Privacy Policy

Version 2.1 consolidated — July 23, 2026

The essential

We are MyBot Ltd, an Israeli company registered in 2021, operator of AlefOS from Ashkelon, in Israel.

AlefOS is a business OS intended for professionals. It helps to capture, structure and retrieve useful information resulting from their workflows: calls, messages, WhatsApp, activated professional sources or information voluntarily transmitted to AlefOS.

AlefOS does not replace the user's existing tools. It coexists with them when the user chooses to connect them or to transmit information to AlefOS.

AlefOS does not automatically monitor the user's entire calls, messages or conversations. The processing depends on the connected sources, the activated contacts or conversations, the voluntarily transmitted information and the parameters configured by the user.

AlefOS is not an automatic WhatsApp bot. It does not reply to customers alone, launch WhatsApp campaigns, or run automated message series. AlefOS can extract, organize, structure and prepare drafts. Any external or engaging WhatsApp message prepared by AI must be validated by the user before sending. When sending is enabled, messages are sent through the official Meta WhatsApp Business Platform or an authorized provider, and Meta API costs may be charged according to usage.

For processing carried out in the client's professional space, the professional using AlefOS remains in principle responsible for the relationship with their own contacts, clients, prospects or collaborators. MyBot Ltd provides the technical infrastructure and acts mainly as a subcontractor.

AlefOS may process audio content transmitted by the user, an audio URL or a provider flow when enabled. Retention depends on the source, configuration and operational retention rules. Raw transcripts, summaries, signals, missions, reminders and structured information must be distinguished and can be kept differently as part of the professional business memory.

AlefOS may use AI assistance to analyze, summarize, classify, prioritize or prepare operational information. AI outputs are assistance only: they may be incomplete or inaccurate and should be verified by the user before any professional decision or external communication. External or engaging actions prepared by AI require user validation.

AlefOS retains data only as long as necessary according to the nature of the data, operational usefulness, security, legal obligations and technical constraints. If certain data cannot be deleted immediately for technical, backup, security or legal reasons, AlefOS may restrict its use and then delete or anonymize it when possible.

AlefOS never sells personal data to third parties, does not share it for purposes of cross-context behavioral advertising, does not use it for advertising targeting and does not use it to train general artificial intelligence models intended for third parties.

AlefOS is not intended for children, does not provide an automated solicitation service by calls or SMS, and only sends SMS for authentication, security, service or a functionality expressly activated.

If your contact details or a relational identifier appeared in AlefOS before your registration, you can ask to know why, exercise your rights, object to the processing or request the deletion of the data concerned when the law allows it.

MyBot Ltd operates AlefOS. MyBot Ltd is the Data Protection Contact for requests relating to the protection of personal data.

The present privacy policy describes how MyBot Ltd, an Israeli company registered under number 516373891 and whose registered office is located in Ashkelon, in Israel, operating the AlefOS product, processes personal data in connection with its website, its web application and the associated services. Legal contact: MyBot Ltd — AlefOS, Ashkelon, Israel. Email: support@alefos.ai. Data Protection Contact: MyBot Ltd.

In accordance with articles 4, 12 and 13 of the GDPR, when MyBot Ltd acts in the capacity of data controller, it provides the concerned persons with information relating to its identity, the purposes pursued, the categories of data processed, the applicable legal bases, the recipients, the retention periods and the available rights.

When American laws relating to the protection of privacy apply, MyBot Ltd also provides information relating to the categories of personal data processed, the professional or commercial purposes of the processing, the categories of recipients, the applicable rights and the modalities for exercising these rights.

This does not concern only registered users. If you have already interacted with a professional using AlefOS, notably by call, message, appointment, WhatsApp or other activated professional flow, this policy can also concern you.

The present Privacy Policy explains how personal data are collected, used, kept, deleted, disclosed and protected in the framework of AlefOS, notably for users, professional clients, artisans, independents, small teams, service providers, prospects, non-user contacts, silent or ghost contacts, as well as any person whose data can appear in a professional flow processed by AlefOS. AlefOS is a business OS intended for professionals who work from daily flows such as calls, written or vocal messages, WhatsApp, notes, activated professional sources, connected tools or information transmitted voluntarily to AlefOS. AlefOS does not have the vocation to replace the user's existing tools. The service coexists with these tools when the user chooses to connect them, to authorize them or to transmit certain information to AlefOS.

AlefOS does not function as a main mobile application nor as a permanent listening system. Registration, onboarding, the configuration of connectors and certain parameters are done mainly from a web application. Operational usage can then be done via MCP compatible environments, notably ChatGPT, Claude, Grok or any other compatible environment when this one is supported.

The objective is to capture the useful information present in the authorized flows, to structure them and to make them exploitable in the form of relational memory, signals, missions, reminders, products, files, events or validatable actions. For calls, AlefOS does not listen to them and does not record them natively in an automatic way: the user can notably add AlefOS to a conference call, transmit an audio or voluntarily activate a processing functionality so that AlefOS acts as a business notebook. For WhatsApp or equivalent services, the connection of an account or of a connector does not mean that all conversations are automatically processed: the user can configure the contacts, conversations or sources that he wishes to process or exclude, according to the available functionalities. Other professional flows can be structured only when the relevant source is activated, available and authorized for the user or professional client. These processing operations are carried out solely within the limit necessary for the purposes described in the present policy and according to the parameters, authorizations or connectors activated by the user or the professional client. The present policy does not mean that all functionalities, connectors or sources mentioned are activated for each user. The data processed depend on the services effectively used, the integrations connected, the authorizations given and the configuration choices of the professional client.

