Privacy policy
Last updated: 4 November 2026
BizStaff is a service of GABMAN INVESTMENTS LTD (גבמן השקעות בע״מ), Company No. 513969626, 10 Herzl St, Tel Aviv-Yafo 6688318, Israel. Email: contact@bizstaff.ai.
This policy explains what information BizStaff handles, why, with whom it is shared and what rights you have. In this policy, "we" and "us" mean GABMAN INVESTMENTS LTD.
1. Our two roles
- Our website, the free demo and our customers' accounts. For this information we decide how it is used.
- Customers of a business that uses BizStaff. When someone writes to or talks with a business's agent, the business decides how that information is used, and we process it on the business's behalf under our data processing agreement. Please also read the business's own privacy policy.
2. What we collect
When you use our website and the free demo
- The business website address you enter.
- Information we read to build the demo: the business's public website, its public business listing on Google (address, phone, opening hours), public web pages about the business and the booking, ordering or scheduling link it publishes.
- The messages you type and the voice you send to the demo agent.
- Technical information such as your IP address, which we use for security checks (Cloudflare Turnstile) and to limit abuse.
- If you leave your details: your name, email, phone number, the number of people in your business and any note.
When a business is our customer
- Contact and billing details of the business's team, the business information it gives us, its type of business and the agent's settings.
- Payments are handled by our payment providers, PayMe (Isracard) and Airwallex. We do not store card numbers.
When people talk to a business's agent (on the business's behalf)
- Messages sent through the business's website chat, WhatsApp or text messages (SMS) to and from the business's number. Anyone can reply STOP to stop texts from a business's number, and HELP for help.
- Phone calls with the voice agent are recorded and transcribed, and the caller is told so when the call starts: the agent's opening line says that it is an AI assistant and that the call is recorded. The voice is processed to understand and answer the caller. The agent learns from each call: a short note about the caller, and questions it could not answer. The business can listen to its calls and read their transcripts on its own page while they are kept.
- The person's phone or WhatsApp number, what they asked for (for example a date, a service, an appointment or an order), links we sent and requests passed to the business's team.
- A short note about the person, so the agent can pick up where the last conversation ended (for example their name and requests). The agent is instructed to leave out payment details, ID numbers, passwords and health information.
Sensitive information
At clinics, dental and medical offices, law and accounting firms, insurance agencies and similar businesses, the agent asks only for what is needed to book an appointment or a consultation, and is instructed not to ask for medical details or the details of a legal or financial matter. BizStaff is not a medical records or patient-intake system. Please do not send such details, card numbers or ID numbers to an agent. When a business works with children, the agent asks only what registration needs: the parent's name and contact details and the child's age.
3. How we use information
- To build and run the business's agent and answer its customers.
- To share the business's own booking, ordering or scheduling link, and for hotels, to check availability on the hotel's booking site and send booking links with the dates.
- To pass requests the agent should not handle to the business's team.
- To call a person back when they ask for it.
- So the business's agent keeps learning about the business: every week from the business's website and public reviews, and from answers the business's team gives its customers. What it learns is used only for that business's agent, and the business can see and remove it.
- To keep the service secure, prevent abuse, provide support and bill customers.
We do not sell personal information, we do not share it for advertising, and we do not use conversations to train AI models. When we say the agent "learns", we mean notes and answers we store for that business's agent only. Mobile phone numbers and text-messaging consent are never shared with third parties or affiliates for their marketing.
Legal bases (EU and UK GDPR). We use your information to do what you ask (building a demo, answering you) and to perform our contract with customers; for our legitimate interests in running, securing and improving the service and answering business inquiries; to meet legal duties, such as keeping tax records; and with your consent where we ask for it, which you can withdraw at any time. For information about a business's customers, the business decides the legal basis.
Do you have to give us information? No law requires you to. It is your choice, but without it we cannot build a demo, answer you or provide the service.
Automated decisions. The agent answers questions automatically, but we do not make decisions about people that have legal or similarly significant effects on them by automated means.
4. Service providers
We use these providers to run the service. They process information for us under their data processing terms:
- Cloudflare: hosting, data storage, security checks and email delivery.
- OpenAI: generating the agent's text answers and researching public information about a business.
- ElevenLabs: voice conversations (speech to text and text to speech).
- Twilio: phone numbers, calls and SMS.
- Meta (WhatsApp): WhatsApp messages.
