's email address.
• Purpose of Processing: Displaying available timeslots to your clients and automatically booking or updating appointments via our AI agents according to your instructions.
• Google Limited Use Policy: Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The data is not used for advertising, ad targeting, is not sold to third parties, and is not shared except as necessary to provide the service.

5.10 Our Company Social Media Accounts and Platform APIs

We publish WhaleBiz's own content (posts, images, videos and stories) to WhaleBiz's own accounts on Facebook, Instagram, Threads, X, LinkedIn, YouTube and TikTok. We do this through the official APIs of these platforms (Meta, X, LinkedIn and YouTube API Services by Google) and, for some channels, through a third-party scheduling service.

• What our management system processes: our own content, the identifiers of our own accounts and posts to confirm that a post was published, and aggregated performance data of the accounts and posts (impressions, views, followers). A comment or review written on our accounts is shown in the system with the author's public name and its text, so that we can reply to it; we may prepare a draft reply with AI tools, and a team member reviews it before it is sent. We do not build profiles of people who view, like or comment on our posts, and we do not send them marketing messages.
• When you interact with our accounts: viewing, commenting on or messaging our accounts on a platform is governed by that platform's own terms and privacy policy (Meta, X, LinkedIn, TikTok, Google). If you write to us through such an account, we handle your message as described in sections 2 and 4.
• YouTube API Services: our publishing tool uses YouTube API Services to upload videos that WhaleBiz produces to WhaleBiz's own YouTube channel. Use of YouTube is subject to the YouTube Terms of Service and the Google Privacy Policy. Access granted to our tool can be revoked at any time in Google security settings.
• Google Limited Use: our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Deleting data received from these platforms: to ask us to delete any data about you that we received from Facebook, Instagram, Threads or another of these platforms, write to privacy@whale.co.il with the subject "Data deletion" and the name of the account or a link to the profile concerned. We confirm the request and delete the data within 30 days, as described in section 12.3.

5.11 Marketing Services for Business Customers

When a business customer orders marketing services from us (preparing and publishing content, running campaigns, performance reports and website hosting), we act as a data processor on its behalf, under Sections 7 and 24:

• Materials and content: The brand profile, instructions, files the customer uploaded to the media library (images, videos and documents) and the content prepared for it are stored on our cloud infrastructure in the European Union. The AI models (Section 16) receive the texts and file descriptions needed to prepare the content. All of this is subject to Section 5.4: we do not train models on the customer's materials, and images of patients and medical information are not used to develop models in any form.
• Google Drive folder: A customer may share a Google Drive folder with our service account, with read-only access. Images and videos from the folder are copied to the customer's media library and handled like any file uploaded to it. Sharing can be stopped at any time; files already copied stay in the library until the customer asks for them to be deleted (Section 9.1).
• Producing images and videos: This is done on our servers in the European Union. A software component we use for production reports technical data about each render to its maker, for licensing purposes (the license key, the server's IP address, the type of render and the environment). It does not receive the content itself or any information about the customer or its customers.
• Connected accounts: When the customer connects a social media account, an advertising account, a business profile or a website, the access authorization (token) is held by us or by the third-party publishing service we work with (Section 6.1). It is used only to publish the content the customer ordered, to run the campaigns it ordered and to read performance data. We do not ask for account passwords, and the customer may revoke the authorization at any time.
• Publishing: A file chosen for a scheduled post is stored at an address that cannot be guessed, so that the network or the publishing service can fetch it at publishing time. Once published, the content is public and governed by the network's terms.
• Performance data: We read aggregated data about the accounts, posts and ads (impressions, views, clicks, followers and ad spend) to show it to the customer and to plan the next content. We do not build profiles of individual followers or viewers.
• Websites and landing pages we host: The customer is the owner of the website and the owner of the database of enquiries that come through it, and visitors are governed by its privacy policy. The website measures visits and clicks on WhatsApp, phone and short links without cookies, without a visitor identifier and without storing IP addresses: only the page, the source of the visit (referring domain and UTM parameters) and the device type are kept. To attribute a click to the source of the visit, the source is kept only in the browser tab (session storage) and is erased when the tab is closed. An enquiry submitted through a form is forwarded to the customer's CRM account. Additional analytics and advertising tools are turned on only at the customer's request and subject to visitors' consent.
• Patients and people appearing in content: The customer is responsible for obtaining written consent to publication from every person appearing in the materials it provided, and for patients a separate consent to public publication (Section 11A of the Terms of Use). A person appearing in content who wishes to access information about them, withdraw consent or ask for the content to be removed contacts the customer as the database owner, and we assist the customer in handling the request.