Who is responsible for your data

The professional using AlefOS (professional client, service provider, artisan, operator or any person using AlefOS in a professional framework) is responsible for the relationship with you and the legal obligations that result from it. We provide the infrastructure.

For the processing carried out in the client's professional space, the professional client remains responsible for the processing. It determines the purposes and essential means of the processing carried out in the framework of its relationship with its own contacts, prospects, clients, collaborators or professional interlocutors.

When a professional client imports, connects, transmits or processes third-party data through AlefOS, that client is responsible for having the right to do so, informing the relevant persons when required, and holding the necessary authorizations for the connected or transmitted data.

MyBot Ltd acts, for these processing operations, in the capacity of subcontractor of the professional client, to the extent that it provides the infrastructure, the functionalities and the technical means allowing the capture, the structuring, the analysis, the transmission and the operational exploitation of the information processed in the client's professional space.

MyBot Ltd acts however as limited autonomous controller for the processing operations necessary for the proper functioning of the AlefOS platform, notably the management of accounts, authentication, OTP or OAuth mechanisms, security, billing, support, prevention of abuse, technical deduplication, management of requests relating to the rights of the concerned persons and the mechanisms of voluntary claiming of contacts.

The tenant remains responsible for its relationships with clients, prospects, collaborators, suppliers and contacts. AlefOS provides the infrastructure and acts as processor or service provider for tenant business data, except for platform operations such as account management, security, billing, support and abuse prevention.

When applicable American laws use a different terminology, MyBot Ltd must be understood, for the business data processed in the client's professional space, as a service provider, processor or contractor acting on behalf of the professional client, within the limit of the instructions, purposes and functionalities defined by this client. MyBot Ltd does not process these business data to sell them, to share them for purposes of cross-context behavioral advertising or to use them for its own advertising campaigns.

When the formal designation of a data protection officer is mandatory or decided by MyBot Ltd, their contact details are communicated to the concerned persons. At the date of the present version, unless formal designation to the contrary, the Data Protection Contact is MyBot Ltd.

Principles applicable to the processing of data

MyBot Ltd ensures that personal data are processed in a lawful, fair and transparent manner; collected for determined, explicit and legitimate purposes; adequate, relevant and limited to what is necessary; accurate and, if necessary, kept up to date; kept for a duration not exceeding that necessary for the purposes of the processing; and processed in a manner to guarantee appropriate security.

MyBot Ltd implements data protection measures from the design and by default, in order to limit the processing to the data necessary for the functioning of AlefOS and the associated services.

These principles include also, when applicable American laws require it, reasonably accessible information on the practices of collection, use, retention and disclosure of personal data, as well as the implementation of reasonable security measures proportionate to the nature of the data processed.

What we collect

AlefOS processes only the data necessary for the functioning of the service, according to the functionalities used, the connected sources, the authorizations given and the information transmitted voluntarily by the user or the professional client. According to the cases, AlefOS can process the following categories of data:

a) Identification and contact data: last name, first name, telephone number, email address, postal address, company, job title, contact identifier, technical identifier, account information, user settings, preferences, subscription, billing and exchanges with support.

b) Data resulting from professional flows: calls or call metadata processed via CallOS when the user adds AlefOS to a conference, voluntarily transmits an audio or activates a compatible telephone functionality; written or vocal messages; WhatsApp messages or equivalent services only when they are connected, transmitted, authorized or configured to be processed; activated professional source data when available and authorized; notes, requests, reminders, documents or other professional information transmitted to AlefOS.

c) Audio content and transcriptions: audio content of calls or voice messages when the user transmits the audio, adds AlefOS to a conference or voluntarily activates a processing functionality; transcriptions generated from these contents; extracts or summaries necessary for the structuring of the signal.

d) Data structured by AlefOS: operational signals, missions, reminders, validatable actions, calendar information, mentioned products or services, product files, relational files, active relationship indicators, PION results, business context, GroupOS entries, ProductOS elements and information useful to the user's professional memory.

e) Data relating to non-user contacts: contact details, relational identifiers, minimal context, signals, missions or structured information necessary for the functioning of the client's professional space, notably when a contact is mentioned in a call, a message, a note, an activated source, a connected tool or information transmitted to AlefOS. These profiles do not constitute active user accounts.

f) Technical, security and usage data: technical logs, IP address, session identifiers, browser or device information, system events, diagnostic data, security logs, configuration settings, functionalities used, actions performed in AlefOS, performance data, errors and information necessary for maintenance, security and prevention of abuse.

g) Metadata linked to contents or connectors: source of the information, date and time, technical identifiers, synchronization status, type of content, file size or format, origin of the flow, connector used and information necessary for storage, transfer, deduplication or technical coherence of the service.

AlefOS does not process all these categories for each user. The data effectively processed depend on the functionalities activated, the tools connected, the configuration choices, the exclusions put in place and the actual usage of the service.

The data published in GroupOS correspond to the information that a user or authorized member chooses to publish in an AlefOS group. They can include, according to the published content, business instructions, training, meeting notes, opportunities, errands, protocols, client information or other professional knowledge shared with authorized members of the group.

The ProductOS data correspond to the products, services, services or know-how detected, suggested, confirmed or structured in the user's business catalog. They can come from mentions made in authorized professional flows or from a voluntary entry, then be used for internal research, relational memory, the catalog or an authorized publication/synchronization.