- Google: public business listing information about a business.
- PayMe (Isracard) and Airwallex: payments.
These providers may process information outside Israel, including in the United States and the European Union. The European Commission and the UK recognize Israel as giving adequate protection to personal data. Where a provider is in a country without such recognition, we rely on the provider's certification under the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses in its data processing terms, and on the provider's undertakings as Israel's regulations on transfers abroad require. You can ask us for a copy of these safeguards.
5. How long we keep information
- Demo agents are deleted after 7 days, or after 30 days if you leave your details.
- Details you leave in the demo are kept for up to 180 days, unless you become a customer.
- Conversations with a business's customers are kept so the agent can follow the conversation, and are deleted after 72 hours without new messages, unless the business sets a different period.
- Customer notes are kept for up to 90 days after the person's last conversation, unless the business turns them off. A person can ask the agent or the business to forget them, and the note is deleted right away. Conversations and recordings are then deleted on the schedule below, or sooner if the business asks us.
- Requests passed to the business's team are kept for 30 days.
- Call recordings and transcripts are stored with our voice provider and are deleted after 30 days. A short summary of each call is shown to the business for the same 30 days.
- What the agent learned (questions it could not answer, the team's answers and short summaries of public reviews, without reviewers' names) is kept while the business is a customer, and the business can remove it.
- Voice from the demo is kept by our voice provider for up to 30 days, like call recordings. Demo messages are deleted with the demo agent.
- Customer and billing records are kept while the business is a customer and then for as long as tax and accounting law requires, generally 7 years in Israel.
- Security counters are kept for up to 2 days.
6. Cookies and similar technologies
We do not use advertising, analytics or tracking cookies, and our fonts are served from our own site. We store only what the service needs: the website chat saves a conversation ID in the browser so a person can continue the conversation, our website remembers the language you chose, and the security check (Cloudflare Turnstile) may use what it needs to tell people from bots. Because these are needed for the service you asked for, we do not show a cookie banner.
7. Your rights
You may ask to see, correct or delete your information, to restrict or object to its use, or to receive a copy in a portable format, and you may withdraw a consent at any time, under Israel's Protection of Privacy Law, 5741-1981, and, where they apply, the EU or UK General Data Protection Regulation and US state privacy laws (for California residents, see section 8). Write to contact@bizstaff.ai. We answer within 30 days. If your request is about a conversation with a business, you can also contact the business, and we will help the business answer you. You may also complain to Israel's Privacy Protection Authority or to the data protection authority where you live.
8. California residents (CCPA)
If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA), gives you these rights about personal information we hold about you for our own purposes, for example as a visitor to our website, a user of the demo or a contact at one of our customers:
- To know and access the categories and the specific pieces of personal information we collected about you, where it came from, why we use it and to whom we disclose it.
- To delete personal information we collected from you, except what the law lets or requires us to keep (for example tax records).
- To correct personal information that is inaccurate.
- To opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.
- To limit the use of sensitive personal information. We use sensitive personal information, such as the content of messages and call recordings, only to provide the service you or the business asked for, as the CCPA permits, and never to infer characteristics about you.
- Not to be discriminated against for using any of these rights.
In the past 12 months we collected these categories of personal information, from you, from the business you contacted and from public sources about businesses: identifiers (name, email address, phone number, IP address); customer records (business contact and billing details); commercial information (the plan and payments); internet activity (messages in the demo and the website chat); audio information (call and voice recordings); and professional information (the business you work for). We use them for the purposes in section 3, disclose them only to the service providers in section 4 for those purposes, and keep them for the periods in section 5.
How to make a request: email contact@bizstaff.ai and say which right you want to use. We confirm within 10 business days and answer within 45 days. To protect you, we verify your identity by matching what you tell us with the details we hold, for example the email address or phone number you used, and may ask for one more detail. An authorized agent may make a request for you with your signed permission. If your request is about a conversation with a business that uses BizStaff, we act as that business's service provider: we pass the request to the business and help it answer you.
9. Security
Information is sent over encrypted connections (HTTPS), access is limited to people who need it, and service keys are stored separately from the code. No system is completely secure, and we will report serious security incidents as the law requires.
10. Children
BizStaff is a service for businesses and is not directed to children under 16. A business whose customers include children is responsible for what it asks them, and the agent keeps to what registration needs.
11. Changes
When we change this policy we update the date above. We tell customers about material changes at least 30 days in advance.