Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we may collect your name, email address, and any other information you provide during registration.

1.2 Chat and Usage Data

When you interact with TachlisAI, the Product processes your chat inputs and generates responses in order to provide its core functionality. The extent to which this data is stored and used beyond delivering the service depends on your subscription plan (see Section 2 for details).

In addition, we may collect the following usage-related data:

• Usage patterns and session metadata (for example: session duration, feature usage, timestamps)
• Feedback submissions, bug reports, and survey responses
• Documents or files you upload to the Product

Not all users' chat data is retained or used in the same way. Please review Section 2 to understand how your plan affects data usage and retention.

After you allow Phone & apps sharing, available phone details (model, operating system version/build, security patch and settings status) accompany typed or dictated chat messages to TachlisAI and may be sent to OpenAI for phone help. This includes whether WhatsApp, Gmail, Google Maps, Waze and Outlook can open, plus their versions on Android when available. Sharing is optional. Your consent and category choices are saved for this account on this phone; details refresh automatically before each message. You can turn off sharing or individual categories in Settings > Phone & apps. Signing out suspends sharing. Details already submitted follow normal chat and job retention. We do not receive a full installed-app list or read other apps’ private content through this feature.

1.3 Automatically Collected Information

We may automatically collect technical information such as your IP address, browser type, device type, operating system, and general location data derived from your IP address.

2. How We Use Your Information

2.1 Free Tier Users

Free use includes the iOS and Android apps while they are provided at no charge. If you use TachlisAI on a free plan, your chat conversations may be used by the Company to help improve the Product. This is how we keep TachlisAI free - your usage helps us make the experience better for everyone. Specifically, we may use chat data from free-tier users to:

• Improve the quality and accuracy of responses
• Refine content filtering and the hashkafa sensitivity engine
• Fix bugs and improve overall performance
• Generate anonymized, aggregate usage insights for internal analysis

We treat your data with care. Chat data used for improvement purposes is handled by authorized personnel and third-party AI providers (see Section 3) and is not made publicly available. By using TachlisAI on a free plan, you grant the Company a license to use your chat data for the purposes described above.

2.2 Paid Tier Users

If you subscribe to a paid plan, your chat data will not be used for model training or Product improvement unless you explicitly opt in to data sharing. Paid plan users retain greater control over how their data is used, as described in the applicable subscription terms.

2.3 General Uses

Regardless of your plan, we may use your information to:

• Provide, operate, and maintain the Product
• Respond to your inquiries and provide customer support
• Send you product updates, security alerts, and administrative messages
• Comply with legal obligations and enforce our terms

3. Third-Party Data Processing

3.1 AI Service Providers

When you type or submit a prompt, choose an attachment or image, or use a voice feature, TachlisAI collects the content you intentionally provide. To fulfill that request, TachlisAI may also include relevant prior chat messages needed for conversational context. This information can contain personal data if you include it.

TachlisAI sends prompts, relevant chat context, selected attachments and images to OpenAI, L.L.C. to generate, classify, and safeguard AI responses and images. When you choose a voice feature, audio or transcript data may be sent to OpenAI, L.L.C., AssemblyAI, Inc., or ElevenLabs, Inc. to transcribe speech or create spoken audio. We do not send these providers your contacts, photo library, camera roll, or other device data that you did not choose to submit.

In the iOS app, AI chat remains unavailable until a disclosure naming these data categories and recipients is shown and you affirmatively tap Allow AI processing. Tapping Not now withholds permission and no chat, attachment, image, audio, or transcript is sent to these providers. After permission is granted, data is sent only when you submit content or activate a voice feature.

These companies process the data as service providers for the feature you request. We transmit it using encrypted connections, restrict the purpose of processing, and require it to be protected under privacy and security terms at least as protective as those described here. TachlisAI does not sell this data or allow these providers to use it for advertising.

You can review the providers' policies at OpenAI, AssemblyAI, and ElevenLabs.