For people located in the United States, these data can correspond, according to the applicable law, to categories such as identifiers, contact details, professional information, commercial or relational information, electronic or network activity information, audio or electronic contents transmitted voluntarily, approximate geolocation data when they are necessary for the service, operational inferences limited to business memory and technical security information. AlefOS does not voluntarily collect these categories in all cases: they depend strictly on the activated sources and the actual usage of the service.

Why we use it

AlefOS uses personal data in order to provide a business OS capable of capturing, structuring, organizing and retrieving useful information resulting from authorized professional flows, transmitted or configured by the user or the professional client. AlefOS does not have the purpose of monitoring the user's entire communications, but of processing the chosen flows, contacts, conversations or sources in order to extract an exploitable business memory. Personal data can notably be processed for the following purposes:

a) to provide, operate, secure, maintain and improve AlefOS;

b) to capture and structure useful information resulting from transmitted or voluntarily processed calls, written or vocal messages, configured WhatsApp contacts or conversations, notes, activated professional sources, connected tools or information transmitted voluntarily to AlefOS;

c) to generate or update operational signals, missions, reminders, validatable actions, relational files, product or service files, calendar events, summaries and business memory elements;

d) to allow the user to retrieve useful information without having to search manually in his calls, messages, agendas, notes or external tools;

e) to help the professional client to ensure the follow-up of his contacts, prospects, clients, collaborators or professional interlocutors, within the limit of his own purposes and responsibilities;

f) to allow the synchronization, organization, display, search, deduplication, technical coherence and the good functioning of the activated connectors or sources;

g) to manage authentication, accounts, sessions, authorizations, preferences, processing exclusions, onboarding, billing, support and requests relating to rights;

h) to send legal, technical, security or service notifications strictly necessary for the functioning of AlefOS;

i) to diagnose errors, maintain the stability of the service, prevent abuse, fraud, unauthorized access, diverted usages or attacks on the integrity of the system;

j) to allow the publication, structuring and search of business knowledge in authorized AlefOS groups, according to the rights of the members and the available publication parameters;

k) to detect, suggest, structure, confirm, search or prepare products and services in ProductOS, notably for the business catalog, relational memory or an authorized product surface or integration when available and validated;

l) to comply with applicable legal, regulatory, contractual, tax, accounting or security obligations. AlefOS does not process data to replace the user in his professional decisions. The missions, reminders, actions or results generated by AlefOS have the vocation to assist the user and, when this is required by the functioning of the service, to be verified or validated by him before execution.

For applicable American laws, these purposes correspond to professional or commercial purposes necessary for the provision of the service, security, prevention of abuse, support, billing, execution of the contract, maintenance, improvement of the service and the provision of functionalities requested by the professional client. MyBot Ltd does not sell personal data, does not share them for purposes of cross-context behavioral advertising, does not use them for targeted advertising and does not use them to train general artificial intelligence models made available to third parties.

Our legal basis

Contract, legal obligation, legitimate interest or consent — depending on the exact nature of the data processed and its purpose.

Depending on the context, the processing relies on one or more of the following legal bases: a) the performance of a contract or pre-contractual measures; b) compliance with a legal obligation; c) the legitimate interests pursued by the data controller or by a third party, notably the continuity of activities, the organization of professional activity, security, the prevention of abuse, operational traceability and the maintenance of useful business relationships; d) when applicable law requires it, consent. For the ghost or silent contact mechanism described below, the legal basis invoked is the legitimate interest within the meaning of Article 6, paragraph 1, point (f) of the GDPR.

When the processing relies on consent, the concerned person can withdraw it at any time, without this withdrawal affecting the lawfulness of the processing carried out before it.

When the processing relies on legitimate interest, the concerned person can exercise their right of objection under the conditions provided for by the applicable regulations, notably when their interests, rights and freedoms prevail over the pursued interests.

Certain American laws do not rely on a system of legal bases equivalent to the GDPR. In this case, the present policy must be read as information on the categories of personal data processed, the purposes of the processing, the categories of recipients, the available rights, the practices of sale or sharing of data and the means of control made available to the concerned persons.

When you are mentioned before your registration

When a non-user person appears in the professional flows of an AlefOS client, a technical contact profile can be created in the professional space of this client. This can notably happen when a professional enters or synchronizes contact details, adds a note, voluntarily processes a call, a written or vocal message, a calendar event, an email, information resulting from a connected tool or any other professional signal transmitted or authorized in AlefOS.

This technical profile can include, according to the information available, a name, a telephone number, an email address, a postal address, a technical identifier, a minimal relational context or structured information necessary for the functioning of the service. It does not constitute an active user account and does not allow this person to access AlefOS without voluntary registration.

The creation of this technical profile has for purposes to ensure the continuity of the professional relationship in the client's space, to avoid duplicates, to structure useful signals, to allow reminders, missions or actions requested by the professional client, and more generally to ensure the good functioning of AlefOS.

These data can not be collected directly from the concerned person. In this case, MyBot Ltd or the concerned professional client provides the information required by article 14 of the GDPR, except when the provision of individual information proves impossible, requires disproportionate efforts or seriously compromises the purposes of the processing. Appropriate measures are then implemented, notably general information accessible in the present policy.

When this person subsequently creates an AlefOS account, they can, on a voluntary basis, request the search for candidate relationships and choose to import only neutral elements, such as the existence of a relationship, general dates, interaction counters or information strictly necessary for the reconstitution of a minimal relational context.

Private notes, raw messages, transcriptions, internal opinions, professional appraisals, confidential contents, internal instructions, private missions or sensitive information specific to the professional client are not imported into the space of the concerned person.

The concerned person can at any moment request the deletion of this technical profile, exercise their rights or object to its conservation, except for applicable legal obligation or compelling legitimate ground justifying the continuation of the processing.

When the concerned person is located in the United States and an applicable American law confers upon them rights on their personal data, they can ask to know the categories of data concerning them, request their correction or deletion when the law allows it, or exercise any other applicable right. MyBot Ltd does not consider the creation of a technical contact profile in the professional space of a client as a sale of personal data nor as a sharing for purposes of cross-context behavioral advertising.

Data relating to non-user third parties

In the framework of the use of AlefOS, certain personal data can concern persons other than the user, notably clients, prospects, collaborators, professional interlocutors, service providers, suppliers or other contacts of the professional client.

These data can appear when a professional user enters information in AlefOS, adds a signal, voluntarily processes a call, imports or synchronizes contact details, transmits a written or vocal message, activates a connector, configures certain contacts or WhatsApp conversations or equivalent service, or connects another compatible professional source when available and authorized.

It can notably be a matter of contact data such as name, first name, email address, telephone number, postal address, company, organization, professional function, technical identifier or relational identifier associated with the contact. According to the context, AlefOS can also process information strictly necessary for the business memory of the professional client, such as the context of the relationship, the expressed requests, appointments, reminders, missions, products or services mentioned, operational preferences or elements necessary for professional follow-up.

These data are processed solely within the limit necessary for the functioning of the service, for the purposes determined by the professional client, for the requested synchronization, for the structuring of signals, for deduplication, for the technical coherence of the system, for security and for the exercise of the rights of the concerned persons.

No data imported, generated or structured by a user is made visible to another user, except for voluntary sharing action performed by the concerned user, group or collaboration functionality expressly activated, applicable legal obligation or functionality expressly provided for and brought to the knowledge of the concerned persons.

Data relating to non-user third parties are not used for MyBot Ltd's own commercial prospecting purposes, nor sold to third parties, nor used to constitute a common database of contacts accessible to all users.

When a user publishes information in an AlefOS group via GroupOS, this information becomes accessible to authorized members of the group according to their rights. The professional client or publishing member remains responsible for verifying that they are authorized to share this information with the concerned members, notably when it contains personal data, contact details, client information, confidential information, internal instructions, training, protocols or elements protected by professional or commercial secrecy.

GroupOS has the vocation to allow the sharing of business knowledge and information in a controlled perimeter. For example, a taxi group can serve to share a ride, a manager can publish a sales technique or a meeting note, and a team can consult training or a protocol. If the published content contains a telephone number, an address or client information, the authorized members of the group can access it.

MyBot Ltd does not present itself as a data broker for these data and does not monetize contact lists, relationships, signals or business information created in the professional spaces of its clients. When applicable American laws impose a particular qualification or obligation due to the volume, nature or origin of the processed data, MyBot Ltd reevaluates its obligations and updates the present policy if necessary.

In order to improve the functioning of AlefOS and to avoid duplicates, MyBot Ltd can implement technical mechanisms of deduplication or reconciliation of contact data. These processing operations have for sole purposes to avoid the creation of duplicates, to improve the technical consistency of information, to allow the correct display of contacts, to ensure the good functioning of synchronization functionalities and to strengthen the security and integrity of the service.

These processing operations do not allow a user to access data imported or generated by another user. They are framed by guarantees such as the limitation of purposes, the partitioning of user spaces, the limitation of access, the minimization of processed data and appropriate security measures.

These mechanisms of deduplication or reconciliation are limited to what is necessary for the good technical functioning of the service and do not allow to create a common database of contacts accessible to all users.

Data processed by artificial intelligence functionalities

When the user chooses to use functionalities integrating artificial intelligence technologies, AlefOS can process certain data necessary for the provision of these functionalities, notably the instructions or queries entered, the responses generated, the feedback transmitted, the corrections made, the configured automations and the contextual data strictly necessary for the response or the execution of the requested functionality.

These data are processed in order to provide the requested functionalities, to adapt the results to the context, to improve the quality of the service and, when this is provided for, to allow the automation of certain tasks. Unless contrary information is brought to the user's knowledge and appropriate legal basis, the user's personal contents are not used to train general artificial intelligence models intended to be made available to other users.

When certain data are used for purposes of improvement, evaluation or development of artificial intelligence components, MyBot Ltd informs the user of the categories of data concerned, the purposes pursued, the applicable legal basis and, when this is required, the available consent, objection or withdrawal mechanisms.

When providers of artificial intelligence technologies intervene in the processing, they only access personal data to the extent necessary for the provision of the concerned functionality and within the framework of appropriate contractual commitments regarding confidentiality, security and data protection.

The output architecture of AlefOS relies on a main processing of signals and transcriptions on an infrastructure controlled by MyBot Ltd. In case of overload, unavailability or specific technical need, certain processing operations can be entrusted to an external inference, transcription or calculation provider, strictly limited to the technical needs of the service and contractually framed. The processed contents are not used to train general models intended for third parties, unless contrary information is brought to the knowledge of the concerned person and appropriate legal basis.

AlefOS's artificial intelligence functionalities are designed as tools for assistance, structuring and preparation of actions. The results can be incomplete or inaccurate and must be verified by the user when they are used to make a professional decision, communicate with a third party or execute an action. MyBot Ltd does not present the results generated by AlefOS as certified legal, financial, medical, tax or technical advice, nor as a definitive automatic decision.

ProductOS can detect mentions of products, services, offerings or know-how in the authorized flows and propose their structuring in the user's business catalog. These elements can then be used to help retrieve a professional in an authorized relational perimeter, prepare a product file or an authorized external publication/synchronization when the relevant integration is available, connected and validated. Unless functionality expressly configured otherwise, important creations, publications or synchronizations must be validated by the user.

