1. Our roles and who this policy covers
PAKA determines the purposes and means of processing personal data for its own account administration, business relationships, billing, support, website operation, security and legal compliance. For that processing, PAKA is the controller, or the equivalent responsible entity under applicable law. This includes information about Business owners and representatives, authorized users, prospective customers and people who contact PAKA.
When we operate a Canvas, customer conversation, transaction workflow or other enabled feature on a Business’s instructions, we generally process the related personal data on that Business’s behalf. The Business is generally the controller and PAKA is its processor or holder, as applicable. We refer to this information as “Business Customer Data”. The DPA governs that processing.
We may separately process limited account, transaction, security or legal records for our own lawful purposes. This does not permit us to treat all Canvas conversations or customer content as our own data.
If your request concerns a Business’s Canvas or customer records, please contact that Business first. You may also contact us if you need help identifying the responsible Business or believe PAKA’s own processing is involved.
2. Information we process and where it comes from
The information involved depends on how you use the Services and which features a Business enables.
Account and business details. Names, business contact details, business or brand name, legal and billing details, account identifiers, authentication information, team membership, roles, permissions and account settings. We receive these from account owners, authorized users and connected authentication services where used.
Content and configuration. Product and service information, prices, policies, knowledge-base materials, prompts, agent instructions, uploaded files, images, video, audio, course materials and generated output. Such content is personal data only to the extent it relates to identifiable individuals. We receive it from Businesses, their users and enabled integrations, and generate output when providing the Services.
Customer interactions and transactions. Contact details, enquiries, conversation history, submitted files, orders, payment status and transaction references, refund and dispute information, bookings, enrolment, course progress, access entitlements and support requests. We receive this information from Canvas visitors, the Business and services connected for the relevant workflow.
Billing and payment records. Billing contacts and addresses, business and tax details where needed, subscription and usage records, invoices, transaction totals, commission calculations, payment status, refunds, disputes and payment-provider references. For enabled payment services, necessary onboarding, account and transaction information may be exchanged with the relevant provider, including verification status, customer contact details, order information and instructions needed to process or reconcile payments and refunds. Payment credentials must be entered through the designated payment-provider flow, not in an agent conversation. The information PAKA receives depends on the arrangement and can include tokens, transaction identifiers and limited payment-method details. Providers may collect additional verification or payment information directly under their own notices. The providers and their roles are described in Section 6.
Communications and voice. Messages, support correspondence, onboarding responses, feedback and survey responses. Where a voice feature is used, processing can include audio, transcripts, generated speech and associated conversation records. A recording or transcript may contain personal data about speakers or other people mentioned. See Section 5 for voice and AI processing.
Technical and usage information. IP address, browser and device information, timestamps, authentication events, pages and features used, diagnostic and security logs, account activity and information collected through cookies or similar technologies. We collect this through operation of the websites and Services. See Section 10.
Connected-service information. Data exchanged with payment, calendar, invoicing, communications, analytics, media and other services a Business chooses to connect. The categories depend on the integration and the permissions granted. We may also receive relevant verification or fraud-prevention results from providers involved in an enabled service.
3. Whether you must provide information
Providing personal data to PAKA is generally voluntary. Unless we identify a specific legal requirement when collecting it, you are not legally required to give it to us. However, we need certain information to create or administer an account, authenticate a user, provide a requested feature, respond to an enquiry or process a payment. If you do not provide that information, we may be unable to provide the relevant service or complete the request.
A Business determines what information it needs from its own customers and must explain the purposes, recipients, whether provision is mandatory or voluntary, and the consequences of declining. Additional notices may be provided at collection, including for recordings, tracking or particularly sensitive uses.
Please provide only information needed for the relevant purpose. Do not submit payment security codes, passwords belonging to other services, unnecessary identity documents, or sensitive or specially regulated information through ordinary prompts or uploads.
4. Why we use information and the applicable legal basis
We use personal data for the following purposes:
- Providing and administering the Services: creating accounts, managing authorized users and settings, operating enabled features, maintaining customer access and supporting connected workflows.
- Carrying out Business instructions: processing customer interactions, content, transactions, bookings and other Business Customer Data as specified in the DPA.
- Billing and administration: calculating charges, managing subscriptions and usage, issuing invoices, handling payment enquiries and maintaining required business records.
- Support and service communications: responding to requests and sending operational, account, security and legal notices.
- Security and integrity: protecting access, investigating misuse or incidents, preventing fraud and enforcing lawful service restrictions.
- Maintenance and improvement: diagnosing faults, assessing performance and improving usability. Processing of Business Customer Data remains limited by the Business’s instructions and the DPA; this purpose does not authorize independent advertising or general-purpose AI training on that data. We may use genuinely anonymized and aggregated operational information where individuals and confidential business information cannot reasonably be identified, and we will not attempt to re-identify it.
