דילוג לתוכן
לידי
התחברותהתחילו בחינם

Privacy Policy

Last updated: November 12, 2026

Lidi (getlidi.com) answers WhatsApp messages on behalf of businesses, collects the details of each inquiry and sends the business owner a summary. It is operated by אורבן פתרונות, a sole proprietorship registered in Israel (exempt dealer, "osek patur"), online only ("Lidi", "we"). This policy explains what we collect, why, who it is shared with, how long it is kept and how to access, correct or delete it — as the system actually works. A Hebrew version is available here.

1. Who is responsible

  • Business owners and users of Lidi (account, settings, billing): Lidi is the controller.
  • Customers of the businesses (people who message a business on WhatsApp): the business is the controller, and Lidi processes the data on its behalf and instructions, under our Data Processing Agreement. You can contact the business, or us through the privacy request form, and we will handle it together with the business.

2. Business owners and users

  • Account: name, email and password (stored as a hash — we never see it).
  • Business details and bot settings: name, vertical, services, prices, hours, service areas, rules, Q&A and uploaded materials.
  • The alert phone number, after verification by a code.
  • WhatsApp connection: the business number and Meta identifiers; Meta's access token is stored encrypted (AES-256-GCM).
  • Billing: subscription status and payment identifiers. Card details go directly to PayPlus, our card processor, never through us; we keep only the last 4 digits, the expiry and a token (encrypted) that only our PayPlus terminal can charge.
  • Your answers to customers' questions, internal notes on conversations, and taps on daily-summary buttons.
  • Acceptance of the terms, privacy policy and DPA (version and date), and whether you opted in to marketing updates.

3. Customers of the businesses

  • Phone number and the name shown on their WhatsApp profile.
  • The conversation: their messages, the bot's replies and the business's replies (including ones the owner typed in the WhatsApp Business app).
  • Voice notes are transcribed so the bot can answer; the audio is not stored, only the transcript. Images and other files are not stored — only a note that one was sent.
  • A location, if the customer shared one (e.g. for a pickup).
  • Inquiry details the bot recognizes in the conversation (e.g. date, number of people, address), per the fields the business set, and a short summary for the owner.
  • If the customer came from the business's Facebook/Instagram ad: the ad details Meta provides.
  • Phone numbers from the business's WhatsApp contacts and chat history (when it connects its existing number) — only to recognize private chats, which the bot never answers and whose content is not stored.
  • A request to stop automated messages ("stop", "הסר") — kept so it is honored.

4. Website visitors

  • Website demo chats are not stored. If you leave demo feedback, the feedback, your name (if given) and the demo transcript are stored.
  • IP addresses are kept briefly for rate limiting and abuse prevention.
  • No analytics, advertising pixels or tracking cookies. See the cookie policy.

5. Purposes and legal bases

  • Providing the Service — answering customers on the business's behalf, managing leads, alerts and summaries (performance of our contract with the business).
  • Security, abuse prevention, error monitoring and quality control of the bot's replies (legitimate interests).
  • Billing, receipts and legal requirements (legal obligation).
  • Marketing updates — only with explicit opt-in, withdrawable at any time (consent).

There is no legal obligation to provide data, but without the necessary data we cannot provide the Service. Data is processed with AI to draft replies and recognize inquiry details; business decisions (prices, confirming a booking) remain with the business.

6. Who we share data with

We do not sell data or share it with advertisers. Data reaches only the providers that run the Service, as needed, and the business itself:

  • Supabase — database, authentication and file storage — all the data in this policy (servers in Frankfurt, Germany)
  • Vercel — hosting of the website and app, request processing (processing in Frankfurt; global edge network)
  • OpenRouter — AI gateway: conversation text, business settings and lead details are sent to draft replies; voice notes for transcription (USA)
  • OpenAI (via OpenRouter) — the language and transcription models (default) (USA)
  • Meta (WhatsApp Business Platform) — sending and receiving WhatsApp messages, connecting the number, owner alerts (global)
  • PayPlus — card clearing: the payment page, the saved card (token) and the monthly recurring charge (Israel)
  • Twilio — Lidi's US phone number (SMS and calls to it) (USA)
  • Resend — account emails (email verification, password reset) (USA)
  • Cloudflare — routing of emails sent to our address (global)
  • GitHub — code hosting and automated tests — test data only, no customer data (USA)

Some providers are outside Israel (in the EU and the USA). We work only with providers bound to protect and secure the data. Data is disclosed to authorities only where the law requires.

7. Retention

  • Account and business settings: while the account is active.
  • Conversations, contacts and leads of the business's customers: while the business's account is active, or until the business or the customer asks to delete them. After the engagement with the business ends — deleted within 90 days (a process our team carries out), unless the business asks otherwise or the law requires keeping them.
  • Payment records and receipts: as required by law.
  • Technical data and logs are deleted automatically:
  • raw copies of incoming WhatsApp messages and processing records (de-duplication, troubleshooting) — 35 days
  • a record of every AI call, including the generated reply (quality and cost control) — 180 days
  • alerts to the business owner and to our team — 1 year
  • resolved error records — 180 days
  • rate-limit records (contain an IP address or phone number) — 2 days
  • phone verification codes — 1 day
  • the owner's draft answers — 7 days
  • daily-summary buttons — 7 days
  • the alert phone's 24-hour window — 30 days
  • feedback from the website demo — 1 year
  • unverified privacy requests — 7 days
  • Lidi staff activity log (security) — 24 months
  • handled privacy requests (record of handling) — 24 months
  • Database backups — up to 7 days.

8. Your rights

  • Access the data kept about you, and ask to correct or delete it.
  • How: the privacy request form (we verify it's you with a one-time code), or email hello@getlidi.com. We answer access requests within 21 days and correction or deletion requests within 30 days.
  • A customer of a business can also write "stop" to stop automated messages from it.
  • Unsubscribe from marketing updates with the link in every update — immediately.
  • If you are not satisfied with our answer, you can contact the Israeli Privacy Protection Authority.

9. Security

  • Encrypted connections (HTTPS); data encrypted at rest.
  • Each business sees only its own data (isolation at the database level).
  • WhatsApp access tokens are encrypted with a separate key.
  • Our staff's access to a business's data is limited to support and logged.
  • Rate limits, a content security policy (CSP), error monitoring and daily backups.

10. Changes and contact

We will announce material changes by email or in the app. Questions and requests: hello@getlidi.com, אורבן פתרונות (online only).