Privacy Policy

Last updated: September 27, 2026

1. Introduction

Tamloot ("we," "our," or "us") is the service operated by TAMLOOT LTD, an Israeli private company (company no. 517408753). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered relationship intelligence platform — built for professionals who run on conversations, including coaches, therapists, consultants, advisors, mentors, and similar practitioners.

We process personal information in accordance with the Israeli Protection of Privacy Law, 5741-1981 (including Amendment No. 13, in force since 14 August 2025) and the Protection of Privacy Regulations (Data Security), 5777-2017. Our processing is subject to oversight by the Israeli Privacy Protection Authority (PPA).

By using Tamloot, you agree to the collection and use of information in accordance with this policy.

1.1 Working with organizations

Many of our customers are organizations — such as clinics and professional practices — that use Tamloot to support the professionals who work with them. When you use Tamloot as part of such an organization, that organization is the owner of the database (the party that controls your personal data), and Tamloot acts as a holder (מחזיק) — a data processor — handling the information on the organization's behalf and in accordance with its instructions.

For these customers we enter into a written data processing agreement, as required by the Data Security Regulations. It defines the types of data and the permitted processing, the security measures we apply, confidentiality obligations, the use of sub-processors, and the return or deletion of data when the engagement ends. A data processing agreement is available to organizational customers on request.

Sensitive information: session content may include information of a sensitive nature, including health-related information. We treat such information as sensitive data under the Protection of Privacy Law and apply the heightened safeguards described in Section 6.

Rights of the people you work with: if you are someone whose professional or clinic uses Tamloot, requests to access, correct, or delete your information are made through that organization — the owner of the data — and not directly through Tamloot. Please contact them to exercise these rights.

2. Information We Collect

2.1 Information from Google Sign-In

When you sign in using Google, we receive and store the following information from your Google account:

  • Email address — Used to identify your account and send service-related communications
  • Full name — Used to personalize your experience
  • Profile picture — Used to display your avatar in the application

2.2 Google Calendar Data

If you choose to connect your Google Calendar, we request read and write access to your calendar. This connection is entirely optional — you can use Tamloot without it.

What we read:

  • Calendar events — Event titles, dates, times, and participant information for scheduled meetings
  • Meeting details — Video conferencing links (Zoom, Google Meet) associated with calendar events

What we write:

  • Session events — When you choose to sync, we create calendar events for your sessions directly in your Google Calendar

How we use Google Calendar data:

  • To display your upcoming sessions within the Tamloot dashboard
  • To automatically detect and connect to scheduled video meetings for recording
  • To help you prepare for upcoming sessions with relevant context about the people you're meeting with
  • To create session events in your calendar when you choose to sync

Important: We will never delete or modify Google Calendar events that were not created through the Tamloot app. We do not access your Google contacts or any other Google services beyond what is described above.

Revoking access: You can disconnect your Google Calendar at any time from the Settings > Integrations page in the Tamloot dashboard. You can also revoke access from your Google Account permissions page.

Google API Services User Data Policy: Tamloot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.3 Account Information

Information you provide when creating or updating your account, including your name, email address, and professional details.

2.4 Data About the People You Work With

Information about the people you work with that you enter into the platform:

  • Names
  • Contact information (email, phone)
  • Session notes and observations

Depending on your practice, this information may be of a sensitive nature — for example, health-related details. We handle it as sensitive data under the Protection of Privacy Law (see Section 6).

2.5 Session Data

Information related to your sessions:

  • Session recordings (audio/video via Zoom integration, Chrome extension, mobile app, or audio file upload)
  • Transcripts generated from recordings
  • AI-generated session summaries and notes
  • AI-generated meeting preparation notes
  • AI assistant queries and responses
  • Session dates, times, and duration
  • Outbound phone-call recordings made through the iOS app, including both participants' audio, verified caller and destination numbers, timestamps, and call status

Recordings, transcripts, and notes may contain sensitive information, including health-related content, and are protected accordingly.

2.6 Usage Data

We automatically collect certain information when you use our service, including your IP address, browser type, device information, pages visited, and actions taken within the application.

