Privacy Policy

ClickScales · clickscales.com · Last updated: September 19, 2026

This Privacy Policy explains how ClickScales ("ClickScales", "we", "us") collects, uses, stores, and shares information when you use our website (clickscales.com) and our AI sales-agent platform (the "Service"). The Service enables businesses to deploy an AI assistant that communicates with their sales leads by phone, WhatsApp, and email, qualifies those leads, and books meetings on the business's calendar.

Data controller / service operator: Koren Shitrit, Israeli registered dealer (Osek Murshe) no. 207782038, trading as ClickScales, 67 HaYarkon St., Tel Aviv.

If you have any questions, contact us at koren@clickscales.com.

1. Who this policy covers

• Customers — businesses that create an account and use the Service.
• Leads — individuals whose contact details a Customer provides to the Service, or who communicate with a Customer's AI agent. For Lead data, ClickScales acts as a processor / service provider on behalf of the Customer, who is the data controller.
• Website visitors — anyone browsing clickscales.com or submitting a form on it.

2. Information we collect

From Customers

• Account details: name, business name, email address, phone number.
• Business profile information used to configure the AI agent (services offered, pricing, availability, FAQs).
• Integration credentials the Customer chooses to connect (for example an LLM API key, CRM token, telephony credentials, or a Google account authorization). Credentials are encrypted at rest (AES-256-GCM) and are never sold or shared.
• Billing and usage records.

From Leads (on behalf of Customers)

• Contact details supplied by the Customer or its lead sources (name, phone number, email).
• Conversation content: call audio recordings and transcripts, WhatsApp and email messages exchanged with the Customer's AI agent, and AI-generated summaries and qualification notes. Voice recordings are treated as sensitive information.
• Metadata: phone number, time, duration, channel (phone / WhatsApp / email), and outcome.
• Scheduling details when a Lead books a meeting.

From website visitors

• Standard technical data (IP address, browser type, pages viewed, traffic source) and any information you submit in a contact or demo form. If you accept cookies, the Meta Pixel also records page views and successful form submissions for ad measurement (see Section 11).

3. Google user data

Customers may connect their Google account so the Service can schedule meetings on their Google Calendar. This section describes exactly how the Service accesses, uses, stores, and shares Google user data.

• Access: we access Google Calendar data only after the Customer explicitly grants permission through Google's OAuth consent flow, and only for the calendar the Customer connects.
• Use: calendar data is used solely to provide the scheduling features described above — checking availability and managing meeting events created through the Service. We do not use Google user data for advertising, profiling, or training generalized AI/ML models.
• Storage: we store OAuth tokens encrypted at rest (AES-256-GCM) and store only the minimal event details needed to display and manage bookings (event ID, time, attendee contact provided by the lead). We do not copy or archive the Customer's wider calendar contents.
• Sharing: we do not sell Google user data and do not share it with third parties, except sub-processors strictly necessary to operate the Service (Section 6), as required by law, or as part of a merger or acquisition with equivalent privacy commitments.
• Deletion: a Customer can disconnect Google Calendar at any time from the Service dashboard or via Google security settings. Upon disconnection we delete the stored tokens; associated event records are deleted on account deletion or on request.

4. How we use information

• To operate the Service: run AI conversations, qualify leads, book meetings, and show Customers their activity in the dashboard.
• To provide AI functionality: conversation content is processed by large-language-model, speech-to-text, and text-to-speech providers (Section 6) in order to generate the agent's responses. Where the Customer supplies their own AI provider key, that processing occurs under the Customer's own agreement with the provider.
• For quality control and improvement of conversation scripts, on a legitimate-interest basis — without biometric voice identification.
• To maintain security, prevent abuse, comply with legal obligations, and improve reliability of the Service.
• Marketing emails are sent only with explicit consent, in accordance with applicable anti-spam law (including Section 30A of the Israeli Communications Law).
• We do not sell personal information, and we do not use Customer or Lead content to train our own or third-party foundation models.

5. Call recording and outbound contact

Calls handled by the AI agent are recorded and transcribed to provide the Service; notice of recording is given at the start of each call. Outbound calls are made only to leads who submitted their details or otherwise gave explicit consent, and the source and time of that consent are logged. A lead who asks to be removed is added to a do-not-call list and will not be contacted again — either by saying so during a call or by emailing koren@clickscales.com. Customers remain responsible for ensuring a lawful basis for contacting their leads in their jurisdiction.

6. Sub-processors and service providers

We do not sell personal data. It is shared only with sub-processors required to operate the Service, under data-processing agreements: cloud hosting and databases, real-time voice infrastructure, telephony carriers (SIP), speech-to-text and text-to-speech providers, large-language-model providers, email delivery, WhatsApp messaging, website hosting and forms, CRM tooling, and error monitoring (with PII scrubbed before sending). A current, named list of sub-processors appears in the Hebrew section below and is also available on request at koren@clickscales.com.

7. Data retention and deletion

• Call recordings: 90 days, then deleted automatically.
• Transcripts and call summaries: 12 months.
• Lead contact details (name, phone, email): until a deletion or removal request.
• Billing records: as required by law (7 years).
• Customer account data is retained while the account is active and deleted on termination, except where retention is required by law.

8. Security

We apply industry-standard safeguards: encryption in transit (TLS) and at rest for secrets and sensitive data (AES-256-GCM), API keys stored as hashes only, per-tenant data isolation, webhook signature verification, security event monitoring, and time-limited signed links restricting access to call recordings. No system is perfectly secure; we will notify affected parties of a data breach as required by applicable law.

9. Legal bases and your rights

We process personal data in accordance with applicable privacy laws, including Israel's Privacy Protection Law, 5741-1981 and, where applicable, the EU/UK GDPR. You may request access, correction, or deletion of your personal information; deletion requests are handled within 30 days and cover all records — contact details, recordings, transcripts, and meetings. Contact koren@clickscales.com. Where ClickScales processes data on behalf of a Customer, we may redirect the request to that Customer.

10. International transfers

Our infrastructure providers may process data in the United States, the European Union, and Israel. Where required, transfers rely on appropriate safeguards such as standard contractual clauses and the Israeli Privacy Protection (Transfer of Data) Regulations.

11. Cookies and pixels

Our website does not set cookies of its own. The only tracking tool on it is the Meta Pixel, provided by Meta Platforms, and it runs only if you choose "Accept" in the cookie banner. If you choose "Decline", or make no choice, the pixel does not load and nothing is sent to Meta. Declining does not affect your use of the website, including the demo form.

• What the pixel records: that a page was viewed and, when the demo form is submitted successfully, that a lead was created. The content of the form is not sent to Meta. Meta receives these events together with technical data such as your IP address, browser details and the identifiers stored in the cookies below.
• Why: to measure how our advertising performs, and to show our ads on Meta's platforms to people likely to be interested in the Service.
• Cookies it sets: _fbp (a browser identifier) and, when you arrive from a Meta ad, _fbc (the ad click). Both are first-party cookies on clickscales.com and last about 90 days.
• Your choice: stored in your browser's local storage (not in a cookie) for 12 months, so we do not ask on every visit. It is not sent to us.
• Changing your mind: use "Cookie settings" at the bottom of the home page at any time. Withdrawing consent stops the pixel and deletes its cookies from your browser. It does not affect data sent before the withdrawal. You can also block cookies in your browser settings, and manage how Meta uses your data for ads in your Meta ad preferences.
• Meta's role: Meta uses the data it receives under its own Privacy Policy and may process it in the United States, under the EU-US Data Privacy Framework in which Meta participates. For visitors in the EU/EEA, ClickScales and Meta are joint controllers for collecting and transmitting this data, and the legal basis is your consent.
• Your rights: see Section 9, or write to koren@clickscales.com.

12. Children

The Service is a business tool and is not directed to children under 18. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date, and for material changes affecting how we handle Google user data or other personal data, we will notify Customers through the Service or by email.

14. Contact

ClickScales · Israel
Email: koren@clickscales.com