- Marketing: communicating about PAKA’s products and services where lawful, with the consent required for the relevant channel and an effective way to opt out.
- Legal obligations and claims: complying with applicable duties, responding to valid legal requests and establishing, exercising or defending legal claims.
For processing governed by Israeli law, we rely on the consent or statutory authorization required for the particular activity and respect the purposes for which information was lawfully collected. This notice is not, by itself, consent to every optional activity, recording, disclosure or marketing communication.
Where the EU GDPR, UK data-protection law or another law requiring a specified processing basis applies to PAKA’s own processing, the relevant bases are:
- Contract: processing objectively necessary to provide services you personally contract for, or to take steps you request before entering that contract.
- Legitimate interests: administering a relationship with the Business you represent, providing support, maintaining and improving our Services, and protecting their security, where those interests are not overridden by your rights. We do not use this basis to bypass a legal consent requirement.
- Legal obligation: maintaining legally required records and meeting duties applicable to us.
- Consent: optional processing for which consent is required, including relevant marketing or non-essential tracking.
For Business Customer Data, the Business is responsible for establishing the lawful basis for its processing; our instructions-based processing is governed by the DPA. Where we rely on consent, you may withdraw it by contacting us or using the relevant control. Withdrawal does not invalidate earlier lawful processing and may affect the feature that depends on that consent.
5. AI, automated actions and voice
PAKA uses AI models and related providers to deliver enabled features. Relevant prompts, instructions, business content, files, customer messages, audio, transcripts and contextual information may be processed to produce responses or media, organize content, support learning features, summarize activity, generate recommendations or carry out authorized business workflows. Generated summaries, recommendations and inferred preferences can themselves be personal data.
Automated actions may use the information supplied, the Business’s policies and settings, transaction state and permitted agent instructions. Depending on the enabled feature, an action can affect an order, discount, booking, cancellation, refund or access entitlement. AI output may be inaccurate. Businesses must review material settings and outcomes, provide appropriate disclosures and maintain a reachable human contact for customer issues.
Solely automated decisions with legal or similarly significant effects require any legal basis and safeguards prescribed by applicable law. The responsible Business must provide any additional explanation and rights required for its use. Contact the Business to question an outcome or request human review; contact PAKA where the decision concerns PAKA’s own processing. We will handle requests and assist the Business as required by applicable law and the DPA.
For the browser-based voice feature, audio is transmitted from the browser to OpenAI to process the conversation and generate responses. PAKA retains text transcripts and related conversation records rather than storing an audio recording of that interaction. This does not mean that the voice provider retains no data: OpenAI may retain relevant content in abuse-monitoring logs, normally for up to 30 days, subject to applicable legal exceptions and the service-specific data controls. This provider retention is separate from PAKA’s transcript retention under Section 9. Required notices and permissions must be provided before recording or other consent-dependent processing begins. The Business is responsible for those requirements for conversations it operates; PAKA remains responsible for its own duties.
Our Terms and DPA do not permit us to train general-purpose AI models on non-public Business Content or Business Customer Data, or authorize our model providers to do so. A different use would require a separate, specific opt-in from an authorized Business representative and a lawful basis and required permissions for affected individuals. Providers’ permitted service-related processing remains subject to the relevant data-protection terms.
6. Who receives information
We disclose information only for applicable purposes described in this policy and subject to required permissions and safeguards. Recipients may include:
- Service providers and subprocessors: hosting, storage, AI, communications, support, security, analytics, billing and other providers used for the relevant service. Providers processing on our behalf are subject to appropriate contractual restrictions. Section 7 explains subprocessors handling Business Customer Data.
- The relevant Business and authorized users: customer interactions and records are available to the Business operating the Canvas and people it authorizes, according to the relevant functionality and permissions.
- Connected services: providers selected by a Business to receive information or perform an enabled workflow. These providers may act independently under their own arrangements. Disconnecting an integration does not automatically delete information already lawfully received by that provider.
- Payments for PAKA’s Services: HYP is used for Israeli billing and Paddle for international billing. Where Paddle is presented at checkout as the reseller and merchant of record, Paddle processes information for that purchase, including payment, tax, invoicing, refund and dispute administration, under its own terms and privacy notice. PAKA receives the information needed to provide access, administer the account and reconcile the purchase.
- Payments to a Business through its Canvas: PayMe is used for the Israeli payment arrangement. For international payments, the Business connects its own Stripe account. Necessary account, customer, order and transaction information is exchanged to provide the enabled payment functions. These customer-payment arrangements are separate from payment of PAKA’s own service fees.
