Privacy Policy — Business Messaging Platform
Privacy Policy — ITD Communications Business Messaging Platform
Last updated: 25 August 2026
This policy applies to the ITD Communications multi-channel business messaging platform (the "Platform") — the software that allows a business to manage its WhatsApp and email conversations from a single inbox.
It does not apply to browsing the itd-com.com marketing website. That is covered by a separate policy: https://itd-com.com/מדיניות-פרטיות/.
1. Who we are
The Platform is operated by I.T.D. Communication Service Marathon Ltd. (איי. טי. די. תקשורת שרות מרתון בע"מ) ("ITD", "we", "us"), an Israeli private company incorporated on 5 March 1989.
| Registered name (Companies Registrar) | איי. טי. די. תקשורת שרות מרתון בע"מ |
| Registered company number | 511370363 |
| Registered address | Ha-Zayit 54, Oranit 4470604, Israel |
| Privacy contact | Uzi Almagor |
| [email protected] | |
| Telephone | +972-3-918-5000 |
2. Our role: we act on behalf of our business customers
The Platform is sold to businesses ("Customers"). Each Customer connects its own WhatsApp Business account and its own email accounts to the Platform, and uses it to communicate with its own contacts ("End Users").
For personal data contained in those conversations, the Customer is the data controller and ITD is the data processor. We process that data only on the Customer's documented instructions and only to provide the service. We do not use it for our own purposes.
Customers onboarded through the WhatsApp Embedded Signup flow retain full ownership of their WhatsApp Business Account, phone numbers, and message templates at all times, and may revoke our access at any point.
3. Data we receive through the Meta / WhatsApp Business Platform
When a Customer connects a WhatsApp Business account to the Platform, we receive and process the following through Meta's APIs:
| Data | Permission | Why we need it |
|---|---|---|
| WhatsApp Business Account ID, phone number IDs, display names, quality ratings, message templates | `whatsapp_business_management` | To display and manage the Customer's account inside the Platform, create and submit message templates, and show account health |
| Message content, sender phone number, message timestamps, delivery and read status, media attachments | `whatsapp_business_messaging` | To deliver incoming messages into the Customer's shared inbox and to send replies the Customer's agents compose |
| Business portfolio ID and business name | Embedded Signup | To link the connected assets to the correct Customer account |
| Contact names and chat history synced from the WhatsApp Business app (Coexistence onboarding only) | `whatsapp_business_app_onboarding` | To populate the Customer's inbox with their existing conversations so no history is lost when they connect |
We do not:
- Use data obtained through Meta permissions for advertising, profiling, or audience building
- Sell, rent, or license this data to any third party
- Use message content to train machine-learning models
- Access a Customer's WhatsApp assets except to provide the Platform, resolve a support request the Customer raised, or as required by law
- Combine data from one Customer with data from another
4. Other data we process
Account data. Names, work email addresses, phone numbers, and login credentials of the Customer's agents and administrators, used to operate accounts and control access.
Email channel data. Where a Customer connects a mailbox, we process message headers, content, and attachments in order to display them in the shared inbox. Access is granted by the Customer via OAuth and can be revoked by them at any time.
Service logs. Technical logs including IP addresses, timestamps, and error records, kept for security, abuse prevention, and debugging.
5. Retention
| Data | Retention period |
|---|---|
| Message content and conversation history | For the duration of the Customer's subscription, then deleted within 30 days of account closure |
| Account and agent data | Duration of subscription, then deleted within 30 days |
| Technical and security logs | 90 days |
| Records required by Israeli law (e.g. accounting) | As required by the applicable statute |
Customers may request earlier deletion at any time — see section 8.
6. Sub-processors and international transfers
We use the following service providers to operate the Platform:
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms, Inc. | WhatsApp Business Cloud API | United States / global |
| Vercel Inc. | Application hosting | European Union (Frankfurt) |
| Google LLC (Google Workspace) | Business email | United States / global |
| Cloudflare, Inc. | Content delivery and network security | Global |
Where data is transferred outside Israel or the EEA, we rely on appropriate safeguards including standard contractual clauses.
7. Security
We protect data using encryption in transit (TLS 1.2 or above), encryption at rest, role-based access control, mandatory two-factor authentication for all administrative accounts, logical separation between Customer tenants, and audit logging of administrative access.
Access to production systems is limited to personnel who require it to perform their duties.
8. Your rights and how to exercise them
Under the Israeli Protection of Privacy Law, 5741-1981, and — where applicable — the GDPR, individuals may request access to their personal data, correction of inaccurate data, deletion, restriction of processing, and data portability.
If you are a Customer, contact us at [email protected] and we will action your request.
If you are an End User who exchanged messages with a business using our Platform, the business is the controller of your data. Contact that business directly. If you contact us instead, we will forward your request to them and assist them in responding.
Data deletion. To request deletion of all data associated with your account, email [email protected] with the subject line "Data Deletion Request". We will confirm receipt within 5 business days and complete deletion within 30 days. Standing deletion instructions are published at: https://itd-com.com/data-deletion/
Disconnecting. A Customer may disconnect the Platform at any time by removing our app's access from WhatsApp Manager or from Meta Business Settings. Doing so immediately ends our ability to access their WhatsApp assets.
9. Children
The Platform is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
10. Changes to this policy
If we change how we handle data, we will update this page and revise the date at the top. Material changes will be communicated to Customers by email in advance.
11. Contact
Questions about this policy, or about how we handle data:
Uzi Almagor I.T.D. Communication Service Marathon Ltd. Ha-Zayit 54, Oranit 4470604, Israel [email protected] · +972-3-918-5000