2.7 Payment Information

Payment processing is handled entirely by Lemon Squeezy, our Merchant of Record. We do not store your credit card numbers or payment details. Please refer to Lemon Squeezy's Privacy Policy for information about how they handle payment data.

2.8 Chrome Extension Data

If you use our Chrome browser extension to record Google Meet or Zoom web app sessions, we collect and process the following information:

Audio Recording

  • Tab audio capture — The extension captures audio from your Google Meet or Zoom web app browser tab during recording sessions
  • Microphone audio (optional) — With your permission, the extension may also capture audio from your microphone to include your voice in the recording

Browser Permissions

The extension requires the following browser permissions to function:

  • Tab Capture — Required to record audio from your Google Meet or Zoom web app tab
  • Microphone — Optional permission to include your voice in recordings
  • Storage — Used to store your authentication state and extension settings locally in your browser
  • Tabs — Used to detect when you are on a supported meeting page
  • Offscreen — Required for audio processing in compliance with Chrome's Manifest V3 requirements

Host Permissions

The extension only operates on Google Meet (meet.google.com) and Zoom web app (app.zoom.us) pages. It does not access or collect data from any other websites you visit.

Local Data Storage

During recording, audio data is temporarily stored in your browser's local storage (IndexedDB) before being securely uploaded to our servers for transcription. This temporary data is automatically cleared after successful upload.

Data Transmission

Audio recordings are transmitted securely over HTTPS to our servers, where they are processed for transcription and AI-generated summaries as described in Section 2.5 (Session Data). We do not sell, share, or use your recordings for advertising purposes.

2.9 WhatsApp

Tamloot uses the WhatsApp Business Platform, provided by Meta. When you connect a WhatsApp Business account to Tamloot, or message Tamloot on WhatsApp, we receive and store:

  • Account identifiers — your WhatsApp Business account ID, phone number ID, and phone number
  • Display name — the name shown on your WhatsApp profile or business account
  • Message templates — templates Tamloot creates and manages on your connected account, and their approval status
  • Messages — messages sent and received through Tamloot, with their delivery and read status

How we use it:only to deliver the messages you send and receive through Tamloot, such as reminders before sessions, a notice when session notes are ready, and replies within WhatsApp's 24-hour customer service window, and to manage message templates on your connected account.

Messages Tamloot sends from your connected WhatsApp Business account to the people you work with carry reminders and notifications that point them back to Tamloot, not session content.

We never sell WhatsApp data and never use it for advertising. You can disconnect WhatsApp at any time. See Section 9 (Data Deletion).

3. How We Use Your Information

We use the information we collect, for the purposes for which it was provided, to:

  • Provide, maintain, and improve our services
  • Process session recordings and generate AI-powered notes and summaries
  • Authenticate your identity and manage your account
  • Send you service-related communications (account notifications, updates, security alerts)
  • Respond to your inquiries and provide customer support
  • Analyze usage patterns to improve our platform
  • Comply with legal obligations

Where you use Tamloot through an organization, we process the information only as instructed by that organization under our data processing agreement, and we do not use it for our own independent purposes.

4. How We Do NOT Use Your Information

We are committed to protecting your data. We do NOT:

  • Sell your data — We will never sell your personal information or data about the people you work with to third parties
  • Train AI models on your data — Your conversations, transcripts, and notes are never used to train AI models
  • Use your data for advertising — We do not use your information for targeted advertising, retargeting, or interest-based advertising
  • Share data with data brokers — We do not transfer your information to data brokers or advertising platforms
  • Use Google data beyond stated purposes — Information received from Google (Sign-In and Calendar) is only used as described in Section 2 of this policy. We do not share your Google Calendar data with third parties or use it for advertising. We will never delete or modify calendar events that were not created through Tamloot

5. Data Sharing and Sub-processors

We share your information only with the following third parties, solely to provide our services. These providers act as our sub-processors: they are engaged under contractual data-protection terms and may use the information only to provide services to us. Several of them operate outside Israel — see Section 11 (International Data Transfers).

