Privacy Policy

MyBot Ltd operates AlefOS and designs company-branded work OS projects under signed quotations. This policy covers the personal data involved in the website, the commissioned services and authorized professional flows.

The company determines how its business records are used; MyBot processes those records on its behalf and separately handles its own account, billing, commercial and legal purposes. Only connected, transmitted or otherwise authorized sources are processed. An integration may be configured to receive specified flows without a new instruction for each message.

MyBot does not sell personal data, use customer contacts for its own prospecting, share them for cross-context behavioral advertising or train general third-party AI models on customer content. External or committing actions prepared by AI require human validation; configured service messages and internal memory updates are different operations.

People retain their applicable rights whether or not they have an account. Temporary messages, final transcripts, professional memory and backups have different retention purposes. The detailed sections below and the Cookie, Retention and DPA documents describe those distinctions.

MyBot Ltd operates AlefOS. MyBot Ltd is the Data Protection Contact for requests relating to the protection of personal data.

The present privacy policy describes how MyBot Ltd, an Israeli company registered under number 516373891 and whose registered office is located in Ashkelon, in Israel, operating the AlefOS product, processes personal data in connection with its website, its web application and the associated services. Legal contact: MyBot Ltd — AlefOS, Ashkelon, Israel. Email: support@alefos.ai. Data Protection Contact: MyBot Ltd.

In accordance with articles 4, 12 and 13 of the GDPR, when MyBot Ltd acts in the capacity of data controller, it provides the concerned persons with information relating to its identity, the purposes pursued, the categories of data processed, the applicable legal bases, the recipients, the retention periods and the available rights.

When American laws relating to the protection of privacy apply, MyBot Ltd also provides information relating to the categories of personal data processed, the professional or commercial purposes of the processing, the categories of recipients, the applicable rights and the modalities for exercising these rights.

On a Customer-branded interface, the company identified on that interface is responsible for its own business offering and associated data processing purposes. MyBot’s role is determined by the processing concerned. The contact given here is a data protection contact, not a claim that a formal data protection officer has been appointed.

This policy concerns professional customers, administrators, staff, contractors, people mentioned in customer records and visitors or external users of the commissioned interfaces. A person can be concerned without registering or accepting an AlefOS subscription.

The signed quotation defines the OS, interfaces and integrations to be delivered. A project may include a new development. Actual processing starts according to the service’s commissioning, authorized connections and agreed instructions; ordering an integration does not itself begin processing every communication.

Calls, messages, WhatsApp, emails, documents, notes and other professional sources are included only within that authorized scope. Automated intake from an activated source is distinct from general listening to all calls or conversations. Access through an AI assistant is limited by the permissions of the relevant user and company. Independent assistants apply their own policies to information they receive.

For professional records processed on the company’s behalf, the Customer determines the purposes and essential means and MyBot acts as processor under the DPA. If the Customer itself acts for another controller, the agreed processing chain must reflect that role and authority.

MyBot separately acts as controller for its own business relationship, handling demo and quotation requests, account administration, billing, fraud prevention and compliance with its own legal obligations, according to the purpose concerned. Access to a customer record to resolve a support issue remains processing on that Customer’s behalf; administrative support correspondence is a separate purpose. Security processing must likewise be qualified according to its purpose, rather than treated as an unrestricted right to reuse content.

The Customer is responsible for the lawfulness of its sources, instructions and communications. MyBot remains responsible for its own statutory and contractual obligations. These roles do not permit cross-company disclosure or use of Customer Data for MyBot’s own prospecting. Relevant US service-provider, contractor or processor rules apply where their conditions are met.

Principles applicable to the processing of data

MyBot Ltd ensures that personal data are processed in a lawful, fair and transparent manner; collected for determined, explicit and legitimate purposes; adequate, relevant and limited to what is necessary; accurate and, if necessary, kept up to date; kept for a duration not exceeding that necessary for the purposes of the processing; and processed in a manner to guarantee appropriate security.

MyBot Ltd implements data protection measures from the design and by default, in order to limit the processing to the data necessary for the functioning of AlefOS and the associated services.

These principles include also, when applicable American laws require it, reasonably accessible information on the practices of collection, use, retention and disclosure of personal data, as well as the implementation of reasonable security measures proportionate to the nature of the data processed.

What we collect

AlefOS processes only the data necessary for the functioning of the service, according to the functionalities used, the connected sources, the authorizations given and the information transmitted voluntarily by the user or the professional client. According to the cases, AlefOS can process the following categories of data:

a) Identification and contact data: last name, first name, telephone number, email address, postal address, company, job title, contact identifier, technical identifier, account information, user settings, preferences, subscription, billing and exchanges with support.

b) Data resulting from professional flows: calls or call metadata processed via CallOS when the user adds AlefOS to a conference, voluntarily transmits an audio or activates a compatible telephone functionality; written or vocal messages; WhatsApp messages or equivalent services only when they are connected, transmitted, authorized or configured to be processed; activated professional source data when available and authorized; notes, requests, reminders, documents or other professional information transmitted to AlefOS.

c) Audio content and transcriptions: audio content of calls or voice messages when the user transmits the audio, adds AlefOS to a conference or voluntarily activates a processing functionality; transcriptions generated from these contents; extracts or summaries necessary for the structuring of the signal.

d) Data structured by AlefOS: operational signals, missions, reminders, validatable actions, calendar information, mentioned products or services, product files, relational files, active relationship indicators, PION results, business context, GroupOS entries, ProductOS elements and information useful to the user's professional memory.

e) Data relating to non-user contacts: contact details, relational identifiers, minimal context, signals, missions or structured information necessary for the functioning of the client's professional space, notably when a contact is mentioned in a call, a message, a note, an activated source, a connected tool or information transmitted to AlefOS. These profiles do not constitute active user accounts.

f) Technical, security and usage data: technical logs, IP address, session identifiers, browser or device information, system events, diagnostic data, security logs, configuration settings, functionalities used, actions performed in AlefOS, performance data, errors and information necessary for maintenance, security and prevention of abuse.

g) Metadata linked to contents or connectors: source of the information, date and time, technical identifiers, synchronization status, type of content, file size or format, origin of the flow, connector used and information necessary for storage, transfer, deduplication or technical coherence of the service.

AlefOS does not process all these categories for each user. The data effectively processed depend on the functionalities activated, the tools connected, the configuration choices, the exclusions put in place and the actual usage of the service.

The data published in GroupOS correspond to the information that a user or authorized member chooses to publish in an AlefOS group. They can include, according to the published content, business instructions, training, meeting notes, opportunities, errands, protocols, client information or other professional knowledge shared with authorized members of the group.

The ProductOS data correspond to the products, services, services or know-how detected, suggested, confirmed or structured in the user's business catalog. They can come from mentions made in authorized professional flows or from a voluntary entry, then be used for internal research, relational memory, the catalog or an authorized publication/synchronization.

For people located in the United States, these data can correspond, according to the applicable law, to categories such as identifiers, contact details, professional information, commercial or relational information, electronic or network activity information, audio or electronic contents transmitted voluntarily, approximate geolocation data when they are necessary for the service, operational inferences limited to business memory and technical security information. AlefOS does not voluntarily collect these categories in all cases: they depend strictly on the activated sources and the actual usage of the service.

For a bespoke project, relevant data may also include the Customer’s brand configuration, administrator delegations, project orders, acceptance exchanges, external requests and device notification subscriptions where used. A demo request may include professional contact details, business needs and preferred language so that MyBot can respond in the requested language.

Activated call integrations may transmit caller and recipient numbers, timing, direction, participant identifiers, transcripts, summaries, proposed follow-up and recording links. A provider recording link is distinct from a recording stored by AlefOS. CRM document handling may involve the document and its metadata. Identity-resolution records may include normalized contact details, proposed matches, the resolution or ignore reason, the authorized person’s identifier and timestamps. Matches and relationship inferences are not automatically verified facts.

Why we use it

AlefOS uses personal data in order to provide a business OS capable of capturing, structuring, organizing and retrieving useful information resulting from authorized professional flows, transmitted or configured by the user or the professional client. AlefOS does not have the purpose of monitoring the user's entire communications, but of processing the chosen flows, contacts, conversations or sources in order to extract an exploitable business memory. Personal data can notably be processed for the following purposes:

a) to provide, operate, secure, maintain and improve AlefOS;

b) to capture and structure useful information resulting from transmitted or voluntarily processed calls, written or vocal messages, configured WhatsApp contacts or conversations, notes, activated professional sources, connected tools or information transmitted voluntarily to AlefOS;

c) to generate or update operational signals, missions, reminders, validatable actions, relational files, product or service files, calendar events, summaries and business memory elements;

d) to allow the user to retrieve useful information without having to search manually in his calls, messages, agendas, notes or external tools;

e) to help the professional client to ensure the follow-up of his contacts, prospects, clients, collaborators or professional interlocutors, within the limit of his own purposes and responsibilities;

f) to allow the synchronization, organization, display, search, deduplication, technical coherence and the good functioning of the activated connectors or sources;

g) to manage authentication, accounts, sessions, authorizations, preferences, processing exclusions, onboarding, billing, support and requests relating to rights;

h) to send legal, technical, security or service notifications strictly necessary for the functioning of AlefOS;

i) to diagnose errors, maintain the stability of the service, prevent abuse, fraud, unauthorized access, diverted usages or attacks on the integrity of the system;

j) to allow the publication, structuring and search of business knowledge in authorized AlefOS groups, according to the rights of the members and the available publication parameters;

k) to detect, suggest, structure, confirm, search or prepare products and services in ProductOS, notably for the business catalog, relational memory or an authorized product surface or integration when available and validated;

l) to comply with applicable legal, regulatory, contractual, tax, accounting or security obligations. AlefOS does not process data to replace the user in his professional decisions. The missions, reminders, actions or results generated by AlefOS have the vocation to assist the user and, when this is required by the functioning of the service, to be verified or validated by him before execution.

For applicable American laws, these purposes correspond to professional or commercial purposes necessary for the provision of the service, security, prevention of abuse, support, billing, execution of the contract, maintenance, improvement of the service and the provision of functionalities requested by the professional client. MyBot Ltd does not sell personal data, does not share them for purposes of cross-context behavioral advertising, does not use them for targeted advertising and does not use them to train general artificial intelligence models made available to third parties.

The purposes above are allocated according to section 3. MyBot’s own handling of a demo, quotation or support request does not authorize mining the requesting company’s customer conversations for sales opportunities. This policy creates no new permission to exploit customer usage metrics for MyBot’s commercial prospecting; any distinct purpose requires its own assessment, information and applicable legal basis.

The responsible party identifies the lawful basis for each purpose. For MyBot’s own processing, this may be steps requested before entering a contract or performance of a contract with the person concerned, compliance with a legal obligation, a properly assessed legitimate interest such as managing a professional relationship or protecting the service, or consent where required.

A contract signed by a company does not make every employee, prospect or contact a party to it. The Customer determines and documents the basis for its business processing. Legitimate interest is not an automatic basis for every non-user contact; its conditions, necessity and the person’s interests and rights must be assessed. OAuth authorization, acceptance of Terms and confirmation of an action are not interchangeable with data protection consent.

Where consent is used, it may be withdrawn without affecting prior lawful processing. Where legitimate interest is used, applicable objection rights remain available. Laws using different terminology, including relevant US laws, continue to govern the purposes, disclosures and rights within their scope.

A professional may import or record information about a person before that person has an AlefOS account, from an authorized interaction, connected source or direct entry. The resulting company contact record may contain contact details, the origin of the information and the context necessary for that professional relationship. It is not an active user account or authority to access other company records.

The relevant controller provides the information required for indirectly collected data. Any exception must be justified under the applicable rules; this public policy is not a blanket exemption. The person may request the origin of the data, correction, deletion, objection or other applicable rights without registering.

A later registration or submitted identity does not automatically prove a match, transfer a company’s confidential history or authorize access to another company’s records. Any supported matching process must respect identity verification, the relevant permissions and the rights of others. MyBot does not sell these records or turn them into a common prospect database.

Data relating to non-user third parties

In the framework of the use of AlefOS, certain personal data can concern persons other than the user, notably clients, prospects, collaborators, professional interlocutors, service providers, suppliers or other contacts of the professional client.

These data can appear when a professional user enters information in AlefOS, adds a signal, voluntarily processes a call, imports or synchronizes contact details, transmits a written or vocal message, activates a connector, configures certain contacts or WhatsApp conversations or equivalent service, or connects another compatible professional source when available and authorized.

It can notably be a matter of contact data such as name, first name, email address, telephone number, postal address, company, organization, professional function, technical identifier or relational identifier associated with the contact. According to the context, AlefOS can also process information strictly necessary for the business memory of the professional client, such as the context of the relationship, the expressed requests, appointments, reminders, missions, products or services mentioned, operational preferences or elements necessary for professional follow-up.

These data are processed solely within the limit necessary for the functioning of the service, for the purposes determined by the professional client, for the requested synchronization, for the structuring of signals, for deduplication, for the technical coherence of the system, for security and for the exercise of the rights of the concerned persons.

No data imported, generated or structured by a user is made visible to another user, except for voluntary sharing action performed by the concerned user, group or collaboration functionality expressly activated, applicable legal obligation or functionality expressly provided for and brought to the knowledge of the concerned persons.

Data relating to non-user third parties are not used for MyBot Ltd's own commercial prospecting purposes, nor sold to third parties, nor used to constitute a common database of contacts accessible to all users.

When a user publishes information in an AlefOS group via GroupOS, this information becomes accessible to authorized members of the group according to their rights. The professional client or publishing member remains responsible for verifying that they are authorized to share this information with the concerned members, notably when it contains personal data, contact details, client information, confidential information, internal instructions, training, protocols or elements protected by professional or commercial secrecy.

GroupOS has the vocation to allow the sharing of business knowledge and information in a controlled perimeter. For example, a taxi group can serve to share a ride, a manager can publish a sales technique or a meeting note, and a team can consult training or a protocol. If the published content contains a telephone number, an address or client information, the authorized members of the group can access it.

MyBot Ltd does not present itself as a data broker for these data and does not monetize contact lists, relationships, signals or business information created in the professional spaces of its clients. When applicable American laws impose a particular qualification or obligation due to the volume, nature or origin of the processed data, MyBot Ltd reevaluates its obligations and updates the present policy if necessary.

Where the project includes a public catalog or another external surface, the Customer selects what may be published and to whom. Publication of one item does not disclose the full contact file. Temporary IBOX links provide a separate, limited access described in section 16; they do not identify the recipient.

In order to improve the functioning of AlefOS and to avoid duplicates, MyBot Ltd can implement technical mechanisms of deduplication or reconciliation of contact data. These processing operations have for sole purposes to avoid the creation of duplicates, to improve the technical consistency of information, to allow the correct display of contacts, to ensure the good functioning of synchronization functionalities and to strengthen the security and integrity of the service.

These processing operations do not allow a user to access data imported or generated by another user. They are framed by guarantees such as the limitation of purposes, the partitioning of user spaces, the limitation of access, the minimization of processed data and appropriate security measures.

These mechanisms of deduplication or reconciliation are limited to what is necessary for the good technical functioning of the service and do not allow to create a common database of contacts accessible to all users.

A proposed identity match is not proof of identity. Membership in multiple companies or possession of a shared phone number does not itself authorize merging or sharing their records.

AI processing can summarize authorized content, organize professional memory, infer relationship information, suggest catalog entries and prepare actions. Queries, relevant context, corrections and outputs are processed for the commissioned service. Inferences may be incomplete, outdated or wrong and must be checked before important decisions or communications.

Customer content is not used to train general AI models made available to third parties. A feedback, improvement or customization clause does not create an exception to that protection or authorize new unrelated reuse.

Processing by an AI or transcription supplier engaged by MyBot is distinct from data transmitted to an independent assistant chosen by a user. The former follows the agreed processing instructions and supplier safeguards; the latter is also subject to that assistant’s own terms and information. Running an open model internally does not itself transmit content to the model’s publisher.

External or committing AI-prepared actions require human validation. Internal memory updates and configured service notifications are different operations. The system does not provide certified professional advice or, merely through an AI output, a final legal, medical, financial, employment or similar decision.

Professional conversations and free text may contain sensitive information, including data within Article 9 of the GDPR. The service does not solicit those special categories for ordinary use. The Customer must not intentionally process them without an expressly agreed scope and the required lawful basis and safeguards. A budget or financial situation is personal information where identifiable, but is not automatically an Article 9 category.

MyBot does not use sensitive data for targeted advertising, sensitive categorization or training general third-party AI models. No automatic filtering, health-sector certification or suitability for every regulated use is implied. Where relevant US laws impose additional sensitive-data protections, they apply within their scope.

Retention depends on the data category and purpose, not on a single deadline for all professional memory. Raw call audio is retained for the processing need, with any limited legal or incident-related retention assessed separately. A recording held by a provider follows that provider’s arrangements; a stored recording link is a separate item.

For the IBOX retention rules described here, WhatsApp raw text and semantic envelopes have a rolling 120-day window from message creation, including analyzed messages. Other IBOX bodies have a 30-day window. Earlier ingestion buffers have separate windows of up to 24 hours for message buffers and 48 hours for session or raw-transcript buffers. Removing a raw body does not itself remove separately stored metadata, final transcripts, summaries or professional memory.

Final transcripts, relationship records, summaries and missions are kept for the relevant professional purpose and lifecycle, subject to accuracy, minimization, deletion instructions and applicable rights. No automatic age limit is imposed on all such memory merely by analogy with message buffers; this is not a right to retain every item indefinitely. Utility is assessed against the ongoing work, relationship, legal requirements and the rights of people concerned.

Disconnecting a source stops the authorized future connection; it does not necessarily delete previously imported data. Removing an employee’s access is separate from erasing the company’s records. At service end, return, deletion and limited backup retention follow the DPA and the agreed exit conditions. Administrative records retained for MyBot’s own legal obligations are limited to the relevant purpose and period. See the Data Retention page for categories and triggers.

Recipients depend on the commissioned project and the actual processing. Distinguish MyBot’s hosting, authentication, communications, payment and processing suppliers; services contracted by the Customer; independent AI assistants chosen by users; and persons authorized within the Customer’s organization.

An activated calling connector such as Aircall may provide call content and metadata. Meta/WhatsApp may process connected messages and service notifications. AWS S3 may store CRM documents and other objects within the agreed deployment. Those services are not automatically all used for every project. The applicable supplier inventory identifies the legal entity, service, data, location and safeguards; software names such as Whisper or FreePBX do not by themselves identify a third-party recipient.

MyBot limits supplier access to the necessary service and applies the DPA’s subprocessor requirements. It does not sell personal data or authorize suppliers to use Customer Data for independent advertising. Disclosures legally required by authorities or needed for the lawful protection of rights remain limited to the applicable purpose. See the Subprocessors page and the project processing description.

The project’s processing description identifies the locations relevant to storage, computation, backups and remote support. These may differ. Customer branding or a European storage region does not by itself mean that no data are processed or accessed from another country.

Transfers subject to data protection requirements must use a valid applicable mechanism, such as an adequacy decision or appropriate contractual safeguards, with any necessary additional measures. MyBot provides information about the applicable safeguards on request. A planned hosting migration is not presented as completed and does not itself change the location commitments in the Customer’s agreement.

MyBot applies appropriate technical and organizational measures for the relevant service and risks, including applicable authentication, permissions, access limitation and protection of communications. The Security page and project processing description specify the relevant scope. No system is free from risk and a target architecture is not a security certification.

For the temporary IBOX link service, anyone holding the secret URL may view the available summary and reveal the message without signing in, until expiry or revocation. The maximum duration is five hours after creation; after the first successful reveal, access ends after twenty minutes or at the five-hour deadline, whichever comes first. The reveal records an access/read timestamp but does not verify the person’s identity. Do not forward the link; report a leak or wrong recipient promptly.

Security incidents and personal data breaches are handled under the parties’ respective duties. When MyBot processes data on a Customer’s behalf, its notification duty is the one described in the DPA; it is distinct from the controller’s notifications to authorities and individuals.

If you are a business using AlefOS

You are master of the relationship with your contacts, as well as the legal responsibilities that result from it. AlefOS provides the infrastructure; you decide on its use.

Professional clients using AlefOS as data controllers remain solely responsible for: a) the lawfulness of the initial collection of personal data; b) the notification to the concerned persons when this is required; c) the determination of the legal bases applicable to their own activities; d) the processing of requests for rights relating to the processing for which they are responsible; e) the choice of calls, contacts, conversations, sources or connectors that they transmit, activate or exclude in AlefOS; f) compliance with local rules governing the recording of calls, solicitation, electronic communications and practices regarding client relations.

