Privacy Policy

1. Definitions

The following terms shall have the meanings specified alongside them:

• "Personal Data" — any information relating to an identified or identifiable individual, including: name, phone number, email address, IP address, device identifiers, browsing data, and location.
• "Sensitive Data" — sensitive personal data as defined by law, including: medical information, location data, biometric identifiers, genetic data, financial activity data, sexual orientation, political opinions, party affiliation, or information about criminal offenses. We do not collect this type of data on our website.
• "Processing" — any operation performed on personal data, including collection, storage, use, transfer, and deletion.
• "Data Subject" — the individual to whom the personal data relates (you).
• "Third Party" — any entity other than the Company or the data subject.

2. Data Controller & Contact Details

3. Types of Data We Collect

3.1 Data you provide directly (Section 11 of the Law)

When filling out the contact form on our website, providing information is voluntary and not required by law:

Note: Failure to provide the fields required for handling your inquiry will prevent us from responding to you. Fields marked "Voluntary" do not affect our ability to process your inquiry.

To route and prioritize the inquiry for human review, the system also attaches the form page, source page, selected service or plan, and button source. Approximate time on page and interaction count are used in the browser to calculate an internal lead score, but are not sent as separate fields. The score does not make a final decision, reject an inquiry or replace human review.

3.2 Data collected automatically

When browsing our website:

• IP address — anonymized in Google Analytics; the server access log retains the full IP address and browser header for security, troubleshooting, and distinguishing visits
• Browser type and operating system
• Pages viewed and time spent
• Referral source
• Website performance data (Web Vitals)
• Returning visit identification (via local browser storage)
• An anonymous inquiry-funnel stage (for example, form start or successful delivery). The marker contains no name, phone, email, message text or form values, but the server log temporarily associates it with that visit's IP address and browser header
• Affiliate-link clicks — program identifier, page, and link placement, and only while valid analytics-cookie consent exists; the destination URL is not sent

3.3 Data from Meta platforms (Facebook, Instagram, WhatsApp)

We operate a customer service platform that connects to the Facebook Pages, Instagram accounts and WhatsApp Business numbers owned by our clients. A connection is established only after the client explicitly authorises it through Meta, and it can be disconnected at any time.

When a client connects such an asset, we collect and process:

• Details of the connected asset — its Page or account ID, name and profile picture
• Messages sent to and from the connected asset, including attached files and media
• Public comments posted on the connected asset's posts and ads
• The sender's name and profile picture, as provided by Meta, to identify the conversation
• Message timestamps and read status, to manage the queue of enquiries

Purpose: to present all enquiries in a single interface for the client's agents, to reply to them, and to route them automatically. We act as a data processor on behalf of the client, who is the controller of those conversations.

What we do not do: we do not sell this data, we do not use it for advertising or audience targeting, and we do not transfer it to any third party other than the infrastructure providers listed in section 5. Data from one client's asset is never accessible to another client. Disconnecting an asset, or contacting the address in section 2, deletes the data collected from it — see also our data deletion page.

3.4 Data we do not collect

• National ID numbers
• Credit card details (payments are made by bank transfer or under a separate agreement)
• Medical information or other sensitive data

4. Processing Purposes & Legal Basis

We process personal data solely for the following purposes and on the appropriate legal basis:

5. Third-Party Data Sharing

We may share personal data with the following parties only:

5.1 Service and infrastructure providers

• Hetzner Cloud GmbH (Germany) — Server hosting and infrastructure. Germany is recognized as a country with an adequate level of protection under Regulation 2(4). Security standards: ISO 27001, SOC 2 Type II.
• Google Analytics (Google LLC, USA) — For website traffic analysis. Data includes: pages viewed, visit duration, referral source. IP addresses are anonymized. Google is committed to the EU-US Data Privacy Framework. Google Privacy Policy (opens in a new tab)
• Inquiry processing systems (n8n) — For processing contact form submissions. Hosted on Hetzner servers in Germany.
• Cloudflare Inc. (USA) — CDN (Content Delivery Network), security, and DDoS protection services. Cloudflare processes: IP addresses, browser data, and technical browsing information. This data is used to protect the website and improve performance. Cloudflare is committed to ISO 27001 and SOC 2 Type II standards. Cloudflare Privacy Policy (opens in a new tab)
• Meta Platforms, Inc. (USA) — When a client connects a Facebook Page, Instagram account or WhatsApp Business number, messages and comments travel through Meta's infrastructure to our system and back. In addition, if no delivery confirmation is received from a website form and you explicitly choose the continue-to-WhatsApp button, the details shown beside that button are transferred to Meta when the link opens and appear as an unsent message for your review. This path never opens automatically and transfers nothing without your click. Meta is committed to the EU-US Data Privacy Framework. Meta Privacy Policy (opens in a new tab)

5.2 Additional cases

• When required by law or court order
• To protect our rights or property
• With your explicit consent

Note: We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

6. International Data Transfers

Some of our service providers are located outside of Israel:

We ensure that all international data transfers comply with legal requirements and include appropriate safeguards, including engagement with providers committed to international data protection standards (ISO 27001, SOC 2).