5.1 Sub-processors

  • Google — Authentication (Google Sign-In) and calendar integration (read and write access to calendar events). Privacy Policy
  • Composio — Connector platform that stores the authorization for each tool you connect (such as Google Calendar and Docs, Gmail, Zoom, or Notion) and runs requests against those tools on your behalf. Data shared: only for tools you explicitly connect — the OAuth grant itself, plus whatever that tool call carries, such as calendar events, session notes you export to Google Docs, or email content. If you connect nothing, no data reaches Composio. Privacy Policy
  • Supabase — Database hosting and authentication infrastructure. Privacy Policy
  • Lemon Squeezy — Payment processing (Merchant of Record). Privacy Policy
  • Zoom — Video conferencing and recording integration. Privacy Policy
  • ElevenLabs — Speech-to-text transcription services. Privacy Policy
  • Anthropic (Claude AI) — Third-party AI provider used to generate session notes, meeting preparation summaries, and power the in-app AI chat assistant. Data shared: session transcripts (text generated from recordings) and messages typed in the AI chat assistant are sent to Anthropic for processing. Your data is used solely to provide these features and is never used to train AI models. Anthropic maintains industry-standard security practices and provides data protection equivalent to our own standards. Privacy Policy
  • Amazon Web Services (AWS) — Cloud infrastructure, audio file storage, and compute. Privacy Policy
  • Recall.ai — Desktop meeting recording technology. Privacy Policy
  • Twilio — outbound voice calling, caller-ID verification, and call recording.Data shared: verified caller and destination phone numbers, call metadata, and audio from recorded calls.Privacy Policy
  • Hookdeck — Webhook routing and delivery infrastructure. Privacy Policy
  • Meta Platforms (WhatsApp Business Platform) — sends and receives WhatsApp messages, and hosts message templates, for WhatsApp accounts connected to Tamloot or messaging Tamloot. Privacy Policy
  • Kapso — connects your WhatsApp Business app to Tamloot so your conversations with the people you work with appear alongside your sessions. It processes those messages (text, media details, and voice-note transcripts) only if you connect WhatsApp capture. Privacy Policy
  • Vercel — hosting and serverless compute for our website and AI features, including handling WhatsApp messages. Privacy Policy

5.2 Legal Requirements

We may disclose your information if required by Israeli law, a court order, or a competent authority (including the Privacy Protection Authority), or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, in line with the Protection of Privacy Regulations (Data Security), 5777-2017:

  • Encryption in transit — All data transmitted to and from our servers is encrypted using TLS/SSL
  • Encryption at rest — Data stored in our databases is encrypted
  • Access controls — We use role-based access controls and Row Level Security so that you can only access your own data
  • Handling of sensitive data — Information of a sensitive nature, including health-related content, is classified and protected under the heightened requirements of the Data Security Regulations
  • Secure infrastructure — Our services are hosted on industry-leading cloud infrastructure with robust security practices
  • Agreements with sub-processors — We maintain data-protection agreements with the sub-processors that handle personal information on our behalf
  • Access logging — In line with Regulation 10 of the Data Security Regulations, an automated, tamper-resistant mechanism logs access to personal data — including administrative access and access by applications you connect — recording the action and when it occurred; these access logs are retained for the period required by law
  • Ongoing review — We periodically review our security practices and assess risks to personal data

Breach notification: in the event of a severe security incident, we will notify the Israeli Privacy Protection Authority as required by law, and will notify the affected organizational owner and/or affected individuals where directed to do so.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information as follows:

  • Account data — retained while your account is active, and deleted when you delete your account (see Section 9)
  • Session data and data about the people you work with — Retained until you delete it or close your account
  • Session recordings — Retained according to your account settings or until you delete them
  • Phone-call recordings — Twilio's copy is deleted once the recording has been transferred to our storage; our copy is retained like other session recordings
  • Usage logs — Retained for up to 12 months for security and analytics purposes
  • Records kept for legal reasons — Some records are retained for longer where needed to meet security, legal, or accounting obligations under Israeli law

Where you use Tamloot through an organization, retention follows the organization's instructions and our data processing agreement. After the applicable retention period, your data is securely deleted from our systems.

