Privacy Policy

1. Who is who

A business that uses AfterCall (the "Business", for example a repair technician) decides which customer conversations are connected and is the controller of its own customers' data. We process that data on the Business's behalf to provide the service. For the account data of the Business's own users (name, email, sign-in), we are the controller.

2. What we collect

• WhatsApp messages and media received through the WhatsApp Business Platform (Cloud API) on a number the Business connects, including when that number is also used in the WhatsApp Business app ("coexistence"): the text of messages, images, voice notes, message ids, timestamps and delivery status. We also receive the messages the Business itself sends from the WhatsApp Business app on that number.
• Customer names and phone numbers: the phone number of the sender, and the WhatsApp profile name when WhatsApp provides one (used only as a suggested name that the Business can change).
• Voice notes: the audio is downloaded, transcribed to text, and then the audio file is deleted. Only the transcript is kept.
• Images sent by customers, stored privately as evidence for the Business's review. They are deleted automatically after 90 days unless an approval that refers to them is still pending.
• Phone-call data when the Business connects a telephony line: the caller's number, the time and duration of the call, its transcript, and the details extracted from it (for example the fault described and a requested time). A recording AfterCall fetches is a temporary processing copy and is deleted (see Retention); the telephony provider keeps the original under its own terms, not ours.
• Records the Business creates in the product: customers, jobs, visits, tasks, quotes, documents and payments, and an audit trail of who approved what.
• Account data of the Business's users, and the connection credentials the Business gives us for third-party services, which are stored encrypted per business.
• We do not use cookies for advertising or tracking. The service uses only the cookies needed to keep a user signed in.

3. Why we use it

• To receive customers' messages and calls, turn them into suggested work (a customer record, a job, a visit, a task, a reply) and show them to the Business.
• To send a reply or a document to a customer — only after the Business's owner has reviewed and approved it. AfterCall does not send a message, issue a document or take a consequential action on its own; the AI proposes and the owner decides.
• To operate, secure and support the service, and to keep an audit trail.

4. Who processes the data

We use the following processors, depending on how a Business has configured the service:

• Meta Platforms (WhatsApp Business Platform / Cloud API) — delivery and receipt of WhatsApp messages and media.
• Supabase — database, authentication and private file storage.
• Vercel — hosting of the web application.
• Speech-to-text and language-model providers — voice notes and call recordings are transcribed, and the text is analysed to extract structured details: OpenAI, Google (Gemini), and a hosted ivrit.ai Hebrew transcription model (RunPod), depending on configuration.
• Telephony and messaging providers when the Business connects them — for example Extra Mobile and Zadarma (call lines for the optional AI secretary), and Resend (email delivery of documents).
• Services the Business chooses to connect — accounting and quote providers (for example Morning/Green Invoice, iCount, Pitch) and Google (contacts, calendar, maps and geocoding).
• We do not sell personal data and do not use it to train models.

5. Retention

• WhatsApp images: 90 days (configurable per deployment).
• Voice-note audio: deleted after transcription; the transcript is kept with the conversation.
• Call recordings: a recording AfterCall stores is temporary processing material, not a record. It is deleted as soon as a usable transcript has been saved, and in any case within 24 hours of being stored — even if transcription never succeeded. The transcript and what was extracted from it stay with the call. Two exceptions: a recording the Business's owner deliberately marks to be kept in order to check the quality of the transcription, and a recording the owner uploads themselves for that purpose; those are kept until the owner removes them. The telephony provider's own copy of the original is governed by that provider's terms.
• Messages, call data and records of an active Business are retained while the account is active to provide the service; there is currently no fixed automatic deletion period for these records. The Business can request deletion of specific data (section 8), subject to legal retention obligations.
• When a Business stops using AfterCall, its records are exported to it and kept for 60 days, then permanently erased together with its stored files. Its provider credentials are destroyed immediately when offboarding begins.

6. International transfers and security

Our processors may handle data outside your country. Credentials are encrypted at rest; every database row belongs to one Business and is isolated from other Businesses; webhooks from Meta are verified with a signature before anything is read. No system is perfectly secure, and we will notify the affected Business of a breach as the law requires.

7. Your rights

Depending on where you live (including under Israel's Protection of Privacy Law and, where it applies, the GDPR) you may have the right to access, correct or delete your personal data, to object to or restrict its processing, and to complain to a supervisory authority. If you are a customer of a Business, please contact that Business first; you may also write to us and we will pass the request on or act on it ourselves.

8. How to ask for deletion

See the data deletion page (/data-deletion) or write to ori@aftercall.pro. We answer within 30 calendar days.

9. Children

AfterCall is a business tool and is not directed at children.

10. Changes

We will update this page when the service changes and show the date above.