דילוג לתוכן
לידי
התחברותהתחילו בחינם

Data Processing Agreement (DPA)

Last updated: 2026-11-12

This agreement forms part of the Terms of Service (Hebrew) between the business that opens a Lidi account ("the Business", the controller) and אורבן פתרונות, a sole proprietorship registered in Israel (exempt dealer, "osek patur") ("Lidi", the processor). It applies to the personal data of the Business's customers that Lidi processes on its behalf. Version: 2026-11-12. A Hebrew version is available here.

1. Subject matter and purpose

Lidi processes personal data only to provide the Service to the Business: answering its customers on WhatsApp on its behalf, recognizing and keeping inquiry details, sending the owner alerts and summaries, and keeping the conversations in the app. Details in Annex A.

2. The Business's instructions

  • Lidi processes the data only on the Business's instructions — the settings it configures in the Service and its written instructions — and for no purpose of its own.
  • Lidi will inform the Business if it believes an instruction infringes the law.
  • Lidi does not sell the data, use it for advertising, or use the Business's conversations to train models.

3. The Business's obligations

  • The Business ensures it has a lawful basis and that its customers receive any required notice (including that replies are generated with AI).
  • The Business is responsible for compliance with WhatsApp Business policies and anti-spam law (incl. section 30A of the Israeli Communications Law) for messages sent on its behalf.
  • The Business will not enter special-category data into the Service beyond what an inquiry needs.

4. Confidentiality

Access is limited to staff and providers who need it to provide the Service, bound by confidentiality. Staff access to a Business's account for support is logged.

5. Security

Lidi implements measures appropriate to the risk, in line with the Israeli Privacy Protection (Data Security) Regulations, 2017. The main ones are in Annex B.

6. Sub-processors

  • The Business authorizes the sub-processors in Annex C.
  • Lidi will notify the Business (by email or in the app) at least 14 days before adding or replacing a sub-processor; the Business may object on reasonable grounds and, if no solution is found, terminate.
  • Lidi binds each sub-processor to data protection obligations no less protective than these and remains responsible for it.

7. Transfers outside Israel

Some sub-processors operate outside Israel (in the EU and the USA). Lidi transfers data abroad only in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001.

8. Data subject requests

Lidi assists the Business in answering its customers' requests to access, correct or delete data. Requests received by Lidi directly (e.g. through the privacy request form) are passed to the Business and handled in coordination with it.

9. Security incidents

Lidi will notify the Business without undue delay, and within 48 hours of becoming aware, of a security incident affecting the Business's data, with the information it has, the steps taken and what is required of the Business, and will assist with notifying the Privacy Protection Authority and affected people where required.

10. End of the engagement

At the end of the engagement, at the Business's choice, Lidi will provide a copy of the data in a common format (on request, within 30 days) and delete it within 90 days, unless the law requires keeping it. Backups are deleted in their normal cycle (up to 7 days).

11. Audit and information

On reasonable request, Lidi will provide the information needed to demonstrate compliance with this agreement and answer reasonable security questionnaires.

12. General

Liability, governing law and jurisdiction follow the Terms of Service. In case of conflict regarding personal data processing, this agreement prevails.

Annex A — Processing details

  • Data subjects: the Business's customers and inquirers on WhatsApp and the website chat; contacts from the Business's WhatsApp (phone only, to recognize private chats).
  • Data: phone number, profile name, conversation content (incl. voice-note transcripts), location if shared, inquiry details recognized by the bot, ad referral details, opt-out requests.
  • Nature: receiving and sending messages, AI drafting of replies, extraction of inquiry details, storage, display to the Business, alerts.
  • Duration: while the Business's account is active, then per section 10. Technical data and logs are deleted automatically per the Privacy Policy.

Annex B — Security measures

  • Encryption in transit (HTTPS/HSTS) and at rest; WhatsApp access tokens encrypted (AES-256-GCM) with a separate key.
  • Tenant isolation at the database level (Row Level Security) and least-privilege roles.
  • Limited, authenticated and logged staff access.
  • Signature verification on all webhooks, rate limits, content security policy (CSP).
  • Error monitoring and alerting, daily backups, and an incident response procedure.
  • A test environment fully separate from production, with no customer data.

Annex C — Sub-processors

  • Supabase — database, authentication and file storage — all the data in this policy (servers in Frankfurt, Germany)
  • Vercel — hosting of the website and app, request processing (processing in Frankfurt; global edge network)
  • OpenRouter — AI gateway: conversation text, business settings and lead details are sent to draft replies; voice notes for transcription (USA)
  • OpenAI (via OpenRouter) — the language and transcription models (default) (USA)
  • Meta (WhatsApp Business Platform) — sending and receiving WhatsApp messages, connecting the number, owner alerts (global)
  • PayPlus — card clearing: the payment page, the saved card (token) and the monthly recurring charge (Israel)
  • Twilio — Lidi's US phone number (SMS and calls to it) (USA)
  • Resend — account emails (email verification, password reset) (USA)
  • Cloudflare — routing of emails sent to our address (global)
  • GitHub — code hosting and automated tests — test data only, no customer data (USA)