1. Who We Are and Who This Policy Covers

1.1. Hey Zoe ("Hey Zoe", "we") operates heyzoe.io, a platform that lets businesses communicate with their customers on WhatsApp through an AI assistant called "Zoe".

1.2. This policy covers:

• End Users - people who communicate with a business that uses the Service.
• Business Customers - businesses subscribed to the Service and their staff who use the dashboard.
• Visitors to heyzoe.io and people who communicate with Hey Zoe itself.

1.3. Roles. For End User data, the business the End User communicates with is the database owner and decides how the data is used. Hey Zoe processes that data on the business's behalf, according to its instructions and our Terms of Service. Requests about such data may be sent to the business or to us, and we will help the business handle them. For Business Customer and Visitor data, Hey Zoe is the database owner.

1.4. Privacy contact: office@heyzoe.io

2. What Data We Collect

2.1. End Users:

• Phone number, provided automatically through WhatsApp.
• Name, if shared in the conversation or in the WhatsApp profile.
• Conversation content and message times.
• The business contacted and the source of the inquiry, such as an ad campaign.
• Data received from the business's CRM or booking system, if the business connected one - such as leads, membership status and class bookings.

2.2. Business Customers: name, email, phone and business details; content entered in the dashboard; and Service usage data. Payments are processed through iCount, and we do not store credit card details.

2.3. Visitors: basic browsing data and the source of the visit (for example campaign UTM parameters).

2.4. Sensitive data. We do not request sensitive data, such as health information. However, End Users may choose to share such information in a conversation - for example about an injury or pregnancy - and it is stored as part of the conversation.

3. How We Use Data

• To enable businesses to communicate with their customers, including Zoe's automated responses.
• To perform actions the business enabled, such as creating leads and tasks, booking classes and sending automated messages.
• To provide support, fix errors and keep the Service secure.
• To improve response quality and the Service, including review of conversations by authorized staff.
• To bill and manage Business Customer subscriptions.
• To comply with legal obligations.

We do not use End User conversations for Hey Zoe's own marketing, and we do not sell personal data.

4. Legal Basis

• Providing the Service - to respond to an inquiry the End User initiated and to perform our agreement with the Business Customer.
• Consent - for receiving marketing messages. The business is responsible for obtaining this consent from its End Users.
• Legitimate interest - securing the Service, preventing misuse and improving the Service.
• Legal obligation - where the law requires us to retain or disclose data.

5. Service Providers

We share data only with providers needed to operate the Service, and only to the extent needed:

We never sell personal data to third parties.

6. Data Retention

6.1. End User data is kept as long as needed to provide the Service to the business, until the business ends its subscription or a deletion request is made, unless the law requires longer retention.

6.2. When a business ends its subscription, its data and its End Users' data are deleted or de-identified within 90 days.

6.3. Business Customer billing records and invoices are kept for the period required by tax law.

6.4. Residual copies in backups are deleted in the ordinary course of backup rotation.

7. Your Rights

7.1. You may request to access your data, correct inaccurate data, delete it, restrict its use or object to its use.

7.2. Requests may be sent to office@heyzoe.io or to the business you communicated with. We will respond within 30 days.

7.3. Opting out of messages. Sending the word "הסר" in a WhatsApp conversation stops marketing messages from that business. It does not delete your data. To request deletion, contact us as described in Section 7.2.

8. Data Security

• Encryption of data in transit (TLS) and at rest, with additional encryption of sensitive credentials.
• Database access only through our servers, never directly from the browser.
• Access limited to authorized personnel only.
• Periodic security reviews.

No system is completely secure. In the event of a security incident, we will act and notify as required by law.

9. International Data Transfers

Some of our service providers operate outside Israel, including in the United States, so data may be processed there. We take steps so that such transfers comply with applicable data protection laws.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child's data was collected, contact office@heyzoe.io and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time and will update the "Last updated" date at the top. We will notify active Business Customers of material changes by email or WhatsApp.

12. Law, Language and Contact

12.1. This policy is governed by the laws of the State of Israel, including the Protection of Privacy Law, 5741-1981. Users in the EU may also have rights under the GDPR.

12.2. This policy is published in Hebrew and in English. In case of any discrepancy, the Hebrew version prevails.

12.3. Contact: Hey Zoe · office@heyzoe.io · https://heyzoe.io