Privacy policy

This English version is provided for convenience. The Hebrew version is the binding version, and it prevails in any difference between them.

Who we are and what this policy covers

WingUp Business is a service of Dosiz Consumerism and Entrepreneurship Ltd (דוסיז צרכנות ויזמות בע״מ), company no. 516335015, of 14 Pnei Meirim St, Beitar Illit 9056214, Israel (the "Company", "we"). The service operates under the WingUp brand.

This policy explains what personal information we collect, why, to whom we give it, how long we keep it, and what your rights are. It applies to:

• the website biz.wingup.ai and all of its pages;
• the app for business owners (biz.wingup.ai/app);
• the calls that the agent answers, by phone and in the website button;
• the website button, the WooCommerce plugin and the Shopify app.

This policy was written under the Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, and under the Protection of Privacy Regulations (Data Security), 5777-2017. The Hebrew text is written in the plural form and addresses all genders. The Hebrew version is the binding version.

Two roles: our information and the business's information

The law distinguishes between a database owner (בעל מאגר), who decides why and how information is used, and a holder (מחזיק), who processes the information for the database owner. We fill both roles, for different types of information:

1. We are the database owner of the information about our customers and the users of the app (business owners and their employees), about visitors to our website, and about anyone who contacts us as a partner or with a support request.
2. We are a holder of the information about the callers and the customers of each business that uses the service: the recordings, transcripts, summaries, contacts, appointments and orders. The business is the database owner of this information. We process it only to provide the service to the business, under its instructions and under our agreement with it.

Did you call a business that uses WingUp Business? The business is responsible for your information. You can contact the business directly with any request. If you contact us, we will pass your request to the business and help it handle the request.

What information we collect

Business owners and app users

• Sign-up details: business name, business owner's name, mobile phone, email, business website, languages, business type and region (Israel or the US).
• Login details: login with a link sent to your email (we keep only an encrypted hash of the link, which is valid for 15 minutes, and the IP address that requested it), or login with a Google account (name, email and account ID).
• Business details that you enter: opening hours, address, services and prices, policies, staff members, call transfer rules and instructions for the agent.
• Business knowledge: pages from the business's website (up to 12 pages, under the rules in the robots.txt file), and files that you upload (up to 10MB per file).
• The setup call: when the setup agent calls you, the call is recorded and transcribed, and you are told about this at the start of the call. Before the call, we read the business's website and search for the business on Google Places by its name and city, to pre-fill details that you will confirm during the call.
• Payment: credit card details go directly to the payment processor (Grow in Israel, Stripe in the US) and are not stored by us. We keep only the card type, the last 4 digits and the billing history.
• App usage: actions you took, settings, and access and security logs.

Callers to our customers (on behalf of the business)

• The caller's phone number, the business number that the caller called, and the time and length of the call.
• The call recording, the call transcript and a call summary, including the details that the caller gave (for example, name, reason for the call, requested time) and the actions that the agent performed.
• Contact: name, phone, email, language, notes, and a short memory of previous calls (up to 600 characters), so that the agent can recognize a returning caller.
• Sensitive information: callers may give sensitive information, for example medical information when they call a clinic. We treat such information as especially sensitive information (מידע בעל רגישות מיוחדת). The agent is instructed not to ask for credit card numbers or ID numbers.

Visitors who use the business's website button

• The transcript of the call or chat with the agent (we do not keep an audio recording of browser calls).
• Details that the visitor leaves in a callback request: name, phone and reason for the request, and the address of the page from which the visitor made the request.
• A random browser identifier, stored in the browser's local storage (localStorage), to link repeat conversations.
• If the business connected the WooCommerce plugin: the first name, phone and current order details of a customer who is logged in to the store, so that the agent can answer questions about the order.

Information from systems that the business connected

• Google Calendar: permissions to read events and to manage them (calendar.readonly and calendar.events), to check availability and to book, move and cancel appointments.
• WooCommerce: orders (number, status, phone, email and order details) and customers (name, phone and email). On the first connection, we sync the orders of the last 60 days.
• Shopify: orders, customers (name, email, phone and address), products, inventory and shipments, and permission to open return requests.

The access keys to these systems are stored encrypted.

Visitors to the biz.wingup.ai website

• The website does not use tracking cookies or third-party analytics tools.
• We store in the browser's storage, for the length of the visit only (sessionStorage), where you came from (for example, a partner code or a campaign), and we pass this information to the sign-up.
• Our hosting servers log technical requests (for example, IP address and browser type) for security and operations.
• If you fill in the partner form: name, company, partner type, number of clients, phone and email.

Why we use the information

• To provide the service: to answer calls, to perform the actions that the business set, to transfer calls, and to send summaries and notifications.
• To set up the agent and adapt it to the business.
• To bill according to the plan and according to usage.
• To give support, to fix faults and to improve the quality of the service. Improvement of the service is done within the business's account and for the purpose of the service to that business.
• To secure the service, to prevent fraud and spam, and to comply with the law.
• To send service messages about the account. We will send marketing messages only to business owners who agreed to this in advance, and you can withdraw consent at any time (section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982).

We do not sell personal information, and we do not use callers' information to train artificial intelligence models, our own or anyone else's.