- Payment-provider roles: HYP, Paddle, PayMe and Stripe may act as independent controllers for their own legal, financial, verification, fraud-prevention or other disclosed purposes, and as processors for particular services where the applicable arrangement so provides. Their role depends on the activity and contract; they are not automatically PAKA’s subprocessors. Their own privacy notices describe their processing: HYP (https://hyp.co.il/privacy-policy/), Paddle (https://www.paddle.com/legal/privacy), PayMe (https://payme.io/privacy/) and Stripe (https://stripe.com/privacy).
- Professional advisers: lawyers, accountants, auditors and other advisers where necessary and subject to applicable confidentiality duties.
- Authorities and parties to legal matters: where disclosure is required or otherwise lawfully justified for compliance, legal claims or protection of rights and safety. We limit disclosure to what is appropriate for the request or purpose.
- Participants in a corporate transaction: where necessary for a proposed or completed financing, reorganization, merger or asset transfer, subject to confidentiality, lawful disclosure and continued data protection.
Content a Business intentionally publishes is available to its intended audience and, where publicly accessible, may be viewed or indexed by others. Private customer records do not become public merely because the Business uses them to operate an agent.
We do not sell Business Customer Data or use it for our independent advertising under the DPA. We do not sell personal data for money.
7. Subprocessors
PAKA uses service providers to process Business Customer Data on the Business’s behalf. The providers used depend on the enabled feature and processing route; not every provider receives every interaction.
- Amazon Web Services (AWS): cloud hosting and compute, S3 file storage, SES email delivery, CloudWatch logging and related infrastructure services.
- MongoDB Atlas: managed database services for platform and customer records.
- Twilio: delivery of WhatsApp communications, including gift messages, where that feature is enabled.
- Anthropic: AI model processing.
- OpenAI: AI model processing, including the browser-based voice feature described in Section 5.
- Google: AI model processing.
AI providers may receive relevant prompts, instructions, business content, files, conversations, audio or transcripts, outputs and technical metadata needed for the enabled feature. Use may be through a direct service or an infrastructure provider, depending on the relevant arrangement.
The providers and functions listed in this section, together with the primary hosting locations described in Section 8, identify the processing arrangements covered by this policy. Our DPA requires PAKA to disclose the relevant provider identities, functions and processing locations to the Business before a subprocessor processes its personal data. Contact info@paka.ai with questions about the arrangements for your Services. Under our standard DPA, PAKA gives at least 30 days’ advance notice of a new or replacement subprocessor processing Business Customer Data, with the objection and termination rights described there. We impose appropriate written obligations and remain responsible as provided in the DPA.
A Business-selected integration or independent payment provider is classified according to its actual function and contractual role, rather than automatically treated as our subprocessor.
8. International processing
PAKA is an Israeli company. Primary application hosting and the AWS S3, SES and MongoDB Atlas services described above are configured in the Frankfurt, Germany region. This does not mean all processing remains in Germany: AI inference, provider operations, support access and connected payment or communications services may involve processing elsewhere. Under the DPA, PAKA must provide the Business with relevant processing-location information and implement applicable transfer safeguards before that processing begins. Cross-border access or processing is subject to the safeguards below.
Cross-border processing is subject to applicable transfer requirements. For transfers governed by Israeli law, this includes a permitted transfer basis and the required recipient commitments, including conditions governing onward transfers. For restricted transfers governed by EU or UK law, an applicable adequacy decision or another lawful safeguard must cover the transfer. Where contractual transfer safeguards are needed, they must be implemented for the actual transfer; this policy is not itself a set of executed standard contractual clauses.
Contact info@paka.ai for information about the safeguards relevant to your data or a copy where applicable.
9. Retention, return and deletion
We retain personal data for as long as necessary for the applicable purposes, taking account of the information’s sensitivity, the relationship or transaction involved, legal recordkeeping duties, limitation periods, security needs and the feasibility of using less data. Closing an account does not require deletion of records that must lawfully be retained, but it is not a basis for indefinite retention of all customer content.
Business Customer Data is retained on the Business’s instructions and under the DPA. Under our standard Terms and DPA:
- The Business has a 30-day period after account termination to obtain exportable Business Content and customer records through supported export or a reasonable support-assisted process, subject to lawful restrictions and identity verification. The Business may choose return or deletion, including earlier return or deletion, subject to lawful retention. Returned data is also deleted from our systems as provided in the DPA.
- After that export period, remaining Business Customer Data is deleted from active service systems without undue delay and ordinarily within a further 30 days.
- Backup copies may remain for the ordinary recovery cycle, for no longer than 90 days after active-system deletion unless law requires longer retention. They remain protected, are not used for ordinary business purposes and are subject again to deletion if restored.
