This policy applies to all KLOXA services and addresses, however you reached them. It is written for three types of readers: business owners and users of the system, their customers, and website visitors. It was prepared under the Protection of Privacy Law, 5741-1981, as amended, including Amendment No. 13, and the Protection of Privacy (Data Security) Regulations, 5777-2017. The policy is part of the Terms of Use.

Which services and addresses this document covers

The KLOXA website - kloxa.io
The management system - workspace.kloxa.io
The KLOXA mobile app
The public pages - kloxa.one: forms, documents, business pages and contact forms
The mailboxes and document intake addresses - kloxa.co.il
Any other address under the KLOXA domains (kloxa.io, kloxa.one, kloxa.co.il)
Messages and notices sent in the name of KLOXA or through it by email, SMS and WhatsApp

The services are operated by KLOXA Ltd., Company No. 517336467 (hereinafter: "KLOXA" or "we"). The same text applies to all the services, and no other text prevails over it.

Two types of information, and two different responsibilities

Information about business owners, users and visitors - the details given when opening an account, using the services and visiting the website. For this information KLOXA is the database controller, and is responsible for it.
Information that a business manages in the system - its customers, employees, suppliers, forms and documents. This information belongs to the business, and the business is the controller of it. KLOXA is only a holder (processor): it stores and processes the information on behalf of the business and according to its instructions, under the Data Processing Agreement, and makes no use of its own of it. The business is responsible for the lawfulness of collecting the information, for giving the required notices and for obtaining consents.
If you received a link from a business, filled in a form, signed or left details - the information was given to the business, and the business decides what is done with it. Questions and requests about this information are directed first to the business.

What is collected

When opening an account: name, email address, phone number and password, and the business details (name, business or company number, address and field of activity). The password is stored in a form that cannot be recovered, so even we cannot see it.
When paying for the service: billing and contact details. Credit card details, where given, are passed directly to a payment clearing provider and are not stored in full by us.
When using the system: a record of actions - who performed an action, which, on what, when and from which screen. The record is for security and audit purposes, and is locked against modification and deletion.
In a form that a business sent: the answers, the attached files and the signature. With a signature, the time of signing, the network address and the browser details are also stored, as evidence that the signature was made.
In a contact form or a leave-your-details form: the details given, such as name, phone, email and message.
In documents sent to the intake addresses (by email or WhatsApp): the file, the phone number or sender address and the time of sending.
On a business page: views and clicks are counted, along with which campaign you came from. The count does not identify you.
On the KLOXA website (kloxa.io): visits are counted anonymously through Umami Cloud - which pages were viewed and from which type of device, without cookies and without identifying you.
When contacting support or reporting: the content of the inquiry and the contact details you gave.
Technical information: network address, browser and device details, and information about faults, for the purposes of security, preventing abuse and locating faults.
From an external source: only from a source that a business connected itself - for example, inquiries from ad forms on Facebook, Instagram or Google. We do not purchase lists.

You are not required by law to give us information. Without certain details, such as email or phone, we will not be able to open an account or provide the service.

Information received from Facebook and Instagram (Meta)

A business can connect its Facebook page to KLOXA, so that inquiries from ad forms (Lead Ads) on Facebook and Instagram reach its system directly. The information is received only after the page administrator approved the connection in Facebook, and only within the scope of the permissions they approved.

What is received when connecting the page: the page name and page identifier, the Facebook identifier of the person who connected (an identifier specific to our app) and a page access token. The list of pages that the page administrator manages is displayed to them only so that they can choose which page to connect, and is not stored.
The access token is stored encrypted, is used only to retrieve inquiries and for a daily check that the connection is working, and is not displayed to anyone - not even to the business. The personal access token of the page administrator is not stored.
What is received for each inquiry: the answers that the inquirer filled in on the ad form, for example name, phone, email and answers to additional questions, as well as the inquiry identifier, the form identifier and its name, and whether the inquiry came from Facebook or Instagram.
Why: to deliver the inquiry to the business that published the ad, to attribute it to its campaign and to prevent double intake of the same inquiry. This is the only use of the information.
What not: we do not receive and do not store other information from Facebook - no posts, no friends, no messages and no profile details. We do not use the information for advertising, we do not sell it and we do not transfer it to anyone except the business to which the inquiry was sent.
How long: the inquiry belongs to the business that published the ad and is kept by it like any other inquiry, for as long as the business keeps it. The access token is kept as long as the connection is active, and is deleted immediately when the connection is disconnected. The Facebook identifier of the person who connected is deleted on a data deletion request. The page name and page identifier are kept in the business's connection history, as part of the audit record.
How to delete: the business owner can disconnect the page from within the system at any moment. The page administrator can remove the KLOXA app in Facebook settings (Settings & privacy, Settings, Business integrations) or request data deletion through Facebook. Any person can also submit a request on the Data Deletion page.

Use of information received from Meta is carried out in accordance with the Meta Platform Terms.

Mailbox connection (Gmail / Microsoft)

When a business owner connects their mailbox (Gmail or Microsoft Outlook) to KLOXA, KLOXA receives read-only access (gmail.readonly / Mail.Read). This access is used for one purpose only: to locate supplier invoices and receipts in the mailbox and import them into the intake inbox of the business's expenses module. KLOXA does not send, delete or modify messages.

What is accessed: KLOXA searches the mailbox only for messages whose subject contains invoice or receipt words, and only from the date the business chose. For each such message it reads the message, its attachments, and a link to download the invoice if the message contains one. Other messages are not opened.
What is stored: only the invoice or receipt file found in the message (an attachment, a file downloaded from the link, or a PDF of the message body when the invoice is the body itself), the sender's address, the message identifier and the time it was received. The subject and the body of the message are not stored. The full message is held in temporary storage only while it is processed, and is deleted immediately afterwards.
How it is used: the file is read automatically, sometimes with the help of an artificial intelligence provider, to identify the supplier, the date and the amounts, and is placed in the business's intake inbox for approval. The information is used only to provide this feature to the business that connected the mailbox. It is not used for advertising, for building profiles, or for credit or lending decisions, and it is not sold.
To whom it is transferred: only to the service providers needed to run the feature - storage infrastructure, and an artificial intelligence provider that processes the file on our instruction. The sub-processor that reads the documents is Anthropic. The document itself (the full file or the text extracted from it, not the message) is sent to it only when the automatic reading did not identify a mandatory field, and it is bound by agreement not to use the information to train or improve its models. KLOXA itself does not use Google user data to develop, improve or train general artificial intelligence or machine learning models. The information is not transferred to anyone else, except as required by law.
How it is protected: the connection to Google and to Microsoft is encrypted, the access tokens are stored encrypted, stored files are encrypted, and access by KLOXA staff is limited and logged.
How long: an imported document belongs to the business and is kept for as long as the business keeps it. A file that turned out not to be an accounting document is deleted automatically after 30 days. The access tokens are kept only while the connection is active, and are revoked at Google or Microsoft and deleted the moment the connection is disconnected.
How to disconnect and delete: the business owner can disconnect the mailbox from within the system at any moment, and from that moment no more messages are read. Access can also be removed in the Google account settings (Security, Third-party apps and services) or in the Microsoft account. Any person can also submit a request on the Data Deletion page.

KLOXA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Invoice intake on WhatsApp

KLOXA operates one WhatsApp number for receiving supplier invoices and receipts, named "KLOXA קליטת חשבוניות" (KLOXA Invoice Intake). It is an automated bot with a single purpose: to receive a document and place it in the business's intake inbox. It does not hold conversations, and its replies are sent automatically, not by a person.

Who can send: only a phone that the business owner linked with a one-time code generated in the system. One phone can be linked to several businesses, and then the bot asks which business the document belongs to.
What is stored: the file that was sent (a document or an image), the sender's phone number, the message identifier and the time of sending. The file enters the business's intake inbox and is kept there like any uploaded document.
What is not stored: text messages, voice recordings, videos, locations and contacts are not received and are not stored. Nothing is stored from a phone that is not linked.
How the document is read: the system reads the file automatically, sometimes with the help of an artificial intelligence provider, to identify the supplier, the date and the amounts. The content is used only to receive the document for the business it was sent to.
How long: the document belongs to the business and is kept there for as long as the business keeps it. The details of a file awaiting a choice of business, including the phone number, are deleted no later than 30 days after the choice was closed or expired.
How to disconnect: the business owner can cancel a phone's link from within the system at any moment, and from that moment the bot no longer receives documents from it for that business. Any person can also submit a request on the Data Deletion page.

Messages pass through Meta's WhatsApp Business Platform, and its use is carried out in accordance with Meta's business terms.