7. Data Retention Periods

We retain personal data only for as long as necessary:

At the end of the retention period, data will be deleted or anonymized in an irreversible manner.

8. Cookies & Tracking Technologies

8.1 What are cookies?

Cookies are small text files stored on your device when browsing our website. They allow the site to remember preferences and improve the user experience.

8.2 Types of cookies that may be stored

Note: Cloudflare, which provides CDN, security and Turnstile form verification, may place security or challenge cookies when those mechanisms run. We do not use them for marketing tracking.

While valid analytics-cookie consent exists, clicking an affiliate link sends a short request to our server with the program identifier, page, and link placement. The request does not include the destination URL and is not sent without valid consent. Like any HTTP request, it appears in the access log with ordinary connection data, such as the IP address and browser details, and is retained for up to 90 days.

8.3 Browser storage (localStorage and sessionStorage)

In addition to cookies, the site stores the following values in your browser. Most stay on your device; the exception is inquiry-source context, whose attribution fields accompany a form only if you choose to submit it:

Note: You can delete this data at any time through your browser settings (clear site data) or developer tools.

8.4 Managing preferences

On your first visit to the website, a cookie notice will be displayed allowing you to choose which cookies to accept. You can change your preferences at any time by:

• Clicking the "Cookie Settings" button below
• Your browser settings
• Deleting cookies and reloading the website

9. Data Security

We implement appropriate security measures in accordance with the Privacy Protection Regulations (Data Security), 5777-2017:

9.1 Technical security measures

• Encryption in transit: The website is served over HTTPS; the negotiated protocol depends on the browser, Cloudflare and the origin server
• Anonymization: IP addresses are anonymized in Google Analytics
• Access control: Data access is restricted on a role-based permissions basis (RBAC)
• Two-factor authentication: Enabled in management systems that support it, according to the active configuration
• Traffic protection: Cloudflare rules and server-level protections, with review of security logs and alerts
• Security updates: Regular software and system updates

9.2 Backups

• Frequency: Automatic backups for systems configured for backup; frequency varies by service
• Protection and access: Backup access is restricted, and encryption is used according to provider and configuration capabilities
• Retention and location: Determined by the system, infrastructure provider and relevant agreement

9.3 Logging and documentation

• Website access, funnel-stage and affiliate-click logs: Up to 90 days, under the automatic rotation described in Section 7
• Internal change logs and security-incident documentation: Up to 24 months
• Access: Restricted to authorized personnel for security and troubleshooting

9.4 Security incident notification

In accordance with Amendment 13 to the Privacy Protection Law, in the event of a serious security incident that may cause substantial harm to your privacy:

• We will notify you within 72 hours of discovering the incident
• We will detail the type of data that was exposed
• We will provide recommendations for self-protection
• We will report to the Privacy Protection Authority as required under Regulation 11

9.5 Business continuity

Backup and recovery procedures exist for managed systems. Recovery time and recovery-point commitments are not uniform across services and are defined in a proposal or agreement when included in scope.

Despite our efforts, no security system is perfect. We are committed to handling every security incident with full transparency and responsibility.

10. Your Rights (Under Amendment 13)

Under the Privacy Protection Law and Amendment 13, you are entitled to the following rights:

• Right of access: To review the personal data we hold about you
• Right of correction: To request correction of inaccurate or incorrect data
• Right of deletion: To request deletion of your data (subject to legal obligations)
• Right to object: To object to data processing for marketing purposes
• Right to withdraw consent: To withdraw consent you have given at any time
• Right to restrict processing: To request restriction of processing under certain circumstances
• Right to data portability: To receive the data you provided to us in a readable and structured format (such as CSV or JSON)
• Right to be notified of data breaches: To be informed if a security incident affects your data

To exercise your rights: Send a request to info@achiya-automation.com with the following details:

• Your full name
• Identifying information (phone number or email you provided)
• Description of your request

We will respond to your request within 30 days as required by law.

10.2 Data deletion

Upon a deletion request or termination of engagement:

• Active systems: Deletion will be completed within up to 30 days, subject to identity verification and legal retention duties
• Backups: The data will be removed in the next backup rotation and no later than 90 days, subject to legal retention duties
• Method: Data will be removed from systems under our control according to each system's deletion capabilities
• Confirmation: Written confirmation will be sent after completion has been verified

Note: Data that must be retained by law (such as invoices for 7 years) will be kept in accordance with the law.

11. Minors

Our services are intended for business owners and are not directed at minors under the age of 18.

We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us and we will delete the data immediately.

12. Filing a Complaint

If you believe your privacy has been violated, please contact us first at info@achiya-automation.com and we will endeavor to resolve the matter.

If you have not received an adequate response, you may file a complaint with the Privacy Protection Authority:

13. Policy Changes

We may update this policy from time to time. Material changes will be published on the website with appropriate notice.

The last update date appears at the top of this document. Continued use of the website after a policy update constitutes acceptance of the changes.

14. Contact Us

For questions, requests, or complaints regarding this privacy policy or the processing of your data: