Privacy policy.

1. Who is responsible

The controller (בעל שליטה under Israeli law) is Mark Ghazawi, trading as AERA, a sole proprietor registered in Israel, based in Jerusalem. Contact: aeraops@gmail.com. Full business details are in our terms.

When AERA builds and runs an AI agent or automation for a business client, that client is the controller of its own customers' data and AERA is its processor. That processing is governed by our data-processing agreement, not by this policy. If you are a customer of one of our clients, contact that business first; we will help it answer you.

2. What we collect, channel by channel

We do not ask for sensitive data (health, biometrics, beliefs and similar). Please do not send it to the front desk. If you do, we use it only to answer you and delete it with the rest of the conversation.

3. Why we use it, and the legal basis

You are not legally required to give us your data. Without contact details we cannot answer you; without the materials a project needs we cannot build it.

4. AI processing and the AI disclosure

AERA's front desk on WhatsApp is an AI agent, and it says so at the start of a conversation. Calls to AERA's AI front-desk line are answered by an AI voice agent, which says at the start that it is an AI and that the call is recorded. Transcripts of those calls are kept as set out below, and a person follows up. The agents answer questions about our services and prices, collect what you need, and book a next step. A person (Mark or a member of the AERA team) can read the conversation and take over at any time, and you can ask for a person.

Front-desk text is processed by OpenAI under the terms of AERA's ChatGPT subscription, to write the replies. Voice is processed by ElevenLabs under its service terms, for speech and transcripts. We are turning off model training on that subscription. We do not train AI models of our own on your conversations.

Proposals, invoices and automations are approved by a person before they are sent. The AI front desk replies automatically, within information AERA has approved. Prices, dates and commitments bind AERA only once a person confirms them in writing. We make no decision about you that has legal or similarly significant effect by automated means alone (GDPR Art. 22).

More detail, including recording notices for calls, is on our AI disclosure page.

5. How long we keep it

You can ask us to delete your data sooner; see section 9.

6. Who we share it with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only with the service providers below, who process it for us under their business or service terms, and where the law requires it (for example a court order or the tax authority).

AERA's mailbox is a Gmail account, so email you send us is held by Google. The full, current list is on our sub-processors page.

7. International transfers

AERA is based in Israel. The European Commission recognises Israel as giving adequate protection, so data can come to us from the EU without extra safeguards.

Several of our providers are in the USA. For data from the EU or UK, we rely on the provider's Standard Contractual Clauses, or on the EU-US Data Privacy Framework where the provider is certified. For data from Israel, transfers follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, under each provider's business or service terms. You can ask us for a copy of the relevant safeguards.

8. How we protect it

• Encryption in transit (HTTPS) on the site and with our providers.
• Access limited to the people who need it to serve you, with separate accounts. Website passwords in new onboarding submissions are stored only encrypted (AES-256-GCM), and only AERA admin accounts with the owner role can view them. Older submissions are being moved to encrypted storage and the plain copies deleted.
• A strict content security policy, form rate limits, spam traps and salted hashing of IP addresses.
• Proposals, invoices and automations are approved by a person before they are sent. The AI front desk replies automatically, within information AERA has approved.
• Provider accounts protected with strong authentication where the provider offers it.

No system is perfectly secure. We hold no security certification (such as ISO 27001 or SOC 2). If a breach puts your data at risk, we will notify the Privacy Protection Authority and, where required, you, within the time the law sets.

9. Your rights

Wherever you are, you can ask us to:

• Access: tell you what data we hold about you and give you a copy (Israeli law s.13; GDPR Art. 15; CCPA right to know).
• Correct: fix data that is wrong, incomplete or out of date (s.14; Art. 16; CCPA right to correct).
• Delete: erase your data, unless we must keep it, for example invoices (s.14; Art. 17; CCPA right to delete).
• Object and opt out: stop using your data for marketing at any time, and object to processing based on legitimate interests (s.17F; Art. 21). Reply "stop" or "הסר" on WhatsApp and the front desk stops messaging you.
• Restrict or port: pause the use of your data, or receive it in a common machine-readable format (Art. 18 and 20).
• Withdraw consent: for analytics or marketing, as easily as you gave it, without affecting earlier use.

California residents: AERA likely falls below the CCPA's size thresholds, but we honour these rights for you anyway. We do not sell or share personal information and do not use sensitive personal information for inferring characteristics. We will not treat you differently for using your rights. You may use an authorised agent.

10. How to make a request, and how fast we answer

Write to aeraops@gmail.com, or ask on WhatsApp at +972 52-220-0490 ("I want to see / delete my data"). The front desk will log the request for a person to handle; it does not complete access or deletion on its own.

We may ask you to confirm who you are, usually by replying from the same email address or phone number. We answer within 30 days. Where the law allows more time for a complex request (GDPR: up to two further months; CCPA: up to 45 further days), we will tell you within the first 30 days, and why. Requests are free unless they are clearly unfounded or excessive.

If we refuse a request, we will explain why and how you can challenge it.

11. Marketing messages

Under Israel's Communications (Telecommunications and Broadcasting) Law, 5742-1982, s.30A, we send advertising by email, SMS, WhatsApp or automated call only with your prior consent, or to existing customers about similar services where the law allows it and you were given the chance to refuse.

Every marketing message says it is advertising, identifies AERA and gives a simple way to opt out. Replying "stop" or "הסר", or writing to us, removes you. Our front desk only answers people who message us first; it does not send cold messages.

Replies to your own inquiry, proposals, invoices and service notices are not marketing.

12. Children

Our services are for businesses and adults. They are not meant for anyone under 18 and we do not knowingly collect children's data. If you think a child has sent us data, tell us and we will delete it.

13. Cookies

We use a few essential cookies (language, currency, sign-in, security) and, only if you accept, Google Analytics cookies. Details and how to change your choice are in our cookie policy.

14. Contact and complaints

Please tell us first: aeraops@gmail.com. We would rather fix it.

You can also complain to a regulator:

• Israel: the Privacy Protection Authority (הרשות להגנת הפרטיות).
• EU and EEA: the data protection authority where you live or work; the list is on the EDPB website.
• UK: the Information Commissioner's Office.
• California: the California Privacy Protection Agency or the Attorney General.

15. Changes to this policy

We will update this page when our practices change, and change the date at the top. If a change is material, we will tell clients by email at least 30 days ahead, and where the law needs your consent, ask for it.