Privacy policy
Last updated: 12 October 2026
Draft. This text is pending legal review and will be updated before the service launches. If the Hebrew and English versions differ, the Hebrew version prevails.
iziflow ("the service", "we") is a system for businesses to manage their WhatsApp conversations as a team, with the help of AI. This policy explains what information we collect, why, who we share it with, and how to reach us. For questions and requests: privacy@iziflow.co.il.
1. Who this policy covers
- Users of the service: business owners and their team members who sign in to iziflow. For their information, we decide how it is collected and used.
- A business's customers: people who message a business that uses iziflow on WhatsApp. The business owns the database of its customers' information; we hold and process that information on its behalf and only on its instructions. For questions about such information, contact the business first, and we will help it handle the request.
- Visitors to this website: iziflow.co.il sets no cookies and runs no tracking.
2. What we collect about users
- Account details: e-mail address, display name and preferred language.
- Sign-in details: sign-in by e-mail link, sign-in with Google (name and e-mail address from your Google account), passkeys (we keep only the public key; the private key stays on your device), and two-step verification with an authenticator app. Our authentication provider (Supabase) manages these.
- Active sessions: a short description of your browser and device, and when the session started, was last used and ended, so you can see your sessions and sign them out.
- Business membership: which businesses you belong to, your role and teams, and invitations sent or received (including the invited person's e-mail address).
- Activity log: a record of sensitive actions such as sign-ins, role changes and invitations. It cannot be edited, and is used for security and troubleshooting.
- Technical data at our providers: IP addresses and request logs are recorded by our hosting and authentication providers for security, rate limiting and abuse prevention.
3. A business's customer information
When a business connects its WhatsApp to iziflow, we process on its behalf each customer's phone number, WhatsApp profile name and WhatsApp identifier, together with message content, message status and conversation history. We use this information only to provide the service to the business.
4. Why we use information
- To run the service: sign-in, team management, and receiving and sending messages.
- To secure the service: authentication, detecting unusual use and preventing unauthorised access.
- To send service e-mails such as sign-in links and invitations. We will not send you advertising.
- To provide support and meet our legal obligations.
We do not sell information, use it for advertising, or train AI models on it.
5. Artificial intelligence
To suggest and send replies, conversation content and the business's settings are sent to AI models through Vercel AI Gateway. The service is configured to use only providers that commit not to retain the data and not to train models on it. If no such provider is available, the request is not sent.
6. Cookies
The app (app.iziflow.co.il) uses only cookies the service cannot work without:
- Session cookies (named starting with
sb-), which keep you signed in. iz_locale, which remembers the language you chose.iz_link_to, which remembers the e-mail address a sign-in link was sent to, for 10 minutes only.
There are no advertising cookies and no tracking tools.
7. Who we share information with
Only with providers that help us run the service, and only as far as needed:
| Provider | Role | Main location |
|---|---|---|
| Supabase | Database and user authentication | Frankfurt, Germany |
| Vercel | App hosting and AI Gateway | Frankfurt, Germany |
| Resend | Sending the service's e-mails | Ireland |
| Meta (WhatsApp Business Platform) | Receiving and sending WhatsApp messages | Per Meta's terms |
| Sign-in with Google, for those who choose it | Per Google's terms | |
| AI model providers (through Vercel AI Gateway) | Suggesting replies, with no retention and no training | Varies by provider |
We disclose information to authorities only when the law requires it.
8. Where information is stored
The database and the app are in the European Union (Frankfurt). Some providers, such as Meta and AI model providers, may also process information outside the EU, in accordance with applicable law.
9. How long we keep information
Account details are kept while the account is active, and for as long as the law requires. Sign-in links and invitations are valid for a limited time and expire on their own. A business's customer information is kept according to that business's retention and deletion policy. Detailed retention periods will be added before the service launches.
10. Security
- Encryption in transit and at rest.
- Full separation between businesses in the database, with automated tests that try to cross it.
- Two-step verification required for a business's owners and admins.
- Each business's secrets (such as WhatsApp credentials) are encrypted separately and never reach the browser.
- An activity log that cannot be edited.
11. Your rights
Under Israel's Protection of Privacy Law, 5741-1981, you may ask to access, correct or delete your information. Send a request to privacy@iziflow.co.il. If you are a customer of a business that uses iziflow, contact the business, and we will help it handle the request.
12. Minors
The service is meant for businesses and is not intended for anyone under 18.
13. Changes to this policy
We will update this page and its date. We will notify users of any material change by e-mail.