Sensitive data or special categories of data

In the framework of the normal use of AlefOS, MyBot Ltd does not solicit, does not collect and does not process voluntarily special categories of data within the meaning of article 9 of the GDPR, such as data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, trade union membership, genetic data, biometric data for the purposes of identifying a natural person in a unique way, data concerning health, sex life or sexual orientation.

The user commits not to use the services to transmit, import, store or process such data, except if a specific functionality expressly provides for it and an appropriate legal basis frames this processing. In any case, MyBot Ltd does not use special categories of data for purposes of targeted advertising, commercial profiling, sensitive categorization of users or training of general artificial intelligence models.

When applicable American laws recognize categories of sensitive data, MyBot Ltd does not use them to infer sensitive characteristics, does not sell them, does not share them for purposes of cross-context behavioral advertising and does not use them to limit or refuse a service on the basis of a protected characteristic, except legal obligation or functionality expressly requested and legally framed.

How long do we keep things

The audio content transmitted to AlefOS, processed via a voluntary conference or resulting from an authorized voice message, is kept only for the duration necessary for its processing, except for legal obligation, technical incident or specific evidentiary need. Transcriptions, signals and structured information resulting from the exchanges can be kept as the professional user's business memory for the duration of the utility of the active relationship or until deletion by the user, subject to applicable legal obligations.

AlefOS applies a data retention policy limited and proportionate to the pursued purposes. The audio content transmitted to AlefOS, processed via a voluntary conference or resulting from an authorized voice message, is kept only for the duration necessary for its processing, except for legal obligation, technical incident or specific evidentiary need. Transcriptions, signals, missions, reminders and structured information resulting from the exchanges can be kept as the professional user's business memory for the duration of the utility of the active relationship or until deletion by the user, subject to applicable legal obligations. The raw bodies of messages can be subject to a shorter retention duration than the structured signals resulting from them. Administrative, contractual, security or evidentiary data are kept for the period necessary to respect legal obligations, for the defense of rights or for the management of the contractual relationship. At the expiration of the applicable retention duration, the data are deleted or anonymized, unless a legal obligation or a legitimate need for proof justifies their retention.

The notion of active relationship corresponds to a professional relationship still presenting an operational utility for the concerned professional client, subject to compliance with the principles of minimization, proportionality and limitation of retention.

Synchronized or imported contact data are kept for the duration necessary for the provision of the concerned functionality, until their deletion by the user, until the disconnection of the concerned source or until the deletion of the account, subject to legal obligations or the necessity to keep certain data for purposes of security, proof or incident management.

Technical logs, security data, system events and diagnostic data are kept for a duration limited and proportionate to the purposes of security, maintenance, incident detection and prevention of abuse, unless there is a need for longer retention in case of incident, litigation or legal obligation.

Who else has access to your data

Only the service providers, technical components or connectors necessary for the functioning of AlefOS can access personal data, within the limit strictly necessary for their functions. MyBot Ltd does not sell personal data and does not share them for advertising purposes.

At the date of the present policy, the infrastructure and services associated with AlefOS can notably include:

a) hosting, storage and infrastructure providers, notably AWS (Amazon Web Services), for regional hosting, secure storage, databases or infrastructure components in Israel (il-central-1) and in the European Union / Paris (eu-west-3);

b) application hosting or deployment providers, notably Railway or equivalent services, for certain backend components, API, MCP services, web interfaces or execution components;

c) authentication, session or security services, notably Firebase / Google or equivalent services, for authentication, session management, OAuth, connection with certain authentication services or associated security functions;

d) telephony solutions, PBX or equivalent components, notably FreePBX or infrastructures controlled by MyBot Ltd, for the CallOS brick when the user adds AlefOS to a conference call, voluntarily transmits an audio or activates a compatible call, routing or telephone processing functionality;

e) telecommunication or SMS providers, when this is necessary for the verification of the telephone number, the sending of an OTP code, account security or a functionality expressly activated. SIP services, portability, non-essential SMS or advanced telephone connectivity are only used when a corresponding functionality is activated or necessary for the functioning of the service;

f) connectors or professional communication services, notably WhatsApp or equivalent services, or any other compatible professional source, solely when the user or the professional client chooses to connect, authorize, transmit or configure the concerned flows, contacts or conversations in AlefOS;

g) calculation, transcription or inference providers, such as RunPod or any equivalent provider, solely in case of overload, backup, unavailability, specific technical need, particular functionality or expressly activated integration;

h) payment, billing, support, logging, security or diagnostic services, solely to the extent necessary for the contractual, technical, accounting or security functioning of the service.

The main processing of signals, transcriptions and structured information is intended to be carried out on an infrastructure controlled by MyBot Ltd. OpenAI / Whisper or any other external provider of transcription or artificial intelligence must not be understood as a normal or systematic provider of the service when the processing is carried out locally or on an infrastructure controlled by MyBot Ltd. These external providers can however intervene when this is necessary for a specific technical need, an overflow, a backup, an unavailability, a particular functionality or expressly activated integration.

External providers only access personal data to the extent necessary for their respective technical functions and subject to appropriate contractual commitments regarding confidentiality, security and data protection. The list of technical providers is provided on the basis of the information available at the date of the present policy and can be updated according to the evolution of the infrastructure, the services used, the connectors activated by the users or the operational needs of AlefOS.

In accordance with article 28 of the GDPR, MyBot Ltd ensures that its subcontractors present sufficient guarantees regarding the protection of personal data and only act on documented instruction when MyBot Ltd itself intervenes in the capacity of data controller or contractually framed subcontractor.

When applicable American laws use the notions of service provider, contractor, processor or subprocessor, MyBot Ltd requires that the concerned providers only use personal data to provide the requested technical services, do not sell them, do not share them for purposes of cross-context behavioral advertising and do not use them for their own independent purposes, except legal obligation or distinct agreement brought to the knowledge of the concerned persons.

The data can also be communicated to administrative, judicial, tax, regulatory or control authorities when this communication is required by law, a judicial decision, a legally binding request or in order to protect the rights, security or legitimate interests of MyBot Ltd, of users or of third parties.

When your data crosses borders

AlefOS relies on a regional infrastructure intended to limit unnecessary data transfers and to strengthen the partitioning of user spaces.

When regional routing is applicable, the business data of European user spaces are intended to be stored in a European region, notably within the European Union / Paris (eu-west-3). Data of other user spaces can be stored or processed in other regions, notably in Israel, according to the applicable architecture.

Certain technical processing, administrative access, maintenance operations, security processing, assistance processing, inference, transcription or calculation processing, or components necessary for the functioning of AlefOS can nevertheless imply an access, a processing or a transfer of data towards Israel or towards other countries, within the limit necessary for the functioning of the service and subject to the applicable guarantees.

Data transfers from the European Economic Area towards Israel can, when the applicable conditions are met, rely on the adequacy decision adopted by the European Commission concerning Israel.

When data are transferred towards a country or a provider not benefiting from an adequacy decision, MyBot Ltd ensures to put in place the appropriate guarantees required by the applicable regulation, notably standard contractual clauses, complementary contractual, technical or organizational measures, or any equivalent mechanism recognized by the applicable regulation.

The user can obtain complementary information on the guarantees implemented by contacting MyBot Ltd according to the modalities provided for in the present policy.

How we protect your data

HTTPS, access controls, short-lived tokens, rate limiting, isolated tenant data. No system is perfect, but we take this very seriously.

MyBot Ltd implements appropriate technical and organizational measures to protect personal data against destruction, loss, alteration, unauthorized disclosure, illicit access, or any unauthorized processing. These measures may include, where appropriate, access control, authentication, logging, environment segmentation, limited retention periods, infrastructure monitoring, and authorization management. Among the specific measures implemented are HTTPS/TLS encryption for all communications, short-lived and automatically rotating JWT Bearer tokens, user-initiated session revocation, server-side rate limiting on sensitive endpoints, and multi-tenant data isolation. No security measure guarantees zero risk, but MyBot Ltd is committed to maintaining a level of protection adapted to the nature of the processing.

In the event of a personal data breach likely to create a risk for the rights and freedoms of the concerned persons, MyBot Ltd implements the notification or information procedures provided for by the applicable regulation.

AlefOS also implements logical separation of user spaces and, where applicable, regional routing of data by user space in order to limit access, avoid mixing between environments, and strengthen the partitioning of data processed on behalf of distinct professional clients.

If you are a business using AlefOS

You are master of the relationship with your contacts, as well as the legal responsibilities that result from it. AlefOS provides the infrastructure; you decide on its use.

Professional clients using AlefOS as data controllers remain solely responsible for: a) the lawfulness of the initial collection of personal data; b) the notification to the concerned persons when this is required; c) the determination of the legal bases applicable to their own activities; d) the processing of requests for rights relating to the processing for which they are responsible; e) the choice of calls, contacts, conversations, sources or connectors that they transmit, activate or exclude in AlefOS; f) compliance with local rules governing the recording of calls, solicitation, electronic communications and practices regarding client relations.

The professional client must ensure that the use of AlefOS remains compatible with the purposes that it has determined, with the information communicated to the concerned persons and with the rules applicable to its sector of activity.

The professional client also remains responsible for verifying that the addition of AlefOS to a conference call, the transmission of audio content, the sending of electronic communications, the retention of information relating to its contacts, the use of signals generated by AlefOS, the publication of information in an AlefOS group and the validation of products or services in ProductOS are authorized with regard to the rules applicable to its activity, to its country of establishment and to the concerned persons.

The professional client remains responsible for informing its own contacts when applicable law requires it, notably regarding the recording of calls, indirect data collection, commercial communications and the use of relational tracking tools. MyBot Ltd provides documentation and technical means intended to facilitate this information, without substituting itself for the professional client for the processing operations for which the latter determines the purposes and essential means.

When the professional client uses GroupOS, it remains responsible for the contents published by it or under its authority, for the choice of invited members, for the reading or publication rights granted and for the lawfulness of the sharing of data within the group. When the professional client uses ProductOS, it remains responsible for the accuracy of the confirmed products or services, for their compliance with its real activity and for the publications or synchronizations that it validates towards third-party services.

For users located in the United States or in relation with persons located in the United States, the professional client remains notably responsible for compliance with the rules applicable to recorded or assisted calls, to electronic communications, to SMS, to solicitation, to automated calls, to information obligations and to consents required by applicable federal or state laws. AlefOS does not constitute, by its sole provision, a service of robocall, autodialing or SMS marketing: the user chooses the communications, sources and processing operations that it activates.

Analysis, personalization and technical profiling

MyBot Ltd may analyze certain technical signals, usage signals, configuration parameters, interactions with AlefOS and contextual data in order to provide the requested functionalities, personalize the user experience, improve system performance, strengthen security and propose functionalities adapted to the user's needs.