6. Data Sharing and Disclosure

We do not sell your personal data to third parties.

However, we may share your information with:

6.1 Service Providers and Partners

We work with trusted sub-processors who assist us in delivering our Services, in the following categories:

• Cloud infrastructure and hosting: A leading cloud provider, on servers in the European Union
• AI models: Leading language model providers (see Section 16)
• Messaging channels: Meta (WhatsApp, Facebook Messenger, Instagram) and Telegram, according to the channels the customer has connected
• Network security and website hosting: A protection and acceleration service for the management interfaces, and hosting of the websites and landing pages we host for customers
• Content publishing: A third-party publishing service that connects the customer's social media and advertising accounts and publishes in them the content the customer ordered
• System email: Sending emails from the system and the newsletter
• At the customer's choice: Calendar sync, payment clearing, and integrations the customer has enabled
• Our website: Analytics and advertising tools (Section 8)

The list of sub-processors, the purpose of processing, and the country in which each of them processes the data is provided to business customers on request and attached to the service agreement. We may add and replace sub-processors in accordance with Section 24.4.

6.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders, subpoenas, or other legal processes
• Requests from government authorities
• To protect our legal rights or defend against legal claims
• To investigate potential violations of our terms

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, and it will remain subject to the commitments in this Policy. Data of our business customers will be transferred as part of continuing to provide the service to them, and subject to Section 24.

7. Information Collected from End Users of Our Customers

WhaleBiz provides AI chatbot and automation services to business customers. When you interact with a chatbot or service powered by WhaleBiz on a third-party website or messaging platform:

• We collect chat transcripts and interaction data on behalf of our business customers.
• This data may include personal information you provide during the conversation (name, email, phone number, inquiry content).
• Our business customers are considered the "Database Owner" (בעל מאגר מידע) under Israeli law.
• WhaleBiz acts as the Data Processor (מעבד מידע) on behalf of these customers.
• Ownership of this data, including conversation transcripts and contact details of end-users, remains with the business customer or the end-user (as applicable by law). WhaleBiz claims no ownership over this data and will process it strictly in accordance with the customer's instructions to provide the service and during the defined retention periods.
• For questions about how a specific business uses your data, please contact that business directly.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and collect information about how you use our Services.

8.1 Essential Cookies

These cookies are necessary for the operation of our Services and cannot be disabled:

• Session management and authentication
• Security and fraud prevention
• User preferences (language, settings)
• Chatbot conversation state

8.2 Analytics Cookies

We use analytics cookies to understand how visitors interact with our website. They are on by default and you can switch them off at any time (see Section 8.4):

• Google Analytics: Tracks page views, user behavior, traffic sources, and demographic information

8.3 Marketing Cookies

We use marketing cookies and similar technologies, on by default and switchable off at any time (see Section 8.4), for:

• Targeted advertising and retargeting
• Measuring advertising campaign effectiveness
• Social media integration
• Meta Pixel: Conversion tracking and audience building for Facebook and Instagram advertising campaigns
• Google Ads, including enhanced conversions: measuring enquiries that came from advertising. When you submit a form on the site, the email address and phone number you entered are hashed (SHA-256) in your browser and only then sent to Google to match the enquiry to an ad. Google does not receive them in plain text.
• TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag, X (Twitter) Pixel and Microsoft Advertising UET: conversion measurement and audience building for advertising on TikTok, LinkedIn, Pinterest, X and Microsoft (Bing). Each of them loads only with consent to marketing cookies, and only for a network on which we advertise. When you submit a form, TikTok and Pinterest may receive your email address and phone number hashed (SHA-256) in your browser, never in plain text. When you pay for a service, we may report the payment to TikTok from our server, with your email address and phone number hashed in the same way.

