Privacy Policy

Last Updated: July 12, 2026

Introduction

Gambot ("we", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when using our services.

1. Data Accessed

Google User Data:

  • Google Account Information: When you sign in with Google, we access your email address, name, and profile picture for authentication purposes only.

Business Data We Collect:

  • Contact information: name, email, phone number
  • WhatsApp Business API credentials
  • Customer contacts and conversation history
  • Campaign and template data
  • Payment information (tokenized - we do NOT store full credit card numbers)
  • Usage analytics and logs

2. Data Usage

We use your data to:

  • Provide and maintain our WhatsApp Business management services
  • Authenticate your account and prevent unauthorized access
  • Process your campaigns and message templates
  • Store and manage your customer contacts securely
  • Process payments and maintain billing records
  • Send you service updates and important notifications
  • Improve our services through analytics
  • Comply with legal obligations

Google User Data Specific Use: We use your Google account information solely for authentication. We do NOT access, read, or process your Gmail, Drive, or other Google services data.

2a. Meta Platform Data (Facebook)

Gambot uses Meta Platform APIs, including the WhatsApp Business API and Facebook Lead Ads API, in accordance with the Meta Platform Terms.

leads_retrieval — Retrieving Leads from Facebook Lead Ads:

  • What we access: When a business connects a Facebook Lead Ads form to their Gambot account, we access lead data (such as name, email, and phone number) submitted by users through Facebook Lead Ads forms, with the user's consent, via Meta's official APIs.
  • Purpose: Lead data is automatically transferred to the business's CRM within Gambot and is used solely for managing and following up with potential customers.
  • Storage: Lead data is securely stored within the organization's account and is not shared with third parties.
  • Deletion: Lead data can be deleted at any time via the Gambot interface or by contacting us at info@gambot.co.il.

Important: We do not use Meta Platform Data for advertising, sell it to third parties, or use it for any purpose not described in this policy. Use of Meta Platform Data is subject to Meta Platform Terms.

3. Data Sharing

We share your data with:

  • Meta/WhatsApp: To send and receive WhatsApp messages on your behalf through the official WhatsApp Business API.
  • Payment Processors (Tranzila): For secure payment processing. We only share necessary payment information and receive tokenized payment data (no full credit card numbers).
  • Cloud Service Providers (Google Cloud/Firebase): For secure data storage and hosting. All data is encrypted at rest and in transit.
  • SMS Providers (if enabled): For SMS fallback services, only if explicitly enabled by you.

We do NOT:

  • Sell your personal data to third parties
  • Share your data for advertising purposes
  • Use your Google user data for any purpose other than authentication
  • Access your Google services (Gmail, Drive, etc.) beyond authentication

4. Data Storage & Protection

Security Measures:

  • Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256).
  • Authentication: We use Firebase Authentication with Google Sign-In for secure access control.
  • Payment Security: We are PCI-compliant. Credit card data is tokenized by Tranzila - we never store full card numbers.
  • Access Control: Role-based access controls ensure users only see their authorized data.
  • Monitoring: Continuous security monitoring and logging for suspicious activity.
  • Backups: Regular automated backups with encryption.

5. Data Retention & Deletion

Data Retention:

  • Active Accounts: Data is retained for as long as your account is active and for legitimate business purposes.
  • Inactive Accounts: After account closure, data is retained for 30 days for recovery purposes, then permanently deleted.
  • Billing Records: Maintained for 7 years as required by Israeli tax law.
  • Conversation Logs: Retained for up to 2 years for service quality and compliance.

Your Right to Delete Data:

  • You can request deletion of your personal data at any time by contacting us at: info@gambot.co.il
  • We will process your request within 30 days
  • Some data may be retained if required by law or for legitimate business purposes
  • You can revoke Google Sign-In access at any time through your Google Account settings

6. Your Rights

Under GDPR and Israeli Privacy Protection Law, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Object to processing of your data
  • Data portability
  • Withdraw consent at any time

7. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

8. Children's Privacy

Our services are not intended for children under 18. We do not knowingly collect data from children.

9. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through the platform.

10. Contact Us

For any privacy-related questions or requests, contact us at:

Google API Services User Data Policy Compliance

Gambot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only request the minimum Google user data necessary for authentication (email, name, profile picture)
  • We do NOT access, use, or transfer any other Google user data
  • We do NOT use Google user data for advertising
  • We do NOT allow humans to read Google user data unless required for security, compliance, or with explicit user consent
  • All data handling complies with Google's Limited Use requirements