The professional client must ensure that the use of AlefOS remains compatible with the purposes that it has determined, with the information communicated to the concerned persons and with the rules applicable to its sector of activity.

The professional client also remains responsible for verifying that the addition of AlefOS to a conference call, the transmission of audio content, the sending of electronic communications, the retention of information relating to its contacts, the use of signals generated by AlefOS, the publication of information in an AlefOS group and the validation of products or services in ProductOS are authorized with regard to the rules applicable to its activity, to its country of establishment and to the concerned persons.

The professional client remains responsible for informing its own contacts when applicable law requires it, notably regarding the recording of calls, indirect data collection, commercial communications and the use of relational tracking tools. MyBot Ltd provides documentation and technical means intended to facilitate this information, without substituting itself for the professional client for the processing operations for which the latter determines the purposes and essential means.

When the professional client uses GroupOS, it remains responsible for the contents published by it or under its authority, for the choice of invited members, for the reading or publication rights granted and for the lawfulness of the sharing of data within the group. When the professional client uses ProductOS, it remains responsible for the accuracy of the confirmed products or services, for their compliance with its real activity and for the publications or synchronizations that it validates towards third-party services.

For users located in the United States or in relation with persons located in the United States, the professional client remains notably responsible for compliance with the rules applicable to recorded or assisted calls, to electronic communications, to SMS, to solicitation, to automated calls, to information obligations and to consents required by applicable federal or state laws. AlefOS does not constitute, by its sole provision, a service of robocall, autodialing or SMS marketing: the user chooses the communications, sources and processing operations that it activates.

An owner or administrator role represents authority within the organization, not personal ownership of its history. Removing a member’s access and reassigning work must be distinguished from the person’s rights to access, correct or request deletion of their personal data. Professional records are not automatically erased because an employee leaves.

In the member-based IBOX and calendar access model described for AlefOS, members normally see their assigned space. Owners and administrators may have read-only supervision of non-admin member spaces; manager supervision requires explicit grants. Owner and administrator spaces remain protected from peer supervision. Group access follows membership and the applicable owner/administrator read supervision. The project’s permissions determine the scope; being an administrator is not a statement that every administrator can read everything.

For the CRM document template scope, upload, listing, download and deletion are restricted to owners and administrators. This does not announce a separate private-contact document service. Different document permissions for a bespoke project must be defined in its agreed processing and access description.

Analysis, personalization and technical profiling

MyBot Ltd may analyze certain technical signals, usage signals, configuration parameters, interactions with AlefOS and contextual data in order to provide the requested functionalities, personalize the user experience, improve system performance, strengthen security and propose functionalities adapted to the user's needs.

These operations may involve an automated analysis of certain usage behaviors or technical preferences, notably in order to adapt the display, the parameters, the automations or the results provided by certain functionalities. Unless otherwise indicated, these processing operations are not intended to produce legal effects regarding the user nor to affect him significantly on the sole basis of a fully automated decision within the meaning of Article 22 of the GDPR.

AlefOS may classify, summarize, prioritize or propose actions based on processed signals, but these results are intended to assist the user and not to produce, by themselves, a legal, financial, medical, employment, credit, insurance, housing decision or an equivalent decision significantly affecting a person. When applicable American laws impose information, assessments, rights of objection or appeal mechanisms regarding certain automated processing or profiling, MyBot Ltd implements them to the extent that these laws apply to the concerned service.

Personalization for the Customer’s work is distinct from MyBot using usage metrics to pursue its own sales opportunities. This policy does not authorize the latter by calling it service improvement. It does not itself establish that every intended human-control measure is implemented on every bespoke interface.

The available settings follow the interfaces delivered and the user’s permissions. Stopping future analysis, disconnecting a source, withdrawing a share, removing a member and deleting a particular item are separate requests. None should be understood as automatically erasing all previously derived professional memory. Legal rights remain exercisable even where an interface has no dedicated button.

When IBOX WhatsApp service notifications are enabled, they may transmit the recipient’s number, a short summary and temporary link through Meta/WhatsApp, rather than the complete IBOX body. Delivery and failure metadata may be retained for the service. Replying with the exact word STOP or UNSUBSCRIBE records an objection for the resolved contact and blocks further notifications on that channel unless the person subsequently makes an unambiguous request to re-enable them. This is distinct from cookie consent and from deleting a customer record.