8.4 Managing Cookies

When you enter the site, a notice about our use of cookies is shown, with a link to this policy. Continuing to browse the site after the notice is shown constitutes consent to the analytics and marketing cookies described in Sections 8.2 and 8.3. In the notice itself, and at any time afterwards through the "Cookie settings" link at the bottom of every page, you can choose "Only necessary" or switch analytics and marketing off separately. Your choice takes effect immediately and is stored in your browser. For visitors from the European Economic Area, the United Kingdom and Switzerland, analytics and marketing cookies stay off until you explicitly accept them. You can also manage cookies through your browser settings. Blocking some cookies may affect the functionality of our Services.

9. Data Retention

• 9.1 During the engagement: Data of our business customers and their end users (conversations, enquiries, files, the media library and marketing content) is retained for as long as the customer's account is active. The customer may remove records and files from the interface itself; a removed record or file is deleted from storage at the customer's written request, or at the end of the engagement under Section 9.2. We do not undertake to delete a file from storage the moment it is removed from the interface.
• 9.2 At the end of the engagement: The customer may export its data for 30 days. At the end of that period, or earlier at its written request, we will delete the data from our active systems within 60 days. Backup copies are deleted in the regular backup cycle and no later than 90 days, and until then they are not used for any purpose. At the customer's request, we will confirm the deletion in writing.
• 9.3 Records required by law: Accounting records and invoices are retained for 7 years under tax law. Access and security logs are retained for up to 24 months.
• 9.4 WhaleBiz's own channels: Data collected on our own channels is retained for as long as it is needed for the purpose for which it was collected, and is reviewed once a year.
• 9.4A Connected accounts and published content: Access authorizations to the customer's accounts on networks and advertising platforms are revoked when the account is disconnected or at the end of the engagement. Content published in the customer's accounts remains there, and removing it from there is done by the customer.
• 9.5 Exceptions: We will retain data beyond the above only where a law, a court order, or legal proceedings require it, or to prevent misuse of the service.

Aggregated and de-identified data under Section 5.4.3 is not personal data and is not subject to these periods.

10. Data Security

WhaleBiz implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit (TLS) on all connections
• Encryption at rest of stored data
• Hosting with infrastructure providers that maintain independently verified security programs, including ISO 27001 and SOC 2
• Role-based access control with least privilege, and two-factor authentication
• Logging of actions
• Logical separation between the databases of different customers
• A confidentiality undertaking from every team member who has access to the data

We may update these measures from time to time, provided that the level of protection is not materially reduced.

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

11. International Data Transfers

• 11.1 The main servers of the service are located in the European Union.
• 11.2 Some processing is carried out by sub-processors outside Israel, including AI model providers in the United States, in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001, and subject to the contractual commitments of those providers. The country in which each provider processes the data is set out in the list of sub-processors (Section 6.1).
• 11.3 We do not undertake to store data in Israel or in any particular country, unless agreed in writing.

12. Your Rights Under Israeli and International Law

Under the Israeli Protection of Privacy Law (including Amendment 13) and in alignment with international best practices, you have the following rights regarding your personal information:

12.1 General Data Rights

• Right to Access (זכות עיון): You may request a copy of the personal information we hold about you, including chat transcripts and voice recordings.
• Right to Correction (זכות לתיקון): You may request correction of inaccurate or incomplete information.
• Right to Deletion (זכות למחיקה): In certain circumstances, you may request deletion of your personal information ("right to be forgotten"). This includes deletion of chat logs and account data.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format to transfer it to another service.
• Right to Object: You may object to processing of your personal information for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.

