Privacy Policy
Last updated:
This policy explains what personal data Hzmenly (operated by Ibrahim Jabareen) (“Hzmenly”, “we”, “us”) collects, why, who we share it with, and the rights you have. It applies to our website, the Hzmenly dashboard and the WhatsApp booking assistant we operate for businesses.
1. Who we are and our role
- Operator: Ibrahim Jabareen
- Entity type: Exempt dealer (Osek Patur)
- Address: 36 Musheirifa, Ma'ale Iron 3092000, Israel
- Email: support@hzmenly.com
We act in two different roles, depending on whose data it is:
- Business account data (the business owners and staff who sign up and use the dashboard): we decide how this data is used and are responsible for it as the database owner / controller.
- End-customer data (people who message a business on WhatsApp to book an appointment): we process this data on behalf of that business, only to provide the service to it. The business is the database owner / controller and is responsible for informing its customers and having a lawful basis. If you are an end customer, you can contact the business directly, or contact us and we will pass your request on.
2. What we collect
Business account data
- Business name, business category, time zone, language and currency.
- Owner email address and password (stored only as a one-way bcrypt hash — we cannot read it).
- Business configuration you enter: services and prices, working hours, holidays, employee names, schedules, time off and any notes you add, AI assistant settings and owner notification settings.
- WhatsApp connection details: your business phone number and Meta account identifiers, plus an access token stored encrypted (AES-256-GCM).
- Subscription data: plan, trial and billing status, and payment records received from our payment provider (amount, date, status). We never receive or store card numbers or CVV codes.
End-customer data (processed for the business)
- WhatsApp phone number and, where provided, a name.
- The content of WhatsApp messages exchanged with the business, and full conversation transcripts.
- Appointments, appointment history, waitlist entries, visit counts, preferred employee and language.
- Any notes the business adds about the customer.
Technical data
- IP address, browser type and request details, recorded in server logs and used for security, rate limiting and troubleshooting.
- A small number of strictly necessary cookies and local-storage entries — see our Cookie Policy.
What we do not do: we do not use analytics or advertising trackers, we do not build advertising profiles, and we do not sell or rent personal data.
Businesses: please do not enter sensitive data (for example health information, ID numbers or payment details) into free-text notes. The service is not designed for it.
3. Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Creating and running your account and dashboard | Account and business data | Performing our contract with you |
| Answering WhatsApp messages and managing bookings for the business | End-customer data, business configuration | Performing our contract with the business, on its instructions |
| Sending appointment confirmations and reminders on the business's behalf | End-customer phone number, appointment details | On the business's instructions |
| Billing and subscription management | Subscription and payment records | Contract; legal obligations (tax and accounting records) |
| Security, fraud and abuse prevention, troubleshooting | Technical data, logs | Our legitimate interest in a secure, working service |
| Responding to your requests and legal claims | Correspondence, relevant records | Legal obligation; legitimate interest |
You are not legally required to give us your data, but we cannot create an account or provide the service without the data marked as required on the sign-up form.
4. How the AI assistant uses data
Incoming WhatsApp messages, the recent conversation and the business’s services, hours and availability are sent to our AI provider, Anthropic, to understand the request and draft a reply. The assistant can only create, change or cancel appointments through our booking system, under rules the business controls, and it hands conversations to a human when it cannot help. AI can still make mistakes, so businesses should monitor conversations from the dashboard. We do not use your data to train AI models, and Anthropic’s commercial terms do not permit it to train its models on data we send through its API.
5. Who we share data with
We share personal data only with the service providers below, and only as needed to run the service:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Railway Corporation (opens in a new tab) | Cloud hosting of the application, database and queue | All service data (account, business and end-customer data, logs) | United States (US West, California) |
| Anthropic, PBC (opens in a new tab) | AI model that reads incoming WhatsApp messages and drafts replies | Message content, conversation context, the business's services, hours and availability | United States |
| Meta Platforms (WhatsApp Business Platform) (opens in a new tab) | Sending and receiving WhatsApp messages; connecting a business's WhatsApp number | Phone numbers, WhatsApp profile names, message content | Global (Meta's infrastructure) |
| PayPlus (opens in a new tab) | Subscription payment processing (once paid billing is enabled) | Billing contact details and payment transactions; card data is entered with and held by PayPlus, never by us | Israel |
We may also disclose data if required by law, court order or a competent authority, or to protect our rights, users or the public. If our business is sold or merged, data may transfer to the new owner under this policy.
6. International transfers
Some of our providers store or process data outside Israel, including in the United States. We transfer data only where permitted under the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations and, where applicable, the EU GDPR — for example on the basis of the recipient’s contractual commitments to protect the data.
7. How long we keep data
- Account, business and end-customer data: for as long as the business account is active.
- After an account is closed, we delete or anonymise its data within 30 days of a written deletion request, except data we must keep by law. Backups are overwritten on their regular rotation cycle.
- Billing and invoice records: for as long as Israeli tax and accounting law requires (generally 7 years).
- Server logs: for a limited period needed for security and troubleshooting.
8. Security
We use encrypted connections (HTTPS), hashed passwords, encryption of WhatsApp access tokens, database-level isolation between businesses, authentication cookies that page scripts cannot read, and rate limiting. No system is perfectly secure; if a security incident affects your personal data, we will notify you and the authorities as the law requires.
9. Your rights
Under the Israeli Privacy Protection Law, 5741-1981, you have the right to see the data we hold about you and to ask for it to be corrected or deleted. If the EU GDPR or a similar law applies to you, you may also have rights to data portability, restriction and objection. To exercise a right, email support@hzmenly.com. We may need to verify your identity and will respond within the period the law requires.
End customers of a business: because the business controls your data, we will forward your request to it and help it respond.
You may also complain to the Israeli Privacy Protection Authority (opens in a new tab) or, where applicable, your local data protection authority.
10. Children
The dashboard is for businesses and may only be used by people aged 18 or over. We do not knowingly collect children’s data for our own purposes.
11. Changes to this policy
We will post any changes on this page and update the “Last updated” date. If a change is material, we will also notify account owners by email or in the dashboard before it takes effect.
12. Contact
Privacy questions or requests: support@hzmenly.com.