Privacy Policy

1. Who is responsible for your information

There are two different roles, and it matters which one applies to you:

• Website visitors and our business customers (the people who sign up, contact us, or use the admin panel): iChatPilot is the controller of the information described in this policy.
• Our business customers’ own customers (people who message a business through WhatsApp, the chat widget or email, and are answered through iChatPilot): the business is the controller of that conversation data and iChatPilot processes it on the business’s behalf and on its instructions. If you are one of those customers, the business’s own privacy notice also applies, and you should direct requests about your conversation to that business.

2. Information we collect

• Details you give us on the website: name, phone number, email address, business name, field of business, website address and your site language, when you sign up or use the contact form.
• Account details: for business admins and operators, a name, email address, role and a securely stored (hashed) password or the identity returned by Google sign-in.
• Conversation data processed for our business customers: the messages, voice notes, files and contact details (such as a name, phone number or email address) that end customers send through WhatsApp, the chat widget or email, together with the AI Agent’s replies and any operator replies.
• Business content our customers give us: knowledge-base text, product catalogs, opening hours and settings.
• Connected-account data: when a business connects Google Calendar, Gmail, Outlook, Shopify or WooCommerce, we receive the access needed to provide the feature (for example, calendar availability and events, the emails of the connected mailbox, or product and order data) and store the authorization tokens on our servers, accessible only to the service.
• Usage and technical data: IP address, browser type, device and log information, and the amount of AI usage per business (used to show each business its own AI costs).

3. How we use information

We do not sell personal information. We do not use conversation data of one business to answer another business’s customers, and we do not use it to train AI models of our own.

• To provide, operate and secure the service, including generating AI replies, routing conversations to a human operator, booking appointments and sending reminders.
• To respond to sign-ups and contact requests and to onboard new customers.
• To transcribe voice messages so they can be answered.
• To measure usage, bill plans and enforce plan limits, and to show businesses their AI costs.
• To maintain, debug and improve the service, and to prevent fraud, spam and abuse.
• To comply with law and to establish or defend legal claims.

4. AI processing

Replies are generated by an AI Agent that is powered by a third-party language model provider (currently OpenAI). To produce a reply, the relevant message, the conversation context and the business’s knowledge are sent to the provider over an encrypted connection. Under the provider’s API terms, content sent through the API is not used to train its models by default. AI replies can be wrong; businesses can review conversations and take over at any time.

Voice messages are sent to AssemblyAI for transcription.

5. Who we share information with

We share information only with service providers that help us run the platform, under contracts that require them to protect it, and where law requires:

• Cloud hosting and infrastructure: Google Cloud (our servers run in the United States).
• AI and speech: OpenAI and AssemblyAI.
• Messaging: Green API (WhatsApp connectivity) and Meta’s WhatsApp network, when a business connects WhatsApp.
• Email: SendGrid, and the Google or Microsoft mail services of a mailbox that a business connects.
• Integrations a business enables: Google Calendar, Shopify and WooCommerce, and a web-page fetching provider (ZenRows) used to read a business’s own website for its knowledge base.
• Professional advisers, courts, authorities, or a buyer of the business, when required by law or in a corporate transaction, subject to confidentiality.

6. Google user data

When a business connects its Google account (Calendar or Gmail), iChatPilot’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features the business enabled (for example, reading and replying to the business’s customer emails, and checking and booking calendar slots). We do not use it for advertising, we do not sell it, and no human reads it except where needed for security, to comply with law, or with the business’s explicit consent. A business can disconnect its account at any time from the admin panel, and can also revoke access from its Google account settings.

7. International transfers

We are based in Israel, and our providers process information in other countries, including the United States. Where personal information leaves Israel, we rely on the transfer rules under Israeli privacy law and its regulations and on contractual protections with our providers. Israel is recognized by the European Union as providing an adequate level of data protection.

8. How long we keep information

We keep website sign-up and contact details for as long as needed to follow up and to run the customer relationship, and then delete them on request. Conversation data is kept for the business’s use and is deleted automatically after 180 days by default, unless the business configures otherwise. Account and billing records are kept as long as the account is active and for the period required by tax and other laws.

9. Security

We use encryption in transit, per-business access separation, role-based access control, hashed passwords, restricted server-side storage of integration tokens and monitoring. No system is perfectly secure; if we become aware of a security incident that affects your information, we will act as required by law, including notifying the Israeli Privacy Protection Authority and affected parties where required.

10. Your rights

Under the Israeli Protection of Privacy Law, 5741-1981, you may ask to see the personal information we hold about you, to correct it if it is inaccurate, and to have it deleted where the law allows. If you are in the European Economic Area or the United Kingdom, you may have additional rights, such as objecting to or restricting processing and data portability. To use a right, write to us at the email below. We may need to verify your identity first. If your information is in a conversation with one of our business customers, we will refer you to that business or help it respond.

You can also complain to the Israeli Privacy Protection Authority or to your local supervisory authority.

11. Cookies and local storage

Our website does not use advertising or analytics cookies. It stores your language choice in your browser’s local storage so the site opens in the language you picked. The chat widget on our site, and on our customers’ sites, may use browser storage to keep a visitor’s chat session. You can clear this storage in your browser at any time.

12. Children

The service is intended for businesses and is not directed at children under 16. We do not knowingly collect their information; if you believe we have, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version. If a change is significant, we will give notice on the website or by email.

14. Contact us

iChatPilot, Yokneam Illit, Israel. Email: hello@ichatpilot.com