12.2 AI-Specific Rights

Channels of our business customers: If you talked to an agent operated for a business, requests to exercise the rights in this section are directed to that business as the database owner, and WhaleBiz assists it in handling them.

• Use of data to develop models: We do not train models on identifiable data (Section 5.4). A business customer may ask that its data not be used even after de-identification, by writing to privacy@whale.co.il.
• Right to Human Review: For significant decisions that may affect you, you have the right to request human review of any AI-generated decision or recommendation.
• Right to Explanation: You may request an explanation of how our AI systems process your data and make decisions.
• Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you.

12.3 How to Exercise Your Rights

To exercise any of your rights, please contact us at: privacy@whale.co.il

Your request should include:

• Your full name and contact information
• A description of the specific right you wish to exercise
• Any relevant details to help us locate your information (e.g., phone number used for WhatsApp, email associated with your account)

We will respond to your request within 30 days, as required by Israeli law.

13. Newsletter and Marketing Communications

When you subscribe to our newsletter or opt-in to marketing communications:

• Your email address is stored in our email service provider (Resend)
• We may send you promotional content, industry news, and updates about our Services
• Each email includes an unsubscribe link
• You can manage your preferences or unsubscribe at any time

Newsletter subscription and contact form submission require explicit acceptance of this Privacy Policy through a checkbox mechanism.

14. Age Requirement

You must be 18 years or older, or at least the age of majority in your jurisdiction, to use the channels and services of WhaleBiz itself. On the channels of our business customers, the rules of that business apply. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have collected personal information from a minor, we will take steps to delete such information.

15. Third-Party Links and Services

Our Services may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our Services.

16. AI Services Integration - Third-Party Platforms

We use language models from several providers, including Google and Anthropic, and may also use models developed or operated by WhaleBiz. WhaleBiz may choose the models, switch between them, add providers, and run an alternative model when a model is unavailable, at its discretion, subject to Section 5.4 and to the notice mechanism in Section 24.4.

The models are also used to prepare texts, images and voice-overs for the marketing services (Section 5.11). Images generated by some of the models carry an invisible digital watermark indicating that they were created with AI.

The model providers process the conversation content in order to produce the response and retain it for a limited period only, under their commercial terms. The current list is set out in the list of sub-processors (Section 6.1).

17. Third-Party Service Providers

The full and current list of sub-processors, the purpose of processing, and the country in which each of them processes the data is provided to business customers on request and attached to the service agreement. The website's analytics and advertising tools are set out in Section 8. Questions: privacy@whale.co.il.

18. Israeli Law Compliance (Amendment 13)

Whale Biz Ltd (Company No. 517351466), trading as WhaleBiz, is an Israeli company subject to Israeli privacy laws, including:

• The Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות, התשמ"א-1981)
• Amendment 13 to the Protection of Privacy Law (תיקון 13), effective August 14, 2025
• The Protection of Privacy Regulations (Data Security), 5777-2017

18.1 Amendment 13 Key Provisions

Amendment 13 represents the most significant reform to Israel's privacy regime in 40 years. Key provisions affecting you include:

• Expanded Definition of Sensitive Data: The law now covers biometrics, genetic data, location data, financial details, and personality assessments.
• Enhanced User Rights: Strengthened rights to access, correct, and delete personal information.
• Breach Notification: Organizations must notify the Privacy Protection Authority (PPA) and affected individuals in case of data breaches.
• Administrative Enforcement: The PPA has expanded powers to issue orders and levy fines of up to NIS 3.2 million.

18.2 Security Level and Database Registration

Security level of the customer's database: The security level that applies to a customer's database is determined under the Protection of Privacy Regulations (Data Security), 5777-2017, according to the type of data and the number of persons authorized on the customer's behalf. A database that includes medical information will usually be at the medium security level, unless it has up to ten authorized persons on the customer's behalf. The customer will inform us of its database's security level before go-live, and WhaleBiz will comply with the obligations that apply to a holder (מחזיק) under Regulation 19.

Amendment 13 reduced the database registration requirements. Responsibility for determining whether a customer's database requires registration or notification to the Authority rests with the customer as the database owner (Section 24.2).

18.3 Your Rights Under Israeli Law

Israeli residents have specific privacy rights including the right to be informed, right of access, right to correction, and enhanced rights regarding automated decision-making. See Section 12 for complete details on exercising your rights.

19. International Use

Our Services are primarily designed for users in Israel. We do not specifically design our platform to meet the data protection requirements of any jurisdiction outside of Israel. WhaleBiz does not guarantee compliance with region-specific privacy laws including, but not limited to:

• GDPR (European Union)
• CCPA (California, USA)
• LGPD (Brazil)
• Other national or regional data protection laws

If you or your organization are subject to such laws, it is your responsibility to determine whether our Services are suitable for your legal and compliance requirements.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this page
• We will send business customers notice of a material change at least 30 days in advance, by email or in the interface. A customer who does not agree may terminate the engagement before the change takes effect
• A change that is not material, or that is required by law, takes effect upon publication
• Your continued use of our Services after the change takes effect constitutes your acceptance of the updated Privacy Policy

21. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@whale.co.il
• Phone: +972-3-303-4757
• Address: Anne Frank St 3, Bat Yam, Israel
• Website: https://whale.co.il

We will respond to your inquiry as soon as reasonably possible, and in any event within the timeframes required by applicable law.

22. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the State of Israel, without regard to its conflict of law provisions. Any disputes arising from or relating to this Privacy Policy or our data practices shall be subject to the exclusive jurisdiction of the competent courts in Tel Aviv, Israel.

23. WhaleBiz Platform - Specific Terms

The WhaleBiz platform is a cross-platform application (available on web, iOS, and Android) designed for business owners who have deployed AI agents through WhaleBiz. The following additional terms apply to WhaleBiz users:

23.1 Account Data

• Authentication: We collect login credentials, authentication tokens, and session data
• Business Information: Company details, business profiles, and configuration settings
• User Activity: All actions taken within the platform, including settings changes, AI agent configurations, and dashboard interactions

23.2 AI Agent Management Data

• Agent Configurations: Settings, prompts, knowledge bases, and customizations you create for your AI agents
• Configuration Materials: Any information you upload or provide to configure and customize your AI agents
• Files to send to customers: Files the customer adds to the agent's media library so that the agent can send them to its customers are stored at an address that anyone holding the link can open, so that the messaging platform can fetch them. On some channels the agent may show the link itself. Only files meant to be sent to customers should therefore be added to this library.
• Conversation Logs: Transcripts of conversations between your AI agents and your customers
• Analytics: Performance metrics, usage statistics, and engagement data for your AI agents

23.3 Cross-Platform Synchronization

Data collected through the WhaleBiz platform is synchronized across all devices and platforms where you access your account. This includes:

• Settings and preferences
• Conversation histories
• AI agent configurations
• Analytics and reports

24. Data Processing Addendum (DPA)

This section constitutes the Data Processing Addendum ("DPA") and is incorporated by reference into any agreement between WhaleBiz and its customers. It governs the processing of Personal Data in connection with your use of WhaleBiz's Services.

24.1 Definitions

For the purposes of this DPA and in accordance with Israeli law:

• Personal Data (מידע אישי): Any data relating to an identified or identifiable individual.
• Database Owner (בעל מאגר מידע): The customer who controls the purpose and means of processing.
• Data Holder / Processor (מעבד מידע): WhaleBiz, acting on behalf of the Customer in providing the Services.
• Data Subject: Any natural person whose Personal Data is collected or processed via the Services.

