Privacy

Privacy Policy

OMAI · OMAI Software Ltd. · Company No. 517341764 · Version 2.0 · Effective: July 2026

This policy explains how OMAI handles information in the course of providing our smart business WhatsApp assistant. OMAI is a platform that lets a business connect its WhatsApp Business account and receive automated, AI-powered replies to incoming messages. OMAI is operated by OMAI SOFTWARE LTD.

Scope

This policy covers the OMAI website, the OMAI application, and the assistant service. It describes how OMAI handles information both for its own purposes and on behalf of business customers. It does not cover a business customer’s own privacy practices, nor third-party services you may use separately.

Our role: controller and processor

OMAI’s role differs by activity. For a business owner’s own information (account, contact details, billing, security) OMAI is the controller. For the message content of a business’s end customers, OMAI acts as a processor on the business’s behalf and under its instructions. Some providers we use (for example the payment provider and the sign-in provider) act as independent controllers for parts of their own processing. The business is responsible for giving notice to, and where required obtaining consent from, its own customers.

Where information comes from

From you — when you sign up, contact us, configure the assistant, or pay.
From your organization — colleagues who invite you or add business information.
From business customers — when OMAI processes their end customers’ messages on their behalf.
From Meta / WhatsApp — inbound messages, media, the sender’s WhatsApp id and phone number, and delivery status.
From Google — verified email, name and avatar if you sign in with Google.
From Grow (our payment provider) — the result of a payment, a payment token and card last-4 digits.
From Twilio — carrier line and delivery information for managed numbers.
From your device — IP address and basic browser information.
From uploaded documents and customer communications, and data we derive (usage records and AI-processing metadata).

What information we process

Business owner account details: name, email, organization name, and permissions.
WhatsApp connection identifiers: WhatsApp Business Account ID (WABA ID), Phone Number ID, and the business phone number.
Phone numbers of end customers who contact the business.
The content of incoming and outgoing WhatsApp messages, including media, voice notes, images and documents.
Business information added to the knowledge base (hours, services, prices, FAQs, uploaded documents).
Billing details: billing contact, an encrypted payment token, card last-4/brand, and invoice records. We do not store full card numbers.
Usage data, operational logs, audit records, and security/billing metadata.

Why we process it

To provide the WhatsApp assistant: receiving messages, generating and sending replies, and managing the shared inbox.
To let a person from the business take over a conversation, and to tag and track inquiries worth following up.
For security, fraud prevention, billing, and to meet legal obligations.

We do not sell personal data, and we do not use message content to train AI models or for advertising.

How the AI works with your data

OMAI uses Microsoft’s Azure OpenAI Service (not the public OpenAI service) to generate replies and to create search embeddings of your business knowledge.
To produce a reply, the incoming message, recent conversation history and relevant business information are sent to the model. The assistant is instructed to answer from your business information and not to invent prices, availability or policies.
Under Microsoft’s Azure OpenAI terms, your content is not used to train Microsoft’s foundation models; Microsoft may process content for abuse monitoring under its own terms.
We keep AI processing records for operating and improving the service, but those records store technical metadata (such as token counts and which knowledge was used) — not the text of the message or the reply.
AI replies are generated automatically. A person from the business can take over a conversation at any time, and the assistant hands off when a customer asks for a person, sounds frustrated, or raises a sensitive topic.

WhatsApp and Meta

OMAI operates the assistant on the WhatsApp Business Platform (Cloud API) provided by Meta. For messages between a business and its customers, OMAI acts on the business’s instructions as its processor, while Meta handles message delivery under its own terms. When a business disconnects its number, or Meta suspends access, OMAI stops processing new messages for that number.

If you messaged a business that uses OMAI

If you are a WhatsApp user who contacted a business using OMAI, the business you contacted is responsible for your conversation as the controller. To access, correct or delete that conversation, please contact that business directly. OMAI will assist the business with your request where appropriate and where OMAI is not itself the controller of that data.

Subprocessors

Meta Platforms — WhatsApp Business Platform / Cloud API, to receive and send messages.
Microsoft Azure — hosting, database, object storage, search, telemetry and secret storage.
Azure OpenAI (Microsoft) — AI reply generation and embeddings. Content is not used to train Microsoft’s foundation models.
Twilio — carrier phone numbers, message transport and one-time-code delivery for managed numbers.
Grow (Meshulam) — hosted checkout and recurring billing (Israeli card processing).
Google — optional “Continue with Google” sign-in, and OMAI’s own support mailbox.

International transfers

OMAI SOFTWARE LTD is an Israeli company and hosts its systems on Microsoft Azure. Some subprocessors and their infrastructure (for example Meta, Google, Twilio and source-control/CI systems) operate outside Israel, including in the United States and the EEA. Where personal data is transferred internationally, we rely on the recipients’ data-protection terms and the legal transfer mechanisms applicable to each.

Retention and deletion

We keep conversation and message data while your account is active, or as you configure.
When you request deletion, we suspend processing on the account and our team removes your data from our active systems; we aim to complete this within 30 days of verifying the request.
Some data may persist in routine encrypted backups until they age out, and billing and tax records are retained as required by law.
Operational and security logs are kept for limited periods.

Security

Data is encrypted in transit and at rest. WhatsApp and other provider access tokens are stored in Azure Key Vault rather than in our database, and the payment token is encrypted at rest. Access is restricted by role-based permissions and audit-logged, and inbound webhook signatures from Meta are verified so that forged messages are rejected. Message content and phone numbers are kept out of routine logs. No online service can be guaranteed to be perfectly secure.

Your rights

Access and export your data from the dashboard, and request deletion of your data at any time.
Ask us to correct your information, and object to or restrict processing where applicable.
Disconnect the WhatsApp connection at any time from the dashboard.

To exercise your rights, contact us or go to Settings → Account & privacy in the dashboard. Requesting account deletion suspends processing on the account, so export any data you want to keep first. We verify requests and reply from our support mailbox; we do not send automated confirmation emails.

Sensitive information

Because a business can use OMAI for any purpose, WhatsApp messages and uploaded documents may contain sensitive information (for example health, financial or identity details) even though OMAI does not ask for it. Please do not send information you are not authorized to share, and businesses must not upload data they are not permitted to process. Sensitive information receives the same protections described in this policy.

Children

OMAI is a business tool intended for businesses and adults, and is not directed to children. We do not knowingly collect personal information directly from children through our website or dashboard. Any handling of children’s information within a business’s conversations is the responsibility of that business.

Cookies, analytics and advertising

Our website and app use strictly-necessary cookies to run the service (such as keeping you signed in, protecting against abuse, remembering your language and storing your privacy choices). Optional analytics and advertising technologies load only if you allow them: a consent banner lets you accept, reject, or choose per category, and you can change or withdraw your choice at any time from the "Cookie preferences" link in the footer. Rejecting optional technologies is as easy as accepting and never limits access to the site, signup, login, legal documents, support or core features. We never send WhatsApp message content or customer conversation data to analytics or advertising providers. Our Cookie Policy lists exactly what is used.

Changes to this policy

We may update this policy. Material changes will be reflected here with a new version number and effective date, shown at the top of this page.

Complaints

If you have a privacy concern, please contact us first at the address below. You may also contact the Israeli Privacy Protection Authority. Depending on where you are located, other supervisory authorities may apply.

Contact

For privacy questions or requests: support@omai-software.com