Must you give information? There is no legal obligation to give us information. Without the sign-up details, the business details and the payment details, we cannot provide the service. A caller does not have to give details to the agent, but without details she may not be able to handle the request.

The agent is artificial intelligence

• At the start of every call, the agent tells the caller that she is artificial intelligence and that the call is recorded. The business can change the wording of the greeting, but cannot remove this notice.
• The recording starts when the call connects, so it also includes the opening moments in which the notice is said.
• The agent answers from the information that the business set. She may make mistakes. She does not give medical, legal or professional advice, and in an emergency she refers the caller to emergency services.
• The agent does not make decisions that have a legal effect or a similar material effect on the caller. When a decision is needed, she transfers the matter to a person in the business, according to the rules that the business set.
• To detect spam calls, the agent classifies the call and can end a spam call.

To whom we give information

We give information only to those who need it to provide the service, only the information that is necessary, and under an obligation of confidentiality and security. These are our subprocessors:

We will also give information if the law or an order of a competent authority requires it, to protect our rights in legal proceedings, or in the event of a merger or sale of the business activity. In such a case, the buyer will undertake to act according to this policy.

Transfer of information outside Israel

The information is stored on servers in Israel. Part of the processing is done by providers outside Israel, as listed in the table, mainly the real-time processing of the call by OpenAI in the US. We transfer information abroad under the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001: to countries whose law protects personal information, or to providers that undertook by contract to protect the information, not to use it for any other purpose and not to pass it on, in a manner that conforms to Israeli law.

How long we keep information

• Call recordings and transcripts: 90 days by default. The business can shorten this to 30 days. After that, they are deleted automatically.
• The call record (time, phone number, summary and the actions performed), contacts and the activity log: as long as the business's account is active, or until the business deletes them. The business can delete a call or a contact at any time. Deleting a contact also deletes the recordings and transcripts of that contact's calls.
• The business's information after the end of the engagement: deleted within 30 days of the business's request or of the end of the engagement, unless the law requires us to keep it (for example, billing documents). Backups are deleted in their regular cycle, within 60 days at most.
• Temporary login details: expired login links and tokens are deleted after 7 days.
• Security and operations logs: as needed for security, and not longer than is required for that.

How we protect the information

We apply the Data Security Regulations, including:

• Each business's information is separated at the database level, so one business cannot see another business's information.
• Access keys to external systems are stored encrypted, with keys that rotate every 90 days.
• Recordings are stored in private storage. Access to listen is given through a signed link that is valid for 15 minutes only.
• Communication with the website, the app and the API is encrypted (TLS). Some segments of a phone call pass through the regular telephone network, which has no end-to-end encryption.
• Only authorized employees who need it for their role access businesses' information, and every such access is logged. We access a business's calls when it asks for help, or when this is necessary to fix a fault or for security.
• Daily backups, with time-limited retention.

No system is completely secure. If a severe security incident occurs, we will report it to the Privacy Protection Authority as the regulations require, and we will notify the businesses whose information was affected, so that they can act toward their callers.

Your rights

• Right of access (section 13 of the law): to ask to see the information about you that we hold.
• Right to correction and deletion (section 14 of the law): to ask to correct or delete information that is incorrect, incomplete, unclear or out of date.
• Removal from mailing (section 17F of the law): to ask that we do not send you marketing messages.
• Withdrawal of consent: to withdraw consent that you gave, as easily as you gave it.

Send your request to privacy@wingup.ai. We will ask only for the details needed to verify that you are who you say you are. We will answer within 30 days. If we do not answer, or if you do not agree with the answer, you can apply to the court or to the Privacy Protection Authority.

Callers to a business that uses the service: the request is handled by the business, which is the database owner. You can contact the business directly, or contact us, and we will pass on the request.

Cookies and browser storage

• The website: no tracking cookies, no advertising and no third-party analytics. Only storage for the length of the visit, as described above.
• The app: storage that is necessary for login and for saving the language you chose.
• The website button: a random identifier in the browser's local storage. You can delete it in the browser settings.

If we add analytics or marketing tools in the future, we will ask for your consent in advance and update this policy.

Minors

The service is intended for businesses, and app users must be 18 or older. Minors may call a business. When the agent understands that a child is speaking, she is instructed to take a message for a parent. The business is responsible for the information of its callers, including when they are minors.

Information from Google

WingUp Business's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use information from Google Calendar only to check availability and to manage appointments for the business. We do not use it for advertising, we do not sell it, and we do not use it to train artificial intelligence models.

Shopify and WooCommerce

When a business connects a store, we keep a copy of the relevant orders and customers to answer questions such as "Where is my order?". The information is kept as long as the connection is active. A deletion request from a customer of a Shopify store deletes that customer and the customer's orders from our systems. Disconnecting the store or removing the app deletes the store's information.

Changes to this policy

We will update this policy when the service or the law changes. You will find the date of the last update at the top of the page. We will notify business owners of a material change by email or in the app, before it takes effect.

Contact

• Privacy and requests about information: privacy@wingup.ai
• Support: support@wingup.ai
• Mail: Dosiz Consumerism and Entrepreneurship Ltd, 14 Pnei Meirim St, Beitar Illit 9056214, Israel

The Privacy Protection Authority at the Ministry of Justice: gov.il/he/departments/the_privacy_protection_authority