Privacy Policy

1. Introduction

Welcome to Letstok. We value your privacy and are committed to protecting your personal data. This Privacy Policy outlines how we collect, use, and safeguard your information when you visit our website and use our services.

2. Information We Collect

• Personal Data: We collect personal data that you voluntarily provide to us when you register on the website, fill out a form, or communicate with us. This includes your name, email address, phone number, and other contact information.
• Usage Data: We collect information automatically about your interaction with our website, such as IP addresses, browser type, device information, and pages visited.
• Cookies: Our website uses cookies to enhance user experience, track user activity, and improve our services. You can control cookie settings through your browser.

3. How We Use Your Information

We use the information we collect for various purposes, including:

• Providing and maintaining our services
• Communicating with you about updates, offers, and promotional content
• Improving our website and services through analysis of user behavior
• Complying with legal obligations and protecting our rights

4. Sharing Your Information

We do not sell, trade, or otherwise transfer your personal data to outside parties except:

• When we have your consent
• For processing by our service providers who assist us in operating our website and conducting our business
• To comply with legal requirements, enforce our policies, or protect our rights

5. Data Security

We implement a variety of security measures to maintain the safety of your personal data. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

6. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal data:

• The right to access - You can request copies of your personal data.
• The right to rectification - You can request correction of inaccurate or incomplete data.
• The right to erasure - You can request deletion of your personal data, under certain conditions.
• The right to restrict processing - You can request limitation of data processing, under certain conditions.
• The right to object to processing - You can object to our processing of your personal data, under certain conditions.
• The right to data portability - You can request transfer of your data to another organization, or directly to you, under certain conditions.

To exercise these rights, please contact us at info@letstok.com.

7. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites.

8. AI Models and Automated Processing

Letstok is built on generative AI. Some of our processing is therefore automated in ways that are worth describing specifically rather than leaving to the general language above.

• What is sent to model providers: When you generate content, the inputs you supply — prompts, product URLs, uploaded images, audio, video, brand information — and the outputs produced may be transmitted to third-party AI model providers acting as our sub-processors, for the sole purpose of producing the result you requested.
• Training: We do not use your content to train our own models. We contract with our model providers on terms that prohibit them from training their models on data submitted through our API traffic. If this ever changes for a given provider, we will update this policy and the sub-processor list before that provider is used on that basis.
• Ownership of output: Subject to our Terms, content you generate on a paid plan is yours to use, including commercially. We claim no ownership of your prompts or your outputs.
• Accuracy and human review: AI output can be inaccurate, incomplete, or similar to output generated by others from a similar prompt. It is not legal, medical, financial or other professional advice. You remain responsible for reviewing generated material before you publish it, advertise with it, or send it to a customer.
• Synthetic likenesses and voices: AI actors, avatars, talking images and synthetic voices depict generated or licensed personas. You may not use them to impersonate a real, identifiable individual, to imply an endorsement that was not given, or in any way that a reasonable viewer would take as a genuine recording of a real person, unless you hold the rights to do so.
• Automated decisions: We do not use automated processing to make decisions producing legal or similarly significant effects about you. Where a feature can act on your behalf — publishing a post, launching a paid campaign, replying to one of your customers — the product identifies it as such and it operates under settings you control.
• Your inputs remain yours to withdraw: Deleting an asset or your account removes it from our systems in accordance with Section 12. Where a provider has already processed a request, we cannot recall that transmission, which is why we limit what is sent to what the request needs.

9. Sub-processors

We use third-party service providers to host, operate and deliver the service, including cloud hosting and storage, AI model and media generation providers, payment processing, email delivery, and the platforms you connect your accounts to. These parties process personal data on our behalf, under contract, and only on our instructions.

A current list of the categories of sub-processors, their purpose and their processing regions is maintained on our Security page. We will update that list before engaging a new sub-processor for a materially different purpose.

10. Let's Tok for WhatsApp

Let's Tok is our website-to-WhatsApp customer messaging service. It is operated as a separate service with its own account, plans and billing, and it is governed by its own Let's Tok Privacy Policy and Terms of Service, which take precedence over this policy for that service. The following summarises the points most often asked about.

• Who is responsible for what: Where a business uses Let's Tok to talk to its own customers, that business is the controller of its customers' personal data and Letstok acts as its processor. The business is responsible for having a lawful basis for those conversations and for its own privacy notice to those customers.
• Signing in by phone number: Authentication uses a one-time code delivered to a WhatsApp Business number. We process that number, the device and session metadata needed to keep the account secure, and a record of code requests for rate limiting and abuse prevention.
• Message content: Messages exchanged between a business and its customers — including text, media, and message metadata such as timestamps and delivery status — are processed and stored so the business can see and continue the conversation, and so a human agent can take over from an automated flow.
• Meta as a sub-processor: Let's Tok runs on the WhatsApp Business Cloud API. Message delivery, and the identifiers required for it, are processed by Meta Platforms in accordance with Meta's own terms for that API. We connect a business's own WhatsApp Business Account; the business identity shown to its customers is that business, not Letstok.
• Access tokens: Access tokens for a connected WhatsApp Business Account are encrypted at rest with a dedicated key and are decrypted only by the service component that calls the API on your behalf. Disconnecting the account purges the stored token.
• Automation and escalation: The default automated flow is deterministic and contains no generative model. Where a business enables the optional AI answering layer, Section 8 applies to those replies, and the conversation always retains a route to a human agent.
• No advertising use: We do not use the content of a business's customer conversations to target advertising, and we do not share it with other customers or with advertisers.

11. International Transfers

We are based in Israel and our service providers operate in the European Union, the United States and other jurisdictions. Your personal data may therefore be transferred to, stored in, and processed in countries other than your own. Where required, such transfers are made under an adequacy decision or under appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We do not guarantee data residency in any specific country on our standard plans. If your organisation has a residency requirement, contact us before subscribing.

12. Data Retention and Deletion

We keep personal data for as long as your account is active and for as long afterwards as we need it to meet a legal, accounting or dispute-resolution obligation.

• Deleting your account removes its content from our production systems and revokes the access tokens for every connected account.
• Residual copies may persist in encrypted backups for a limited period before being overwritten in the ordinary backup cycle.
• Billing and tax records are retained for the period required by applicable law, regardless of account deletion.
• You may request deletion of a specific asset or conversation sooner by contacting us.

13. Children

Our services are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: info@letstok.com
Address: Haoman 10, Hadera, Israel, 388501