Applicable rights may include access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a competent authority, as well as protections concerning solely automated decisions. These rights are available to current or former members, visitors and non-users within their legal scope. Company export rights are separate from individual data rights.

Contact support@alefos.ai. MyBot handles its own controller requests and informs and assists the relevant Customer for data processed on its behalf, without requiring an active account or sending the person through a circular referral. Verification is proportionate to the request; a full identity document is not automatically required.

Where the GDPR applies, the relevant controller responds without undue delay and within one month, with a possible two-month extension for complexity or number of requests, informing the person of the extension and reasons within the first month. A refusal also explains the reasons and available complaint or judicial remedies. Applicable US rights, including any verification, appeal and non-discrimination requirements, remain available in their respective scope. Technical procedures do not replace legal time limits.

Write to support@alefos.ai with a subject such as Privacy Request and enough context to locate the relevant company and data. Registration is not required. Do not send passwords, tokens, API keys or unnecessary copies of entire conversations. Any further identity check must be necessary and proportionate. MyBot Ltd is the data protection contact at Ashkelon, Israel.

AlefOS is intended for professionals. It is neither designed for minors, nor marketed to them.

AlefOS is designed for professional use. It is not intended for minors. If MyBot Ltd finds that data have been collected in violation of applicable law, it will take appropriate measures to delete them or to restrict access to them without delay.

AlefOS is not intended for children under 13 years old and is not directed towards them. MyBot Ltd does not knowingly collect personal data online from children under 13 years old. If MyBot Ltd learns that such processing has taken place in violation of applicable rules, notably American rules relating to the protection of children's privacy online, it takes appropriate measures to delete or restrict the concerned data.

Professional use does not guarantee that customer records contain no information about minors. Any such processing remains subject to the applicable protections and the agreed service scope; an external interface does not automatically authorize offering a service to children.

AlefOS uses cookies, localStorage, sessionStorage and similar browser technologies for authentication, sessions, security and interface preferences. These necessary functions are separate from optional audience measurement.

Google Analytics 4 is loaded only after you accept analytics cookies. It measures how the site and application are used, including page views, navigation and the usage events described in the Cookie & Session Policy. The _ga and _ga_<container-id> cookies are set only after consent. Your analytics choice is recorded for a maximum of 13 months, after which you are asked again. The lifetimes of the analytics cookies and details of Google's processing are described separately in the Cookie & Session Policy.

You can accept or refuse analytics cookies and change your choice through “Manage cookies” in the footer or on the Cookie & Session Policy page. Google sign-in and Firebase authentication are separate from analytics consent.

AlefOS does not use advertising cookies or retargeting pixels. It does not use these technologies to sell personal data or share them for cross-context behavioral advertising.

This policy is updated to reflect changes in the services and personal data processing. Material changes are communicated as required by applicable law. A new processing purpose is subject to the necessary information and, where required, consent.

Legal framework

The GDPR, the Israeli law on the protection of privacy and all mandatory local regulations apply, depending on your place of residence and the data processed.

The present policy must be interpreted in light of the applicable legislation regarding data protection, including, where appropriate, Regulation (EU) 2016/679, the applicable Israeli legislation regarding the protection of privacy and all mandatory local rules applicable to professional clients or to concerned persons.

MyBot Ltd also ensures compliance with obligations applicable under the Israeli law on the protection of privacy, as amended, notably regarding security, governance, transparency, rights of concerned persons and, when required, identification of a person in charge of data protection questions.

When persons located in the United States use AlefOS or are concerned by data processed in AlefOS, certain federal or state American laws relating to privacy, consumer protection, electronic communications, protection of children or fair commercial practices can also apply depending on the context, the concerned state, the status of the person, the volume of data processed and the role of MyBot Ltd or the professional client. The present policy must be interpreted in a way compatible with these mandatory rules when they are applicable.

For any request relating to confidentiality or data protection, please contact us at the address support@alefos.ai with the subject: Privacy request.

The Data Processing Agreement sets out the obligations for personal data processed on the Customer’s behalf. The Data Retention, Subprocessors and Security pages describe the corresponding arrangements. The Cookie & Session Policy explains browser storage and the available choices.