- Legally required retained information is limited to what is necessary, with restricted access and use, and deleted when the requirement ends. The DPA continues to protect retained Business Customer Data.
This export process is for the Business. It does not guarantee continued Canvas access for the Business’s customers after termination.
For PAKA’s own processing, account, support and operational records are kept according to their continuing purpose. Billing, tax and transaction records are retained for the applicable statutory period, which can extend beyond account closure. Security and claims records are retained only where reasonably necessary for the relevant investigation, risk or legal requirement. PAKA’s voice transcripts and related conversation records are governed by their specific purpose, applicable Business instructions and the DPA. Separate provider retention of voice data is described in Section 5; use of a voice feature is not permission for indefinite retention. Anonymized information that no longer identifies an individual may be retained for service analysis.
10. Cookies, similar technologies and marketing choices
Websites, Cockpit and Canvases may use cookies, local storage and similar technologies for authentication, security, preferences and functionality. Analytics or advertising technologies, if used, require the notices, choices and consent applicable to the technology and jurisdiction. Non-essential technologies that require consent must not be activated before that consent is obtained.
Your browser provides controls for stored cookies and similar information, although blocking essential technologies can prevent parts of the Services from functioning. Browser controls do not replace any consent choice required at the point of use. Contact info@paka.ai for help with PAKA’s tracking practices or choices. Technologies independently configured by a Business are also subject to that Business’s notice and responsibilities.
You can stop PAKA marketing emails through the unsubscribe option or by contacting info@paka.ai. Where applicable, you can also request removal from a database used for direct marketing. We may keep the minimum suppression information needed to honor your preference. Necessary account, security, transaction and legal messages may still be sent. A purchase, account registration or conversation with an agent is not automatically consent to unrelated marketing.
11. Your privacy rights
Rights depend on the applicable law and PAKA’s role. Under Israeli law, individuals generally have rights to inspect personal information about themselves held in a database and to request correction or deletion where information is incorrect, incomplete, unclear or outdated, subject to statutory conditions and exceptions. Additional deletion, notice and other protections may apply to databases covered by Israel’s rules for information transferred from the European Economic Area. Rights concerning direct marketing also apply where relevant.
Where EU GDPR, UK law or other applicable law provides them, rights can additionally include erasure, restriction, portability, objection to processing based on legitimate interests, objection to direct marketing, and protections relating to solely automated decisions. These rights are not unconditional; for example, required legal records may need to be retained. Consent may be withdrawn as described in Section 4.
For PAKA’s own processing, send requests to info@paka.ai with sufficient information to identify the relevant account or activity. We may request proportionate verification before disclosing or changing data. We will respond within the applicable legal time limit and explain any lawful refusal or limitation and available further steps.
For Business Customer Data, contact the Business operating the relevant Canvas. If you contact us, we will refer the request to the relevant Business and assist it as required by the DPA, unless applicable law requires us to act directly.
You may complain to Israel’s Privacy Protection Authority or another competent supervisory authority. Where GDPR applies, this includes the authority in the relevant EEA country, including your habitual residence, workplace or place of the alleged infringement.
12. Security
PAKA is responsible for maintaining technical and organizational safeguards appropriate to the nature and risks of its processing and its obligations under applicable law and the DPA. Our standard DPA describes the contractual safeguards for Business Customer Data, including access restrictions, authentication protections, appropriate encryption, logging, backup and recovery, incident handling and assessment of safeguards.
No service can guarantee absolute security. Businesses and users must protect their credentials, permissions, devices and integrations. If a personal-data breach occurs, PAKA will provide notifications and assistance required by applicable law and the DPA. A Business’s own responsibilities do not remove PAKA’s obligations.
13. Children and minors
A PAKA business account owner must be at least 18. If we learn that a person under 18 has opened a business account as its owner, we will take appropriate steps, which may include restricting or closing the account and handling its information lawfully.
Some Businesses may provide content or services to minors. The Business must assess age restrictions, lawful processing, appropriate notices, parental permissions and other child-protection requirements before using the Services for that purpose. It must not collect children’s information where the necessary legal and technical arrangements are absent. PAKA processes the relevant Business Customer Data under the DPA and remains responsible for its own applicable duties. Contact info@paka.ai if you believe a child’s information has been handled improperly through PAKA.
14. Changes and contact
We may update this policy to reflect changes in our Services, practices or legal requirements. The current version is published at https://paka.ai/privacy-policy. We will identify the updated date and provide notice of material changes through appropriate means where required. Our contractual DPA protections remain subject to that agreement and applicable law.
For privacy questions or requests, contact:
PAKA TECHNOLOGIES LTD
Israeli company no. 516864733
Email: info@paka.ai
Telephone: +1 336-525-5915
Website: https://paka.ai