These operations may involve an automated analysis of certain usage behaviors or technical preferences, notably in order to adapt the display, the parameters, the automations or the results provided by certain functionalities. Unless otherwise indicated, these processing operations are not intended to produce legal effects regarding the user nor to affect him significantly on the sole basis of a fully automated decision within the meaning of Article 22 of the GDPR.

AlefOS may classify, summarize, prioritize or propose actions based on processed signals, but these results are intended to assist the user and not to produce, by themselves, a legal, financial, medical, employment, credit, insurance, housing decision or an equivalent decision significantly affecting a person. When applicable American laws impose information, assessments, rights of objection or appeal mechanisms regarding certain automated processing or profiling, MyBot Ltd implements them to the extent that these laws apply to the concerned service.

Privacy settings and user control

When this is technically possible, MyBot Ltd makes available to the user settings allowing him to control certain collections, connections, synchronizations or uses of data in AlefOS, notably from the web configuration application.

The user can notably control, according to the available functionalities and the rights associated with his account:

a) the activated sources or connectors, such as WhatsApp or equivalent services, calls voluntarily transmitted or processed, messages, activated professional sources or other compatible professional tools;

b) the authorizations granted to AlefOS to access, synchronize, structure or process certain professional flows, contacts or conversations;

c) the preferences for synchronization, content analysis, personalization, telemetry, use of artificial intelligence functionalities or service improvement;

d) the contacts, conversations, sources or elements that he wishes to exclude from AlefOS processing, notably certain WhatsApp contacts or conversations when this functionality is available;

e) the groups, invitations, authorized members, rights and publication rules available in GroupOS;

f) the data, signals, missions, reminders, products, files or business memory elements that he wishes to correct, delete, archive or no longer use, subject to applicable legal obligations and reasonable technical limitations;

g) the products, services, detected mentions, catalog files or ProductOS publications that he wishes to confirm, correct, archive, delete or no longer use;

h) the mechanisms of voluntary claiming of contacts or candidate relationships, when the concerned person chooses to create an AlefOS account and to examine the neutral elements possibly associated with his contact details.

Certain collections or processing operations can be necessary for the essential functioning of AlefOS, for authentication, for security, for the prevention of abuse, for compliance with legal obligations, for billing, for maintenance or for the defense of rights. These processing operations cannot always be deactivated without affecting the access or the use of the service.

When a user deactivates a source, excludes a contact, removes a conversation from processing or limits a processing, certain AlefOS functionalities can no longer be available or produce incomplete results, notably the generation of signals, reminders, missions, searches, summaries or memory elements linked to this source, this conversation or this contact.

Access your data, correct it, delete it, export it, contest it or restrict it. Send an email to support@alefos.ai with "Privacy Request" as the subject.

Subject to applicable legislation and the specific role of the parties, the concerned persons have the following rights: a) right of access; b) right of rectification; c) right to erasure; d) right to restriction of processing; e) right to object; f) right to data portability, where applicable; g) right to withdraw consent when processing is based on it; h) right to lodge a complaint with a competent supervisory authority. When MyBot Ltd acts solely as a subcontractor on behalf of a professional client, the request may be redirected to the relevant data controller, except where legal provisions state otherwise.

The concerned persons also have the right not to be subject to a decision based exclusively on automated processing producing legal effects or significantly affecting them, when this right is applicable.

When the request comes from a person other than the service user, MyBot Ltd may request the information strictly necessary to verify the applicant's identity and identify the concerned data.

When the request concerns data processed on behalf of a professional client, MyBot Ltd may invite the concerned person to contact this client directly or transmit the request to the concerned client when necessary and legally possible. MyBot Ltd cooperates with its professional clients to facilitate the processing of requests to exercise rights under the conditions provided for by applicable regulations.

For individuals located in the United States, rights may include, depending on applicable law, the right to know the categories of personal data collected, used or disclosed, the right to access certain information, the right to request deletion or correction, the right to portability where available, the right to limit certain uses of sensitive data, the right not to be discriminated against for exercising their rights, as well as the right to object to the sale, sharing for purposes of cross-context behavioral advertising, targeted advertising, or certain profiling where these practices exist. MyBot Ltd does not sell personal data and does not share them for purposes of cross-context behavioral advertising. Requests may be verified and, where law provides, be subject to an appeal or review mechanism.

Account deletion and deletion requests may include a safety delay, verification, and manual or automated processing depending on the systems concerned. Deletion remains subject to legal obligations, security, abuse prevention, operational retention rules and technical constraints.

Send an email to <support@alefos.ai> with "Data protection request" as the subject or contact MyBot Ltd. Proof of identity may be requested.

Any request relating to data protection, the exercise of rights or the present policy can be sent to: <support@alefos.ai>. It can also be addressed to the attention of the Data Protection Contact: MyBot Ltd — AlefOS, Ashkelon, Israel. MyBot Ltd may request reasonable proof of identity before processing a request.

AlefOS may ask for the information reasonably necessary to verify identity and locate the relevant data. AlefOS responds within the applicable time limits and may extend the response period where permitted, depending on the complexity or number of requests.

AlefOS is intended for professionals. It is neither designed for minors, nor marketed to them.

AlefOS is designed for professional use. It is not intended for minors. If MyBot Ltd finds that data have been collected in violation of applicable law, it will take appropriate measures to delete them or to restrict access to them without delay.

AlefOS is not intended for children under 13 years old and is not directed towards them. MyBot Ltd does not knowingly collect personal data online from children under 13 years old. If MyBot Ltd learns that such processing has taken place in violation of applicable rules, notably American rules relating to the protection of children's privacy online, it takes appropriate measures to delete or restrict the concerned data.

