Privacy Policy

Last updated: November 7, 2026

Naratek is a service of R.A.S Investments and Finance Ltd., a company registered in Israel ("Naratek", "we", "us"). This policy explains what information we collect, why, who processes it for us, how it is stored and how it can be deleted. It applies to naratek.ai, to the account area at app.naratek.ai, to the business workspaces at *.naratek.ai, and to the messaging channels we operate.

• Who is responsible
• What we collect
• How we use it
• AI
• Payments
• Who processes it
• Storage and security
• Retention and deletion
• Your rights
• Contact

1Who is responsible for the data

• Account and billing details of business owners and their team members: Naratek is responsible.
• Information about a business's own customers, such as leads, contacts and conversations: the business is responsible. Naratek processes it on the business's behalf and only according to its instructions.

2What we collect

1. Account details: name, email address, business name and the business's workspace address. If you sign in with Google, also your Google account identifier.
2. Billing details: when you buy a plan or additional AI usage, Paddle (our reseller, see section 5) tells us your name, email address, country, the product you bought, and the status of your payments and subscription. We do not receive or store your full card details.
3. Content you create in the service: your website or app, tables and records, agent and automation settings, and the messages you send to the builder.
4. Data from accounts the business connects. When a business owner connects an outside account and grants permissions, we receive only what they approved. For example, when connecting Facebook:
   • The name and ID of the Facebook user who connected.
   • The list of Pages they manage, and content and engagement of the Pages they choose: posts, comments and reach data.
   • Ad accounts, campaigns, ads and performance data.
   • Leads from the business's lead forms: what people entered in the form, such as name, phone, email and answers to questions.
   • Access tokens that let us perform actions on the business's behalf.
   Connecting TikTok, Google or monday.com works the same way: we receive only the data covered by the permissions the business approved.
5. Messaging: when you send a WhatsApp message to us or to a business that handles its messages through Naratek, we process your phone number, WhatsApp profile name, the messages, images, documents and voice messages you send, and their timestamps and delivery status.
6. Technical data: IP address, browser and device type, and usage and security logs.

3How we use it

• To provide the service: show the business its own data in its workspace, run what it builds, and save new leads into its tables and notify it about them.
• To perform actions the business owner requested or approved, such as publishing a post, sending a message or creating an ad. No action on an outside account and no spending happens without the business owner's request or approval.
• To answer messages and support requests.
• To manage plans, usage and billing.
• To secure the service and prevent abuse.
• To send service notices, such as sign-in codes and changes to our terms.

We do not sell data, do not use it for our own or anyone else's advertising, and do not train AI models on it. We use data received from Meta in accordance with the Meta Platform Terms.

4Artificial intelligence

When a business uses the platform's AI features, the content relevant to the request is sent to model providers (Anthropic and OpenAI) only to produce the answer. It is sent through their business APIs, which under their terms do not use it for training. Access tokens and secrets are never sent to any model. We keep a record of how much AI processing each request consumed, to meter usage and bill for it.

5Payments

Our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for all our orders. Paddle collects and processes your payment details, calculates taxes and issues invoices, under Paddle's privacy policy. Paddle's checkout may use cookies needed to complete the payment and prevent fraud.

6Who processes it for us

Only providers that operate the service for us, each for its own part:

• Google Cloud: servers and storage.
• Anthropic and OpenAI: AI features.
• Paddle: checkout, payments, taxes and invoices.
• Meta (WhatsApp Business Platform): sending and receiving WhatsApp messages, under WhatsApp's privacy policy.
• An email delivery service: sign-in codes and notifications.
• The outside services a business connects, such as Meta, TikTok, Google and monday.com, only for the actions the business requested.

Some of these providers process data outside Israel, under their data protection terms. Beyond that, we disclose data only when the law requires it.

7Storage and security

• Each business has its own separate database; one business cannot see another business's data.
• Access tokens are stored encrypted (AES-256-GCM) with a key unique to each business. They are never displayed and never written to logs.
• Our servers run on Google Cloud, and all traffic is encrypted (HTTPS).
• Our sites use only the cookies and browser storage needed to sign you in and remember settings, such as your language. We do not use advertising or tracking cookies.

8Retention and deletion

• While an account and its connections are active, the data is kept in the business's workspace.
• Disconnecting an outside account on the Connections screen deletes its access tokens immediately, and no further data is received from that account.
• Data the business has already saved, such as a lead added to its CRM, stays under the business's control, and the business can delete it at any time.
• When an account is closed or a deletion request is made, we delete the data within 30 days.
• Billing and transaction records are kept for as long as tax and accounting law requires, usually seven years.

Full instructions are on the data deletion page.

9Your rights

You may ask to access, correct or delete your data, to object to its processing or to withdraw consent, under the Israeli Privacy Protection Law and, where it applies, the GDPR. You can also complain to a data protection authority. If your data was collected by a particular business, for example through its lead form or its WhatsApp number, you can contact that business directly, and we will help it carry out your request. You can ask us to stop sending you messages at any time.

10Children

The service is intended for businesses and is not intended for anyone under 18.

11Changes

When we update this policy we will also update the date at the top. We will notify account owners of material changes.

12Contact

Naratek · R.A.S Investments and Finance Ltd. · Israel
Email: amir@naratek.ai · Website: naratek.ai