Esek Privacy Policy

Last updated: November 4, 2026

1. Who We Are

Esek (available at esek.io; "we", "our", "us") is an AI workspace for businesses. It answers phone calls and customer messages, books appointments, manages customer records, and runs sales and marketing campaigns. It connects businesses ("Business Customers") with their customers ("End Users") by phone, WhatsApp and, where enabled, Instagram and Facebook Messenger. We act as a Technology Provider under the Meta Business Platform and process data on behalf of our Business Customers in accordance with Meta's Platform Terms and Business Messaging guidelines. This policy explains how we collect, use, store, share and delete personal data.

2. Data We Collect

We collect data from two audiences: Business Customers who register to use our platform, and End Users who communicate with those businesses by phone, WhatsApp, Instagram, or Facebook Messenger.

From Business Customers

From End Users (via WhatsApp conversations)

Connected Instagram and Facebook Messenger accounts

When a Business Customer enables these channels and authorizes a connection, we receive the selected professional Instagram account or Facebook Page identifier, account name, authorizing account identifier, granted permissions, and access credentials. We encrypt the credentials and use them to operate that business's messaging connection.

For customers who message a connected account, we receive a Page-scoped Messenger customer identifier or Instagram-scoped customer identifier, available profile name, message content, supported attachments, and any reply, story, or referral context supplied by Meta. We keep each account's conversations separate. Authorized staff can link a channel identity to an existing customer record. We do not infer that two people are the same person from a matching profile name. Supported attachments may be stored privately so staff can view them after the provider's temporary download link expires.

When authorized staff open a conversation or ask Iska (Copilot) for a customer profile, we may also retrieve the available profile name, Instagram username and profile link, and profile photo URL from Meta. We store an available display name on the channel identity; the additional profile fields are fetched on demand rather than saved to that customer record.

Authorized staff can read and reply to these messages. When the business enables AI assistance and the applicable consent requirements are met, message text and relevant history are processed by the AI providers described below. The retention and deletion rules for these channels are described in section 8.

Connected Zoom accounts

Each appointment host can choose to connect their own Zoom account. We receive the host's Zoom account and user identifiers, account email, granted permissions, and authorization tokens. We encrypt the tokens and use the connection to create, reschedule and delete meetings for confirmed online appointments. Meeting requests contain the business and service name, scheduled time and duration, a booking reference, a generated passcode and security settings. They do not contain the customer's phone number, email or an attendee list.

We store the connection identity, encrypted tokens, meeting identifiers, participant join URLs and passcodes, and synchronization status. To recover an interrupted meeting creation without duplicating it, we read scheduled meeting listings and the matching meeting's details. Unrelated listing data is not saved as Esek meeting records. This integration does not access recordings, transcripts, AI Companion summaries, participant rosters or real-time media.

The host or an authorized administrator can disconnect Zoom in Esek. Disconnecting removes the stored connection and retained Zoom meeting access data. When Zoom notifies us of removal or deauthorization, we clear authorization tokens, account identity, granted permissions, meeting identifiers, join URLs and passcodes. Existing Esek appointment and business records retain the periods in section 8. Meetings already created may remain in the host's Zoom account. Privacy and deletion requests can be sent to privacy@esek.io.

From End Users (via AI phone calls)

When a Business Customer turns on the AI phone assistant, calls forwarded to the phone number we provide are answered by an AI voice assistant on that business's behalf. Business Customers configure the opening greeting. For each such call we collect:

AI calls and voicemail. During AI answering, call audio is processed live. We keep the written transcript, summary and message as the record of the call. Where call recording is enabled, we keep a private recording of the call audio, both the caller's side and the assistant's side, for up to 30 days, or longer where section 8 says so. Authorized workspace members can play it back. We also use it to investigate problems and check quality. It is then deleted automatically. It is not used to train AI models and is not shared for advertising. Depending on where the call comes from, callers may hear at the start of the call that it is recorded. Erasing a call, or deleting the workspace, deletes this recording immediately, except as section 8 says. When the business has insufficient minutes and balance, direct phone calls switch to voicemail: callers hear a greeting asking them to leave a message after the tone, and we privately store up to two minutes of their message. Authorized workspace members can play it. Erasing the caller’s record also deletes this recording.

Calls answered by the AI phone assistant end automatically after ten minutes.

Optional device permissions

3. Legal Basis for Processing

4. How We Use Data

We use WhatsApp, Instagram, and Facebook Messenger data strictly for the purposes described above. We do not use End User data for advertising, profiling, or any purpose unrelated to providing the messaging service.

5. Data Sharing

We do not sell personal data. We do not sell or share mobile numbers or SMS opt-in data with third parties for their marketing (see Text messages). Data may be shared with the following third-party processors:

The full list of sub-processors, with what each one receives and where it processes data, is on our Sub-processors page.

Microsoft Outlook Calendar. Each appointment holder can choose to connect their own Microsoft account. We receive the account email and identifier and read event times and availability status to prevent overlapping bookings for that person. Event titles, descriptions and attendees are not requested or stored. With the holder’s permission, we also create a separate Esek calendar and write the business’s booking details there. Without that permission, the connection is read-only and checks availability only. We store authorization tokens for ongoing synchronization. A holder or business administrator can disconnect the calendar in booking settings; this deletes our stored connection and tokens.

6. Google Account Data

Google connections are optional. Esek requests permission through Google's consent screen when you choose a feature that needs it. Google Sign-In does not itself grant access to your files, calendars or meetings. You can use Esek without connecting Google; features that import or synchronize Google data require the relevant permission.

Storage and sharing. Google account data is processed by our backend and stored in our access-controlled Google Cloud infrastructure described in sections 5 and 7. Data travels over TLS; stored integration tokens are encrypted. Authorized business staff can access imported records according to their workspace permissions. When you enable AI features and give the applicable in-app consent, selected document content and derived knowledge can be sent to the AI processors named in section 5 to classify business information, generate responses or produce requested drafts. Google-generated session summaries are imported without an Esek AI call; generating a draft from a staff-supplied transcript is a separate action requiring AI consent. We share Google data only as needed for these user-facing features with consent, for security, or as required by law. We do not sell Google user data, use it for advertising, or use it to train generalized AI models.

Retention and deletion. Sign-in identity is retained while your Esek account exists. Integration credentials remain while the connection exists; disconnecting a calendar deletes its stored connection and tokens. Removing a linked document source deletes that source, its stored credentials and its imported knowledge content. Disabling synchronization stops future reads but keeps the source. Imported catalog records, bookings and session documentation remain workspace records until separately deleted or the workspace is deleted, under section 8. Disconnecting or revoking Google access does not erase those records or delete the original Google files and calendars. Workspace deletion removes associated data from the live service and from recovery backups within 30 days. To request access, correction or deletion, contact privacy@esek.io or use our data deletion instructions.

Your controls. You can remove linked sources in business settings, disconnect a calendar in booking settings, or revoke Esek's Google permissions at your Google Account permissions page. Revocation stops future authorized access; reconnecting requires consent again.

Esek's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. This also applies to data derived from that information. Our personnel may read Google user data only with your affirmative agreement to view specific data, when necessary for security or legal compliance, or when aggregated for internal operations as permitted by that policy.

7. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States, where our servers are hosted and where Meta and most of our sub-processors operate. Each sub-processor and the place where it processes data are listed on our Sub-processors page. For transfers from the EU, the EEA and the UK, we rely on the EU-US Data Privacy Framework (including its UK Extension) where the recipient is certified under it, and on Standard Contractual Clauses (with the UK Addendum for UK data), together with data processing agreements with each processor.

8. Data Retention

Whose record a call is. A record of a call to a business is that business's own customer record, in the same way a written note of the call would be. It is not part of the personal account data of the staff member who works there. Two consequences follow, and we would rather state them plainly than leave them to be discovered:

If you called a business that uses Esek and you want the record of your call erased, ask the business, or write to us at privacy@esek.io. Erasing a call clears the caller's phone number, the transcript, the summary, any message taken, and any recording of the call we still hold, other than one section 8 says must be kept, and marks the call as erased on request. What remains is how long the call lasted and what it cost the business, which says nothing about who called or what was said. We keep that much because it is the evidence for a charge already made.

Disconnecting a social account and deleting its data. Disconnecting Instagram or Messenger stops new messaging through that connection and clears its stored credentials. It does not by itself erase existing conversations or records the business already holds. To request erasure of social-platform data, contact privacy@esek.io with the connected account or Page and the business concerned. We verify the request and its scope, including records shared with other channels, and confirm the outcome. A request that still needs verification or review is not treated as a completed deletion. Customers who do not have an Esek account can use the same contact address.

When Meta sends us a verified authorization-revocation notice, we stop the affected connection and clear its credentials. When Meta sends a data-deletion request, we also begin erasure of the associated social data and return a confirmation code and status-page link. Shared records, exports, recovery backups, or AI history may require additional review before the request can be marked complete. Removing a disconnected channel from the connection list only hides that connection; it does not erase its history.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data, or to object to or restrict certain processing. To exercise any of these rights, contact us or see our Data Deletion page for the deletion request process. We will respond within 30 days.

10. Children's Data

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

11. Cookies and Local Storage

The web application uses a cookie to keep you signed in and a short-lived cookie that protects connecting a Google account. It keeps your sign-in, your settings and your cookie choice in your browser's local storage. If you arrive through a referral link, a cookie remembers the referral for 60 days. The application loads Google's libraries only when you connect Google Drive, loads Paddle's checkout only when you pay, and stores a notification token only if you turn on browser notifications.

Our marketing website and signup flow also store, in your browser, a randomly generated identifier and the campaign parameters from the address you arrived on. We use them to measure how the site performs and to attribute a signup to the advertisement that led to it. They are set by us and stay in our own systems, except for advertising measurement described below: for visitors who accepted marketing cookies, or who are outside the EU, the EEA and the United Kingdom and have not declined them, the Meta ad click identifier from that address is sent to Meta with the signup, as described under Meta (Conversions API) in section 5.

Our marketing website additionally carries advertising tags from Meta, Google Ads and OpenAI Ads. These tags set cookies and report page views and conversion events to their providers so we can measure and attribute our advertising. They load only after consent. Visitors in the EU, the EEA and the United Kingdom are asked before they load; elsewhere they load without a prompt. A browser that sends a Global Privacy Control signal is treated as having declined, wherever the visitor is. Advertising tags do not load automatically on ordinary application screens. A completed web signup can load the Google Ads and OpenAI tags to report that conversion under the same consent controls.

OpenAI Ads measurement uses the ad click reference (oppref), a browser reference, the site origin, event type and time, and a random signup event identifier. Its first-party cookies request lifetimes of 30 days for the click reference and 365 days for the browser reference. Where automatic advanced matching is enabled, the OpenAI Pixel can detect supported customer details on the website, normalize and hash them in the browser, and send the hashes with conversion events. Opening WhatsApp is recorded as an intent event, not as a received enquiry. We record an incoming source-labelled WhatsApp message in our own analytics; we do not send its text or the sender's phone number to OpenAI Ads through this integration. Declining marketing measurement prevents future OpenAI events and removes its measurement cookies.

12. Security

Connections between your device and Esek, and between Esek and external providers, use TLS. Since October 30, 2026, connections between our services, database and cache inside our production environment also use TLS with verified certificates. Passwords are hashed with bcrypt. Database access is restricted to authenticated services inside our private network. Access tokens received during WhatsApp Embedded Signup or Instagram and Messenger authorization are stored encrypted and scoped to the minimum required permissions.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered Business Customers. Continued use of the platform after changes constitutes acceptance of the updated policy.

14. Contact

Questions about this policy? Contact us at privacy@esek.io.

15. Who we are

The controller of the personal data described in this policy is Zak Goichman, trading as Esek, a sole proprietor (עוסק מורשה) registered in Israel. For customer messaging data processed on a Business Customer’s behalf, that business determines the purposes of processing and Esek acts as its processor.

Our Israeli business registration number is available on request from legal@esek.io.