Privacy Policy — Studio Slash & Converty

This English text is a complete translation of the Hebrew policy above and carries the same meaning. In the event of a conflict, the Hebrew version governs.

1. Who we are

Studio Slash builds and operates Converty — an AI-powered sales agent embedded in business websites that holds conversations with their visitors.

2. Who controls your data — us, or the business you spoke to?

This determines who to contact with any request, and depends on where you gave the data.

a. Data given directly to us — Studio Slash is the controller

This applies when you submit a form or book a meeting on studio-slash.co.il, chat with the agent on our own site, or message our Facebook Page or Instagram account @studio_slash_1.

b. Data given to another business using Converty — that business is the controller

If you met the chat agent on another company's website, the information you provided belongs to that company. Studio Slash supplies the technology and processes the data solely on their behalf, as a Processor. We do not use it for our own purposes and we do not sell it. Requests go to that business; if you contact us by mistake we will forward your request and assist them, but the decision is theirs.

3. You are talking to an AI

The Converty chat agent is not a human representative. It is an AI assistant that answers on the business's behalf from information the business approved, and this is stated at the start of every conversation. Your message content is processed by an AI model from Anthropic (the Claude family) to generate replies. You can ask to speak to a person at any point.

4. What we collect, by touchpoint

a. Marketing site — forms and booking

Full name, phone, email, business name (optional), message content; for bookings, the chosen slot and your browser's time zone. Providing this is voluntary.

b. The Converty chat agent

• Conversation content — your messages and the agent's replies;
• Name, phone and email — only if volunteered;
• A technical conversation ID in your browser's sessionStorage, cleared when the tab closes;
• Basic usage events (chat opened, button clicked) — only if the business enabled this; it is off by default.

c. Portal and CRM

Each client business sees its own leads and conversations: contact details provided, conversation summary, handling status, estimated deal value and activity records. Access is restricted per business by row-level database permissions.

d. Calendar booking

If a meeting is booked through the chat, the name and phone you provided are written into an event in the business's Google Calendar (name in the title, phone in the description) in order to arrange the meeting.

e. Instagram and Messenger messages

When you message us on these channels we receive from Meta, via a signed and verified webhook: a sender ID (an identifier Meta issues for your account specifically in relation to our app — not your public username), the message content, and the message ID and timestamp.

As of this document's date, that data is not stored in our database and does not become a lead. It appears in our hosting provider's technical logs for a limited period, and a message or sender identifier is held in separate technical storage to prevent processing the same message twice — automatically deleted within 24 hours.

f. WhatsApp — a future channel

When WhatsApp is enabled we will receive, through the WhatsApp Business Platform, the sender's phone number, message content, message ID and timestamp. Meta states that on this platform messages are retained by Meta for up to 30 days, and user identifiers are deleted within 30 days of a message's last status update. Our use will be the same as other message channels: responding to your enquiry only.

g. Measurement, advertising and cookies — marketing site only

On studio-slash.co.il only (not in the chat agent on client sites) we run measurement through Google Tag Manager:

Hashing does not make data anonymous — it makes it harder to read directly, but it remains personal data, which is why it is disclosed here.

Every measurement tool in this table — including the Meta Pixel — is gated by the consent mechanism in section 5 and does not run by default for visitors from the EU, UK or Switzerland.

We no longer claim tools we do not use. A TikTok pixel previously present on the site has been removed entirely, both browser-side and server-side, and no data is sent to it. Website fonts are now served from our own origin rather than Google Fonts, so no IP address is sent to Google in order to display text.

5. Consent for measurement and advertising

The site implements Google Consent Mode v2, and all 6 measurement and advertising tags on the site — including the Meta Pixel — are gated by it:

• Visitors from the EU, UK and Switzerland — advertising and analytics storage is denied by default and is not enabled unless consent is given. The tools in section 4(g) do not operate for you without consent.
• Visitors from Israel and the rest of the world — the default permits measurement and advertising, as permitted by applicable law. You may object at any time (section 11).

6. Legal basis for processing

In Israel, processing is carried out under the Privacy Protection Law, 1981, including Amendment 13 (in force since August 2025), which expands the definition of personal data to include, among other things, IP addresses and cookie identifiers.

7. Who we share data with

We do not sell personal data and we do not share it for third-party marketing. Data is passed to infrastructure and service providers acting on our behalf, solely to operate the service:

Transfers to these providers are protected by transport encryption, and for lead alerts additionally by shared-secret authentication, so an alert cannot be forged or injected with false data.

8. Where data is stored, and cross-border transfers

Our primary database is located in Frankfurt, Germany (eu-central-1) — inside the European Union. Some providers listed in section 7 also process data outside the EU, including in the United States, under their own transfer mechanisms.

For transfers from the EU to Israel: as of this document's date, Israel is recognised by the European Commission as providing an adequate level of protection (an adequacy decision), so such transfers require no additional mechanism. That recognition is periodically reviewed by the Commission and may be amended or withdrawn; if its status changes we will update this document and move to an alternative transfer mechanism such as Standard Contractual Clauses.

9. How long we keep data

10. How to request deletion of your data

You may request deletion of your personal data at any time, free of charge and without giving a reason.

Step 1 — Send the request

Email studio.slash1@gmail.com with the subject "Data Deletion Request".

Step 2 — What to include

1. Which channel you contacted us through — website chat (and which website), a form on our site, Instagram, Messenger or WhatsApp;
2. An identifier you used — the phone number or email address you gave us, or the username the Instagram/Messenger message was sent from;
3. An approximate date of the contact, if known.

Step 3 — What actually gets deleted

Once the request is verified, we delete from the systems under our control:

• The full conversation transcript with the chat agent;
• The lead record and stored contact details (name, phone, email);
• The conversation summary and associated CRM activity records;
• Records of messages received from Instagram, Messenger or WhatsApp, including the technical de-duplication records;
• On explicit request, the calendar event created for a booked meeting.

Step 4 — What we cannot delete, and what we do instead

• Data given to another business using Converty: that business is the controller. We forward your request to them within 7 business days and tell you who it went to.
• Data held by Meta or Google within their own services is governed by their policies; to delete it there, contact them directly through your account settings.
• Data we are legally required to retain (for example accounting records) is kept for the statutory period and used for no other purpose.
• Encrypted backups may retain a copy briefly until the next backup cycle.

Step 5 — Timeframe and confirmation

We handle requests within 30 days at most of receipt, and usually far sooner. When complete we send an email confirmation setting out what was deleted. If we cannot fulfil the request in whole or in part, we explain why.

11. Your rights

Under the Israeli Privacy Protection Law, 1981

• Right of access — to know what data is held about you;
• Right of correction — to correct inaccurate, incomplete or outdated data;
• Right of deletion — to request erasure (section 10).

Additional rights for EU and UK residents (GDPR)

• Access to your data and a copy of it;
• Rectification of inaccurate data;
• Erasure ("the right to be forgotten");
• Restriction of processing;
• Objection to processing based on legitimate interests, including profiling for advertising;
• Data portability — receiving your data in a structured, commonly used format;
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing;
• Lodging a complaint with the supervisory authority in your country of residence.

To exercise any of these: studio.slash1@gmail.com. We respond within 30 days at most.

12. Security

• Transport encryption (HTTPS) across all touchpoints;
• Row-level database permissions, so each business sees only its own data;
• Cryptographic signature verification on messages received from Meta, confirming they genuinely originated there;
• Shared-secret authentication on internal lead alerts;
• Secrets and keys held in an encrypted secrets store, not in source code.

No system on the internet is perfectly secure, and we cannot guarantee absolute protection.

13. Children

The service is intended for business owners and their customers and is not directed at children under 16. We do not knowingly collect data about minors. If you become aware that a minor has provided us with data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. Material changes will be published on this page with a new version number and date. Continued use of the service after an update constitutes acceptance of the updated policy.

15. Contact

For any question about this policy or how your data is handled: studio.slash1@gmail.com · +972-50-447-2153.