24.2 Roles and Responsibilities

Customer as Database Owner

If you are a business customer using our Services, you are considered the Database Owner under Israeli law. You are solely responsible for:

• Determining whether your database requires registration with the Registrar of Databases
• Providing end users with all required privacy notices and disclosures at the point of data collection
• Obtaining all required consents under applicable law
• Selecting appropriate data security options in the Service
• Ensuring that your use of the Services complies with applicable data protection laws

WhaleBiz as Data Processor

WhaleBiz processes Personal Data solely for the purpose of providing the Services in accordance with this Policy and the Customer's documented instructions. The settings the Customer configures in the platform, and the actions permitted under Section 5.4, form part of those instructions. WhaleBiz will:

• Process Personal Data only as necessary to provide the Services
• Implement and maintain appropriate technical and organizational security measures
• Assist the Customer with responding to data subject rights requests when feasible
• Ensure that every team member with access to the data is bound by confidentiality and uses the data only in accordance with this addendum
• Keep each customer's data separate from the data of other customers

Purposes, Operations and Systems

WhaleBiz processes the data only to provide the service according to the Customer's settings. The processing operations are storage, processing by AI models in order to respond, transmission over the channels the Customer has connected, producing summaries and reports for the Customer, and operations under Section 5.4.3. Where the Customer ordered Marketing Services, the processing operations also include preparing content, producing images and videos, publishing in the accounts the Customer connected, reading performance data, and hosting the website and receiving enquiries from it (Section 5.11). The systems that have access to the data are the platform, the connected channels, and the sub-processors referred to in Section 24.4.

24.3 Security Level

Security Level: The security level that applies to the Customer's database is determined under Section 18.2. WhaleBiz implements the security measures in Section 10 and complies with the obligations that apply to a holder under the Protection of Privacy Regulations (Data Security), 5777-2017.

24.4 Sub-processors and International Transfers

The Customer grants WhaleBiz a general written authorization to engage sub-processors, including cloud providers, AI model providers, messaging platforms and content publishing services, in order to provide the service. The list of sub-processors is provided to the Customer on request and attached to the service agreement. We will give notice of a new sub-processor at least 14 days in advance, by email or in the interface. The Customer may object within that period on data protection grounds and, if no reasonable solution is found, may terminate the engagement without penalty. In an emergency, such as the failure of an existing provider, we will replace the provider and give notice as soon as possible. Every sub-processor is subject to data protection obligations no less protective than those in this addendum, and providers outside Israel are also subject to the undertakings required under the regulations on the transfer of data abroad (Section 11).

24.5 Data Retention and Deletion

Retention and deletion of the data during the engagement and at its end are carried out in accordance with Section 9. At the Customer's written request, instead of deletion, we will transfer the data to the Customer, de-identify it, or retain it for the period required by law.

24.5A Security Incident

We will notify the Customer without undue delay after becoming aware of a security incident that has affected the Customer's data, and will provide further information as it becomes known. We will provide the Customer with the information it needs to report to the Privacy Protection Authority and to handle the incident. The notice is not an admission of liability.

24.5B Annual Report

At the Customer's request, once a year, we will provide it with a written report on how we comply with this addendum.

24.6 Liability and Indemnification

Customer agrees to indemnify WhaleBiz against any claim or penalty resulting from the Customer's failure to comply with Israeli data protection requirements or from their failure to notify WhaleBiz of the need for medium or high security classification.

25. Disclaimer and Limitation of Liability

While we take reasonable measures to protect your data, you acknowledge that:

• No method of transmission over the Internet or electronic storage is 100% secure
• AI-generated content may not always be accurate, complete, or suitable for your needs
• Third-party services have their own privacy practices beyond our control
• We are not responsible for the actions of our business customers who use our Services to interact with their end users

To the maximum extent permitted by law, WhaleBiz disclaims all liability for any unauthorized access to, or use of, your information arising from circumstances beyond our reasonable control.

© 2026 WhaleBiz. All rights reserved. | עברית | Русский