Only strictly necessary cookies — for authentication and session management. No advertising tracker. Consult our Cookie Policy for more information.

The website and the web application can use cookies, trackers or similar technologies strictly necessary for their functioning, for authentication, for security, for technical measures and for service improvement. AlefOS uses mainly the browser's local and session storage spaces for session management and user preferences. HTTP cookies are used in a limited way. No advertising tracking, third-party analytics or retargeting cookie is used. When applicable law requires it, non-essential trackers will be subject to a specific notification or an appropriate consent mechanism. Consult the Cookie Policy for more details.

AlefOS does not use cookies or trackers to sell personal data, to share them for purposes of cross-context behavioral advertising or to perform advertising retargeting. If such processing were added in the future, they would be subject to specific information and consent, objection or opt-out mechanisms required by applicable law.

Updates to this policy

We will inform you of important modifications. The live version is always available on alefos.ai/privacy.

MyBot Ltd may modify the present Privacy Policy at any time in order to take into account legal, technical, contractual or operational evolutions. The version in force is that published on alefos.ai. In case of important modification, an appropriate notice will be provided in accordance with applicable legislation.

Legal framework

The GDPR, the Israeli law on the protection of privacy and all mandatory local regulations apply, depending on your place of residence and the data processed.

The present policy must be interpreted in light of the applicable legislation regarding data protection, including, where appropriate, Regulation (EU) 2016/679, the applicable Israeli legislation regarding the protection of privacy and all mandatory local rules applicable to professional clients or to concerned persons.

MyBot Ltd also ensures compliance with obligations applicable under the Israeli law on the protection of privacy, as amended, notably regarding security, governance, transparency, rights of concerned persons and, when required, identification of a person in charge of data protection questions.

When persons located in the United States use AlefOS or are concerned by data processed in AlefOS, certain federal or state American laws relating to privacy, consumer protection, electronic communications, protection of children or fair commercial practices can also apply depending on the context, the concerned state, the status of the person, the volume of data processed and the role of MyBot Ltd or the professional client. The present policy must be interpreted in a way compatible with these mandatory rules when they are applicable.

Version: 2.1 consolidated

Last update: July 23, 2026

For any request relating to confidentiality or data protection, please contact us at the address support@alefos.ai with the subject: Privacy request.

WhatsApp and IBOX retention. AlefOS keeps the raw text and semantic envelope of WhatsApp messages stored in IBOX for a rolling period of 120 days, whether or not the message has already been analyzed. Raw ingestion buffers used before IBOX storage remain subject to separate shorter technical windows, currently up to 24 hours for message buffers and 48 hours for session or raw transcript buffers. IBOX bodies from other sources are currently removed after 30 days. Signals, summaries, missions and other structured business-memory outputs are stored separately and are not subject to the 120-day raw-text window; in the absence of another deletion instruction or applicable lifecycle rule, they may be retained without a fixed automatic maximum period as part of the customer's business memory.

Calls, Aircall and recordings. When a customer activates Aircall or another compatible calling connector, AlefOS may receive calling and called numbers, call direction and timing, provider and participant identifiers, transcript, summary, action items, recording or recording-link information, and other call metadata. This content may include complete conversations and potentially sensitive information. The professional customer remains responsible for providing notices and obtaining any consent required for recording or transcription.

CRM documents. AlefOS may store CRM PDF files and related metadata in Amazon Web Services S3 object storage. In the current tenant-template model, uploading, listing, downloading and deleting these files is limited to tenant owners and administrators. If AlefOS later introduces documents private to individual contacts, the applicable access model and this notice will be reviewed before that feature is opened.

Temporary IBOX links. An IBOX sender may create a public link in the form /m/:token so that a recipient can first view a summary and then request the full message without signing in. The link expires no later than five hours after creation. After the first successful reveal, access expires after 20 minutes or at the five-hour deadline, whichever occurs first. The first successful reveal records the message read time (read_at). The URL acts as an access secret: anyone who obtains it may access the available content until expiry or revocation. Recipients should not forward it and should report a leaked or misdirected link immediately.

WhatsApp notifications and objection. When enabled, AlefOS may send an automatic WhatsApp service notification through Meta/WhatsApp containing the recipient's phone number, a short message summary and a temporary IBOX link, but not the complete IBOX message body. Delivery and failure metadata may also be processed. A recipient can object to these IBOX WhatsApp notifications by replying with the exact word STOP or UNSUBSCRIBE. AlefOS records a durable channel suppression for the resolved contact and blocks future notifications unless the contact later makes an unambiguous request to re-enable them.

Team access. Tenant IBOX and calendar content is organized by member. A member normally sees their own assigned space. Owners and administrators may have read-only supervision over non-admin member spaces, while manager supervision requires explicit grants. Owner and administrator member spaces remain private from peer supervision. Group access follows group membership for agents and managers, with explicit owner/administrator read supervision. These controls are intended to replace former flat tenant-wide access patterns and may be supplemented by dispatch or contact-specific grants.

Identity resolution. CRM identity-resolution workflows may store a normalized phone number, source and target contact identifiers, the resolution or ignore reason, the identifier of the person performing the action, and timestamps in order to resolve unknown callers or message participants and prevent duplicate records.

Named providers. Relevant providers include Aircall for activated call ingestion, Meta/WhatsApp for connected messaging and outbound service notifications, and Amazon Web Services S3 for CRM document and other object storage. Processing location depends on the customer's configuration, the provider's service region and AlefOS operational routing. Provider contracts and transfer safeguards apply as required by applicable law.