Privacy Policy

1. General

This privacy policy governs the manner of collection, use, storage, and protection of personal and business information within the framework of Upperfloor's services, including the development and deployment of AI agents, business automation systems, and connection to Meta platforms (WhatsApp Business API, Instagram API, Messenger).

Details of the database owner:

Use of our services constitutes informed consent to the terms of this policy.

The policy is worded in the masculine form for convenience only, and refers to all genders alike.

2. Information Collection

Upperfloor may collect and process information within the framework of its ongoing activity, including:

  • Contact details of business personnel (name, phone, email)

  • The content of WhatsApp and Instagram messages sent and received through the platform

  • The content of inquiries or requests from the business's customers

  • Operational information provided within the framework of the specification

  • Documentation of conversations or tasks for the purpose of operating the AI agent

  • Technical identifiers: Phone Number ID, WABA ID, Access Tokens

  • Usage data and logs for monitoring and security purposes

The information is collected directly from the client, from its customers, or from Meta platforms via official APIs.

3. Use of Information

The information will be used for the purpose of:

  • Adapting the intelligence agent to the needs of the business

  • Operating the system in accordance with the approved specification

  • Receiving, processing, and sending WhatsApp and Instagram messages on behalf of the client

  • Providing customer service, fixes, and ongoing updates

  • Improving system performance or investigating malfunctions

  • Complying with regulatory requirements and Meta policy

No use will be made of the information for any other purpose without the client's prior consent.

4. Use of Meta Platforms

Upperfloor is connected as an approved Tech Provider to Meta platforms, and uses the following official interfaces:

  • WhatsApp Business Cloud API – for sending and receiving WhatsApp messages on behalf of our clients

  • Instagram Graph API – for managing messages, comments, and automations on Instagram

  • Facebook Login for Business – for the process of connecting client accounts (Embedded Signup)

Use of these platforms is subject to:

  • WhatsApp Business Platform Terms of Service

  • Meta Platform Terms

  • Instagram Platform Policy

Information collected through Meta platforms is used solely for providing the service and will not be shared, sold, or used for our own marketing purposes.

4a. Use of the TikTok Platform

Upperfloor is integrated as a partner platform of TikTok through the TikTok Business Messaging API, and uses the following official interfaces:

  • TikTok Business Messaging API – for receiving and sending direct messages (Direct Messages) in our clients' TikTok Business accounts

  • TikTok Login Kit – for the process of authenticating and authorizing the connection of client accounts

Use of this platform is subject to:

  • TikTok Business Messaging API Terms

  • TikTok for Developers Terms of Service

  • TikTok Business Products (Data) Terms

  • TikTok Privacy Policy

Information collected through the TikTok platform (including message content, user identifiers, and conversation metadata) is used solely for the purpose of providing the service to the business client who approved the connection, and will not be used for our own marketing purposes, will not be sold, and will not be transferred to third parties who have not been approved.

4b. Use of the Google Platform

Upperfloor integrates with Google Calendar services through the Google Calendar API, for the purpose of managing meetings and coordinating availability for our business clients who approved the connection. We use the following official scopes:

  • calendar.events – creating, reading, and updating calendar events on behalf of the client (including creating Google Meet links for meetings)

  • calendar.freebusy – checking availability (busy/free times) in the client's calendar for the purpose of displaying available times for scheduling a meeting

  • userinfo.email – identifying the email address of the connected account

The connection is carried out via an official Google authorization process (OAuth 2.0), and the client can disconnect it at any time.

The use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements. Accordingly:

  • Information received from Google Calendar is used solely for providing the meeting-coordination service to the business client who approved the connection.

  • We do not sell this information, and we do not transfer it to third parties except for the purpose of providing the service (storage infrastructure) or as required by law.

  • We do not use information from Google Calendar for advertising purposes or for training artificial intelligence models (AI/ML).

  • Access to the information is limited to providing the declared functionality only.

Google's access tokens (access/refresh tokens) are stored in encrypted form, and are used solely for operating the calendar connection.

5. Confidentiality and Protection of Information

The company undertakes to fully safeguard the client's privacy, in accordance with the engagement agreement and the NDA clauses. In particular:

  • It will not make any use of the client's business, personal, or operational information for a purpose not directly related to the project

  • It will not transfer, sell, or disclose the information to third parties, except with the explicit approval of the client or as required by law

  • The information is protected by advanced security measures, including: SSL/TLS encryption, role-based access restriction, ongoing monitoring, and encrypted backups

  • Access to the information is limited to the relevant technical team only

6. Use of Tools and Third-Party Providers

For the purpose of operating the system, Upperfloor makes use of external platforms, including:

  • Meta WhatsApp Business Cloud API – official WhatsApp interface

  • Meta Instagram Graph API – official Instagram interface

  • TikTok Business Messaging API – official TikTok interface for managing direct messages

  • Evolution API – management of WhatsApp connections

  • Chatwoot – conversation inbox management system

  • n8n – automation and workflow system

  • Anthropic / Claude – advanced language models

  • OpenAI – advanced language models

  • Google Workspace APIs – calendar, mail, tasks

  • AWS / Hetzner / Contabo – storage and cloud services

In addition, the upperfloor.ai website makes use of monitoring and analytics tools for the purpose of improving the user experience and measuring marketing effectiveness:

  • Meta Pixel — tracking of website visits, clicks, and form completions. The information is used to improve targeted advertising on Meta platforms.

  • Microsoft Clarity — session recording and heatmaps for the purpose of understanding visitor behavior on the website. Sensitive information entered into forms is automatically masked.

  • Google Analytics 4 — analysis of visitor traffic, sources of arrival, viewed pages, and conversion events. The information is used to improve the website and to measure marketing performance.

These tools are loaded only after the user's consent via the cookie banner. Their use is subject to the privacy policy of each provider (Meta, Microsoft, Google).

Use of these services is carried out solely for the purpose of providing the service to the client, while maintaining the principles of privacy protection.

The company selects solely recognized providers with high security standards.

6a. Use of Cookies

The website uses cookies — small text files that are stored in your browser. The cookies are used for the purpose of:

  • Traffic analysis and improving the user experience (Google Analytics, Microsoft Clarity)

  • Measuring advertising effectiveness and ad targeting (Meta Pixel)

  • Proper operation of the website

The cookies active on the website:

  • Meta: _fbp, _fbc — advertising tracking

  • Microsoft Clarity: _clck, _clsk — behavior analysis

  • Google Analytics: _ga, _gid — traffic analysis

Analytics and marketing cookies are loaded only after the explicit consent of the user via the cookie banner displayed upon entering the website.

You may block or delete cookies through your browser settings. Blocking cookies may affect the browsing experience on the website.

7. Transfer of Information Abroad

Some of the providers that we use store information outside of Israel, including in the USA and in Europe (AWS Stockholm, Hetzner Germany).

For the purpose of the monitoring and analytics tools detailed in Section 6, information may be transferred to the following providers:

  • Meta Platforms Inc. (USA) — Meta Pixel

  • Microsoft Corporation (USA) — Microsoft Clarity

  • Google LLC (USA) — Google Analytics

The transfer of information is carried out in accordance with the Protection of Privacy Regulations (Transfer of Information to Databases Outside the Borders of the State), 5761-2001, and subject to the providers meeting accepted security standards (SOC 2, ISO 27001, or equivalent).

8. Information Retention Period

  • Operational information and logs: retained for the duration of the engagement and up to 24 months after its termination

  • WhatsApp, Instagram, and TikTok correspondence and messages: retained for the duration of the engagement. After termination – they will be deleted within 90 days unless otherwise required by law

  • Google Calendar data (meeting events and connection tokens): retained for the duration of the engagement. After disconnecting the connection or terminating the engagement — they will be deleted within 90 days, unless otherwise required by law

  • Accounting and engagement documents: retained for 7 years in accordance with the tax laws in Israel

  • Backups: retained for up to 30 days after deletion of the original information

The client is entitled to request early deletion of information in writing to the address team@upperfloor.ai.

9. Rights of the Client and Data Subjects

In accordance with the Protection of Privacy Law, 5741-1981, every person whose information is stored has the following rights:

  • To review the information stored about them

  • To request correction or deletion of inaccurate information

  • To request an explanation of the manner of use of the information

  • To request full deletion of the information (subject to legal limitations)

  • To object to a certain use of the information

In order to exercise these rights, one may contact: team@upperfloor.ai

10. Data Deletion

Users who connected via Facebook/WhatsApp/TikTok/Google may request the deletion of their data at any time:

  • By contacting team@upperfloor.ai

  • By removing the application through the account settings on the relevant platform (Facebook Apps and Websites / TikTok Authorized Apps)

  • Removing the authorization through Google account settings (Google Account → Security → Third-party apps with account access)

  • Via the deletion request page: https://upperfloor.ai/data-deletion

After receipt of the request, the information will be deleted within 30 business days and a confirmation will be sent by email.

11. Conversations with AI Agents

It is possible that during use of the system there will be contact with an automated agent (AI agent). The client and/or the user are aware that the conversation may be carried out with an automated system, and that the information provided within its framework is used for the purpose of providing a response, improving the service, and operational documentation.

12. Policy Update

Upperfloor reserves the right to update the privacy policy from time to time, subject to publishing an updated version on the website. Material changes will be published to clients in direct communication.

For questions or clarifications, you may contact us:

Email address: team@upperfloor.ai