3.2 Cloud Infrastructure

We use Amazon Web Services (AWS) as our cloud infrastructure provider. Your data is stored and processed on AWS servers. AWS maintains industry-leading security certifications and compliance standards. For more information, please refer to the AWS privacy and security documentation.

3.3 Analytics Services

We use Google Analytics to understand how people reach and use TachlisAI. Google may process browser and device information, referral source, general location derived from an IP address, sanitized page routes, and interaction events.

We configure Analytics without advertising storage, ad personalization, Google Signals, Analytics cookies, or TachlisAI user identifiers. We omit URL query strings and replace account, organization, conversation, share, and message identifiers with generic route labels. We do not send chat content, prompts, uploaded files, account names, or email addresses to Google Analytics.

3.4 No Sale of Data

We will not sell, license, or distribute your personal data to any third party other than as described in this Privacy Policy, except as required by applicable law or legal process.

3.5 SMS, WhatsApp, and mobile number privacy

New online accounts may require a mobile number and a one-time verification code. Twilio processes the number to check its line type and deliver and verify the code. We retain verification status, the last four digits, and a number fingerprint to enforce one account per number and prevent signup abuse. This security record can remain after account closure to prevent repeated registrations. Signup verification does not enroll you in marketing messages or SMS chat.

If you text START and complete SMS setup, or add and verify a mobile phone number for TachlisAI text chat, we use your number, setup status, verification status, consent and opt-out records, channel, and message metadata to verify access, deliver user-initiated SMS or WhatsApp chat and customer-care responses, process HELP, STOP, START, TERMS, and account-control requests, and operate the requested channel. When you initiate a WhatsApp conversation with an official TachlisAI business sender, we use your WhatsApp number and inbound message to provide and secure the conversation you requested.

WhatsApp message content, attachments, voice notes, quoted-reply references, Twilio message identifiers, timestamps, and delivery or read events may be processed to create or continue your personal TachlisAI chat, apply your settings, prevent duplicates, transcribe voice notes, create requested voice or image responses, and maintain chat history. WhatsApp never exposes organization conversations. The AI-provider processing described in Section 3.1 also applies when you request those features through WhatsApp.

Twilio Inc. and Meta Platforms, Inc. (including WhatsApp) process phone numbers, message content, media, and delivery metadata as communications providers so messages can be transmitted, delivered, secured, billed, and reviewed for platform-policy compliance. Temporary TachlisAI-generated WhatsApp voice audio is configured to expire from our uploads storage after one day. Twilio and WhatsApp may retain or delete data under their own terms and policies. You can review the providers' policies at Twilio and WhatsApp.

Mobile information collected for SMS or WhatsApp messaging, including mobile phone numbers and consent records, is not sold, rented, or disclosed to third parties or affiliates for their marketing or promotional purposes. We share it only with service providers as described here, at your direction, or when legally required.

Message frequency varies. Message and data rates may apply. Send STOP on a channel to opt out of that channel, HELP for help, or START to begin setup or resume messages. SMS and WhatsApp opt-out state is maintained separately.

4. Google Workspace Integrations

Connecting a Google account is optional. If you choose to connect Google Workspace, TachlisAI requests OAuth permission to access only the Google services needed for the features described below. You can use TachlisAI without connecting Google Workspace.

4.1 Google Data We Access

Depending on the permissions you grant, TachlisAI may access:

• Permission to send email you review and confirm; TachlisAI does not request permission to search or read your Gmail inbox in light access mode
• Google Calendar lists, events, event details, and attendee information so you can review and schedule events
• Names, metadata, and content only for Drive files TachlisAI creates after you review and confirm the action
• Google Docs, Sheets, and Slides content only for files TachlisAI creates
• Your Google account identifier, name, and email address so we can display and bind the connected account to your TachlisAI account

4.2 How We Use Google Data

We use Google user data solely to provide and, where applicable, improve the specific user-facing Google Workspace features you request, such as preparing an email, listing calendars or events, scheduling an event, or creating an app-managed Drive file. We do not use Google user data for general Product improvement, analytics, advertising, profiling, or any purpose unrelated to those requested features.