8. Your Rights

Under the Israeli Protection of Privacy Law you have the following rights regarding your personal information:

  • Access — Request to review the personal information we hold about you (Section 13 of the Law)
  • Correction and deletion — Request that information that is inaccurate, incomplete, unclear, or out of date be corrected or deleted (Section 14 of the Law)
  • Direct mailing — Request to be removed from any direct-mailing list
  • Information about access to your data — Because access to personal data is logged (see "Access logging" under Data Security), you may request information about access to your personal data, including who accessed it and when

As a matter of practice, we will also honor reasonable requests to receive a copy of your data in a portable format, and to withdraw consent for or object to certain processing, to the extent this does not conflict with our legal obligations.

To delete your account and data, see Section 9 (Data Deletion).

If you use Tamloot through an organization that owns your data, please exercise these rights through that organization. Otherwise, contact us at contact@tamloot.cc. You also have the right to lodge a complaint with the Israeli Privacy Protection Authority.

9. Data Deletion

You can delete your Tamloot account and your data at any time, unless you belong to an organization that owns some of your records — see 9.2.

9.1 How to delete your account

  • In the web app: go to Settings > Privacy and choose "Delete my account"
  • In the iOS app: go to Settings and tap "Delete Account"
  • By email: if you can't use either app, or you messaged Tamloot on WhatsApp without creating an account, email contact@tamloot.cc and ask us to delete your data. Write from the email address on your account, or include the WhatsApp number you messaged us from.

9.2 What gets deleted

Deleting your account permanently removes:

  • Your account and profile
  • Your sessions, recordings, transcripts, and notes
  • Data about the people you work with
  • Your assistant conversations, including conversations on WhatsApp
  • Your connected integrations, including your WhatsApp connection and its identifiers. Tamloot revokes the access it holds for connected services and deletes the access tokens it stores for them, including the access token for a WhatsApp Business account you connected.

We delete your recordings, transcripts, and notes from our own systems immediately. We also instruct our recording and transcription vendors to delete their copies; this normally completes on their end automatically, but if a vendor is briefly unavailable, we retry until it succeeds — this does not delay or block your account deletion.

Your assistant conversations, including conversations on WhatsApp, are deleted from our records immediately. Any WhatsApp messages still held in the assistant's short-term working memory clear automatically within 24 hours, whether or not you delete your account.

If you use Tamloot through an organization that owns some of your sessions or client records, we can't delete your account while those records still exist under the organization — an organization owner needs to release or delete them first. Once that's done, you can delete your account as usual. Records the organization owns are otherwise handled through that organization (see Section 1.1).

9.3 Timeline

Deleting your account in the app takes effect immediately and cannot be undone. If you want a copy, export your data first (Settings > Privacy). We handle email requests within 30 days. Some records may be kept longer where Israeli law requires it, as described in Section 7.

9.4 Disconnecting WhatsApp and Meta

To stop Tamloot using WhatsApp without deleting your account, disconnect WhatsApp on the Connectors page in the web app.

If you connected a WhatsApp Business account, you can also remove Tamloot's access from Meta. In Facebook, go to Settings & privacy > Settings > Business integrations, select Tamloot, and remove it. Admins of the business account can also remove Tamloot in Meta Business Suite, under Business settings. Removing access in Meta stops Tamloot from sending or receiving messages on that account. To delete the data Tamloot already holds, delete your account or email us.

10. Children's Privacy

Our service is intended for professionals — coaches, therapists, consultants, advisors, and similar practitioners — and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Some of our sub-processors operate outside Israel — specifically in the United States, the European Union, and Switzerland — for cloud infrastructure, AI processing, transcription, and payment services. Where we transfer personal information outside Israel, we do so in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001. Transfers to the European Union / EEA and to Switzerland rely on their recognition as providing an adequate level of protection; transfers to other countries, including the United States, are made subject to contractual undertakings requiring the recipient to protect the information to a standard consistent with Israeli law and not to make unauthorized onward transfers. By using our service, you are informed of and consent to these transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website prior to the change becoming effective. We encourage you to review this Privacy Policy periodically for any changes. Your continued use of our service after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: contact@tamloot.cc

Company: TAMLOOT LTD, an Israeli private company (company no. 517408753).

Supervisory authority: you may also contact or lodge a complaint with the Israeli Privacy Protection Authority (PPA).

Governing Law: This Privacy Policy is governed by the laws of the State of Israel.