What we use the information for

To provide the services, to open and manage an account, to bill for them and to support users.
To carry out the actions that the business requests in the system, on its behalf and according to its instructions.
To secure the services, to prevent fraud and abuse, and to record actions for audit purposes.
To locate faults and improve the services, based on aggregated data that does not identify a person.
To send service messages, material updates and notices concerning the account.
To send marketing content on behalf of KLOXA - only to those who agreed to it, and with an option to unsubscribe in every message.
To meet obligations under law, including accounting, tax and record-keeping obligations, and to defend our rights in legal proceedings.

What is stored in the browser and on the device

The display preference (light or dark), the language and the accessibility toolbar preferences.
A draft of a form you started filling in and did not submit, so that you do not lose what you wrote. It is stored only on your device and is deleted when the form is submitted. No draft is stored at all for a form marked as sensitive.
Sign-in details for the system, for signed-in users.
The source of arrival at a business page (campaign), for the duration of the visit only.
There are no advertising cookies and no cross-site tracking. On the KLOXA website, visits are counted anonymously (Umami), without cookies. Full details in the Cookie Policy.

Where the information is stored and how it is protected

The database and file storage are on servers in Israel. Some service providers, such as email, messaging, network protection, website visit counting and artificial intelligence, may process information outside Israel, as set out in "Who can access and to whom the information is transferred".
Each business is isolated from the others, and there is no access between businesses.
Sensitive fields are stored encrypted: ID numbers, payroll amounts, bank account details, signatures and forms marked as sensitive. They are displayed partially, and full disclosure requires two-step verification and is logged.
Traffic is encrypted, access is determined by permissions, and unusual activity is monitored.
The data is backed up daily, and the recovery process is tested.
No system is completely immune. In the event of a serious security incident we will act as the law requires, including reporting to the Privacy Protection Authority and notifying the affected businesses.

Who can access and to whom the information is transferred

The business owner and those to whom they grant permission. The scope of access is determined by them.
KLOXA staff - access to business data is limited, is carried out for support, security or maintenance purposes only, and is logged with the business so that it can see it itself.
Service providers - infrastructure and storage providers, payment clearing, email, SMS, WhatsApp, network protection and anonymous website visit counting (Umami), and an artificial intelligence provider that processes documents, forms and messages only when a user triggers an AI-based action (for example, importing a document or drafting a reply). They act on our instruction, are bound by confidentiality and security, and are not permitted to make independent use of the information.
Authorities - only as required by law or by an order of a competent authority.
Merger or sale - if KLOXA's activity is transferred to another entity, the information will be transferred to it under the same protection terms.
We do not sell information and do not transfer it to a third party for marketing purposes.

To the extent that a service provider processes information outside Israel, the transfer is made only under the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, to a country that protects the information at an adequate level or under a suitable undertaking by the provider.

How long the information is kept

Business data is kept as long as the account is active. We do not delete business data automatically.
Information given to a business is kept as long as the business keeps it, subject to the law that applies to it.
A record of a change to data is kept over time and is not deleted, as part of the audit requirement. A record of viewing only is deleted at the end of a defined period.
Documents and records that must be kept under law are kept for the period set by law.
After an account is closed the data can be exported. Its deletion will be carried out on request and subject to retention obligations under law.

Your rights

To access the information stored about you, to correct information that is not correct, complete, clear or up to date, and to request to delete information - under the Protection of Privacy Law and subject to retention obligations under law.
To object to direct mailing and to remove yourself from marketing mailings, through the link at the bottom of every message or by contacting us.
A business owner can export the business data at any stage, to Excel or PDF, without contacting us.
Gave information to a business? Contact the business first, as the information is its own. We will help it fulfil your request, and you can also contact us.
We will respond to a request within the period set by law. We may ask to verify your identity before we provide or delete information.
If you did not receive a satisfactory response, you can contact the Privacy Protection Authority at the Ministry of Justice.

Minors

The services are intended for business owners, and are not intended for opening an account by anyone who has not yet reached the age of 18. A business that manages information about minors - for example students or patients - is responsible for obtaining the required consents from the parent or guardian.

Changes to this policy

This policy may be updated. The binding text is the text published on this page, with the version number and update date at its bottom. A material change will be brought to users' attention in advance, by a notice in the system or by email.

Contact us

For any question about privacy, and to exercise your rights: [email protected]

KLOXA's Privacy Protection Officer: [email protected]

KLOXA Ltd. · Company No. 517336467