Email can be sent only from the Google account that the signed-in TachlisAI user connected. TachlisAI does not allow a user to choose, spoof, or impersonate another sender address.

Actions that change external data, including sending email, creating events, or writing files, are prepared for review and run only after the signed-in user explicitly confirms them in TachlisAI.

4.3 Storage, Sharing, and Retention

Google OAuth tokens and pending action payloads are encrypted before storage. Pending action payloads are short-lived and are cleared after completion. Google content may appear in the TachlisAI conversation where you requested it so TachlisAI can provide the requested feature. It remains Google user data and is excluded from every general chat-improvement, analytics, Product-improvement, and model-development practice described elsewhere in this Privacy Policy.

When necessary to fulfill your request, relevant Google content may be transmitted to our cloud infrastructure and AI service providers acting as processors for TachlisAI. We limit that processing to delivering, maintaining, or securing the user-facing feature you requested. Those processors may not use Google user data for their own purposes, advertising, profiling, or AI or machine-learning model development, improvement, or training.

TachlisAI does not use Google Workspace APIs or Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. This applies regardless of your subscription plan. Google user data is not sold, used for advertising or profiling, provided to data brokers or information resellers, used to determine creditworthiness or for lending, or used to create databases unrelated to the user-facing feature you requested.

Humans do not read Google user data except when you affirmatively authorize access for support, when needed for security or abuse investigation, when required by law, or for strictly limited internal operations necessary to provide or secure the requested feature and permitted by Google's Limited Use requirements. We do not transfer Google user data except to service providers acting on our behalf where necessary to provide or secure the requested feature, or as legally required.

You can disconnect Google Workspace in TachlisAI Settings at any time. Disconnecting revokes the connection where supported and deletes the stored connection record. Deleting your TachlisAI account removes stored Google connection, OAuth state, and action records associated with your TachlisAI account, subject to legal obligations that may require limited retention.

4.4 Google API Limited Use

TachlisAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Storage and Security

We take the security of your data seriously. Your data is hosted on Amazon Web Services (AWS) infrastructure, and we employ multiple layers of protection, including:

• Encryption in transit via TLS/HTTPS for all data transmitted between your device and our servers
• Encryption at rest using industry-standard key management for all stored data, including databases, file storage, and system logs
• Authenticated access with role-based access controls, ensuring only authorized personnel can access user data
• A web application firewall (WAF) to protect against common web-based threats
• Private network architecture that isolates application services from the public internet
• Continuous point-in-time backups with deletion protection to ensure data durability and recoverability
• Immutable audit logs to maintain a tamper-proof record of system activity
• Real-time monitoring and alerting to detect and respond to potential security incidents

While we implement commercially reasonable measures to protect your data, no system is perfectly secure. We cannot guarantee absolute security and encourage you to avoid sharing sensitive personally identifiable information (such as Social Security numbers, financial account details, or medical information) through the Product.

6. Data Retention

We retain your account information for as long as your account is active or as needed to provide you with the Product. Chat data from free-tier users used for Product improvement may be retained indefinitely in anonymized or aggregated form. You may request deletion of your personal data by contacting us at the address below, subject to any legal obligations requiring retention.

7. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal data, including:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate data
• The right to request deletion of your personal data
• The right to withdraw consent to data processing (where applicable)
• The right to data portability

To exercise any of these rights, please contact us using the information provided in Section 11 below. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

8. Children's Privacy

TachlisAI is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete such information promptly.

9. Important Disclaimers

TachlisAI does not provide halachic rulings (psakim), legal advice, medical advice, or financial advice. Any information provided by the Product is for general informational and educational purposes only. You should not rely on any output from the Product as a substitute for professional advice.

The Product is provided on an "as is" and "as available" basis, without warranties of any kind, whether express, implied, or statutory.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on our website and updating the Effective Date above. Your continued use of the Product after any changes constitutes your acceptance of the revised Privacy Policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: