Privacy Policy – AutoWriter

Last updated: November 1, 2026

This is an English translation for convenience. The Hebrew version is the binding one.

This policy explains what information the AutoWriter service ("the Service", "we"), operated by Olympus Health Solutions (business no. 027922970), collects, why and how we use it, who we share it with, and what rights you have. The Service writes articles, prepares content kits (posts, images, videos and newsletters), creates designed posts, image ads and videos (including talking presenters, dubbing and transcription), builds landing pages, a business card and a live magazine, analyses search and AI-engine performance, and connects to platforms such as WordPress, Google and social networks. The Service also includes "The Champions Team": digital assistants for the business's marketing, sales and money. This policy applies to users everywhere in the world; section 11 lists additional rights by region.

1. Who is responsible for the data

For your account data (sign-up, billing, support and Service security), we are responsible.
For your customers' data, such as landing-page enquiries, appointment bookings, a mailing list and magazine readers, your business decides the purposes, and we act as a service provider processing the data for you and on your instructions.
In the terms of European law (GDPR): for account data we are the controller, and for your customers' data we are a processor. On request we will sign a data processing agreement (DPA).

2. What we collect

Information you provide

Account details: name, email address, phone (if given), profile photo (if uploaded) and password. The password is stored only as a hash.
Site and business details: site address, business description, audience, documents, images, logo, videos and content you upload so that content is written accordingly.
Information entered into The Champions Team: products and prices, leads and customers in the sales pipeline (name, phone, email, stage, notes and call summaries you pasted), the business's income and expenses, and calendar appointments.
Call recordings you upload for transcription: the file is sent for transcription and deleted from the server right after. Only the text and the analysis are kept, in the lead's card. Upload only calls you took part in, and inform the other party where the law requires it.
A face photo and a voice recording, only if you used a tool that asks for them: a photo of you (or of someone who consented) to create a talking-presenter video, and a 10 to 60 second recording to clone your voice. They are used only to create your videos. A record of the consent is kept with them: the time, the IP address and the wording confirmed.
Product photos, screens and logos: that you uploaded to be included in posts, ads and videos.
Payment details: name, phone and email for billing. Card details are entered directly on the payment page of the processor Grow (Meshulam); we neither see nor store the card number. We keep only an encrypted token for recurring charges and the last four digits.
Support requests and messages you send us, including questions you write to the digital assistant inside the Service.

Information from accounts you connect

Sign in with Google, Facebook or Microsoft: the account's name and email address only.
Google: only if you connect, and read-only: data from Search Console and Analytics for your sites (impressions, clicks, queries, pages and average position), and Google Drive files you chose to import or back up to.
WordPress, Webflow, Shopify or another platform: the access details you provided (such as an Application Password). They are stored on the server and never shown again in the browser.
Facebook and Instagram (Meta), only if you connect: when you connect through Meta we receive the list of Pages you manage, their names and the Instagram business account linked to each Page, and an access token for the Page you choose. We use them only to publish on that Page and Instagram the posts you approved or scheduled. Permissions: pages_show_list, pages_manage_posts, pages_read_engagement, instagram_basic, instagram_content_publish and business_management. We do not read private messages, do not collect information about your followers, and do not use this data for advertising.
Your business's WhatsApp number, only if you connect it: messages your customers send to the business number, their name and phone number, the replies of the digital assistant and yours, and a record of consent to receive updates and of opt-out requests (when and how). Your business is responsible for this data, and we process it on its behalf (see section 1).
Satisfaction survey answers, only if you turn it on: the rating (1 to 5), the customer's comment and the time of the answer. With a personal link, the answer is also saved in that customer's card. The survey page asks for no name, phone or email, and its address holds no personal details. Your business is responsible for this data, and we process it on its behalf (see section 1).
The newsletter and magazine mailing list, only if you use it: the email addresses and names you add, the consent source you wrote (for example "sign-up form on the website") and when they were added, plus the list of addresses that unsubscribed. When adding recipients, you confirm that all of them explicitly agreed to get mail from the business. Your business is responsible for this data, and we process it on its behalf (see section 1).
Other networks (LinkedIn, a Telegram channel, a webhook): the access details you provided, only for the accounts you select, and only for the publishing you request.
Your personal bot on Telegram or WhatsApp, only if you connect: your chat ID or WhatsApp number, and the messages you send the bot, such as "today", "tasks" or tapping "Yes". The bot sends business summaries and tasks only to you, and never contacts your customers.

Your customers' information

Details visitors leave on your landing pages or magazine: name, phone, email, message and requested appointment time.
Chats with the digital assistant on the business card and in the landing page chat: the questions the visitor wrote, the answers they got and when, plus a name and phone if they left them in the callback or meeting form. Phone numbers, email addresses and long numbers the visitor typed in the chat are hidden before saving. The chats are kept so the business sees them in its inbox and can get back to the people who asked, and a question that had no answer is kept so the business can add an answer to it. Up to the 200 latest chats per business are kept. The chat window tells visitors that the chat is kept by the business. Your business is responsible for this information, and we process it on its behalf (see section 1).

Technical information

Server activity logs: IP address, browser type and access times, for security, preventing misuse and fixing faults.

3. Why we use it

To provide the Service: research the site, build a content plan, write articles, create images and videos, build landing pages and send drafts to your site.
To show you performance analysis, reports and recommendations.
To pass enquiries and leads from your landing pages to you.
To run The Champions Team: manage leads and appointments, write call scripts and ads, calculate profit and break-even, and find what's stuck in the business so we can suggest your next step. Suggestions are shown in the Service and, if you connected one, in your personal bot.
To publish on the networks you connected the posts you approved or scheduled.
To charge payments, issue receipts and send account messages, such as verification, password reset and changes to the terms.
To give support, keep the Service secure and prevent misuse and fraud.
To improve the digital assistant's answers: a question with no ready answer is kept together with the screen it was asked on, without your name or account details, so we can add an answer.
To meet our legal obligations, such as keeping accounting records.

We do not sell personal data, do not use it to build advertising profiles, and do not cross-match data between businesses.

4. Legal basis for using data

We use data only where the law allows it. For users in the European Union, the European Economic Area and the United Kingdom, these are the bases under the GDPR:

What we do	Basis
Providing the Service, the account, the connections you asked for and the publishing you approved	Performance of our contract with you
Security, fraud prevention, fixing faults and improving the Service	Our legitimate interest, in a way that does not override your rights
Marketing emails, and connections or features that are your choice	Consent, which you can withdraw at any time
Accounting records, responding to authorities	Legal obligation

5. Artificial intelligence

To write and analyse, we send AI providers only the data needed for the task, such as business details, the article topic and the content of the page being checked, and in The Champions Team also a lead's details or a call summary when you ask for an analysis, and the money figures when you ask for a month summary.
When the WhatsApp assistant is on, the customer's message and the conversation's context are sent to the AI provider to draft a reply. A call recording you upload is sent to OpenAI for transcription.
To create images, ads, videos, voice and dubbing, the script or text is sent to the model provider fal.ai, together with only the materials you chose to include: a product photo, screen, logo, face photo or voice recording. The cloned voice is kept by the model provider while you use it, and you can delete it from within the Service.
When you ask for a summary of survey comments, the comments and ratings are sent to the AI provider without customers' names.
Passwords, access tokens and keys are never sent to AI providers.
We do not use your content to train general models. Under their business API terms, the providers we work with commit not to train their models on this data.
Content is published publicly only after you approve it, or if you explicitly chose direct publishing or autopilot.
Automated decisions: the Service offers estimates and recommendations, such as the chance of closing a deal, tasks that are stuck or a winning ad. These are recommendations only. We make no automated decision about you or your customers that has a legal or similarly significant effect, and any action toward a customer is taken only by you.
Please do not upload sensitive data that is not needed, such as medical data, ID numbers or full payment details.

6. Data from Google (Google API Services)

When you connect with Google, the Service asks for read-only access to Google Search Console and Google Analytics, and access to Google Drive files only for an import or backup you chose. We use this data only to show you your sites' performance inside the Service, recommend article topics and back up your data. We change nothing in your Google account.

AutoWriter's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, the data is not transferred to third parties except to provide the Service, is not used for advertising, is not used to train general models, and is not read by humans except with your consent, for security, or as required by law.

Gmail (the inbox assistant, only if you turn it on): the Service asks for read-only access (gmail.readonly). It reads emails from the last 7 days, up to 20 messages per sort, to sort them, write a summary and prepare reply drafts shown only to you. For this, the sender, subject and part of the message text are sent to the AI provider (Anthropic), which does not train models on them. The Service never sends, deletes, archives or changes anything in the mailbox: a draft opens in Gmail's own compose window, and only you send it. The latest sort results are kept in your account and deleted when you disconnect Gmail.

The Google access token is stored encrypted on the server. You can disconnect at any time inside the Service, or in your Google account security settings.

7. Who we share data with

We share data only with providers that help us deliver the Service, only to the extent they need, and subject to confidentiality and security obligations:

Anthropic (Claude): writing, research and analysis.
OpenAI: image generation and call-recording transcription.
fal.ai: creating images, ads and videos, talking presenters, voice cloning, dubbing and transcription, using third-party models available through it (such as Google, Kling, ByteDance, MiniMax and ElevenLabs). The script and the materials you chose to include are sent, as described in section 5.
Moz and OpenPageRank: domain authority metrics for link and competitor analysis. Only website addresses are sent.
Pixabay and Wikimedia Commons: searching images and videos in stock libraries. Only search words are sent.
Google: Search Console, Analytics, Drive and page-speed checks (PageSpeed), as you choose. Landing pages and the magazine load fonts from Google Fonts, so Google receives their visitors' IP addresses.
Meta Platforms (Facebook, Instagram, WhatsApp Business): publishing on the Page and Instagram you connected, and your personal WhatsApp bot if you connected it. The post and media you approved are sent, and on WhatsApp your phone number and the messages to you. If you connected your business WhatsApp, also the messages between the business and its customers and campaign messages you approved. Meta also acts as an independent controller of the data in your accounts with it.
Telegram: the personal bot you created, if you connected it. Your chat ID and the summaries and tasks the bot sends you are sent.
DataForSEO: search, keyword and link data for competitor analysis. Site addresses and search terms are sent, with no personal data.
Pexels and Openverse: stock-image search. Only search terms are sent.
Grow (Meshulam): payment processing in shekels.
Stripe: payment processing in US dollars. Card details go directly to Stripe and are not stored by us.
Resend: sending emails from the Service, and also sending the newsletter and magazine to the recipients on your business's mailing list.
Twilio: sending SMS and WhatsApp messages, such as sign-in codes and booking reminders. The phone number and message text are sent.
The server's hosting provider and Cloudflare: hosting the Service, secure delivery and security certificates (SSL).
The platforms you connect, such as WordPress, Google and social networks, for the actions you request. They may act as independent controllers of their own data, under their own privacy policies.

Team members you invite see data according to the permissions you gave them. We disclose data to authorities only when the law requires it. If the business that operates the Service is sold or merged, data will pass to the new owners only subject to this policy, and we will give notice in advance.

8. Transfers outside Israel

Some providers store and process data outside Israel, including in the United States and Europe. Transfers are made in accordance with Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations and appropriate contractual commitments. On request, we will provide details of the providers and where data is processed.

For data originating in the European Union, the European Economic Area or the United Kingdom: Israel has an adequacy decision from the European Commission, so data may be transferred to it. When data moves from us to a provider in a country without an adequacy decision, the transfer relies on a recognised mechanism, such as the Standard Contractual Clauses (SCC) or the EU-U.S. Data Privacy Framework (DPF), as applicable to that provider.

9. How long we keep data

Account data and content: while the account is active. After the account is closed, data is kept for 30 days in case you change your mind, then permanently deleted, including articles, images and connection tokens.
Landing-page enquiries and leads: up to 12 months, or until you delete them or close the account.
Meta, Telegram and WhatsApp connections: until you disconnect them or close the account. A Meta Page choice that wasn't completed is deleted after 15 minutes.
Business WhatsApp conversations: up to the latest 200 messages per conversation, until you delete them or close the account. Consent and opt-out records are kept as long as they must be proven under law.
Survey answers: up to the latest 500 answers, until you delete them or close the account.
Mailing list: until you delete a recipient or close the account. An address that unsubscribed stays on the unsubscribe list as long as the list exists, so it isn't mailed again by mistake.
Call recordings: deleted right after transcription.
Face photo and voice recording for cloning: until you delete them from the Service or close the account. The recording is kept so the voice can be cloned again if the provider removed it after a period without use. The consent record is kept as long as it is needed to prove consent under the law.
Product photos, screens and outputs such as ads and videos: while the account is active, or until you delete them.
Questions to the assistant with no answer: the latest 500, without identifying details.
Security and operational logs: only as long as needed for security and fixing faults.
Payment and accounting records: as required by tax law.
Backups: encrypted, and replaced on a regular rotation.
Disconnecting a connection stops use of the access token but does not by itself delete data already received. For deletion, see section 12.

10. Security

Communication with the Service is encrypted (HTTPS). Passwords are stored only as one-way hashes. Payment tokens and platform access tokens are stored encrypted and never sent to the browser. Backups are encrypted, and access to data is limited to the account owner and the team members they invited. We protect against CSRF attacks and repeated sign-in attempts, and messages arriving from WhatsApp are checked against Meta's signature. No method is 100% secure, but we take reasonable measures to protect data. In a serious security incident we will act as the law requires, including reporting to the Privacy Protection Authority and informing affected people where the law requires it.

11. Your rights

To access your data, ask to correct wrong data, and ask to delete data or close the account.
To disconnect any connection to an external service, and to withdraw consent to marketing emails.
Most actions can be done directly in the Service. For anything else, contact us at the address below. We will respond within 30 days, after verifying identity.
Anyone who left details on a landing page of a business using the Service can contact that business, and we will help handle the request.
You may also file a complaint with the Privacy Protection Authority.

In the European Union, the European Economic Area and the United Kingdom

In addition to the rights above: to receive your data in a common format and move it to another service (portability), to restrict the use of your data, to object to use based on legitimate interest, and to withdraw consent at any time without affecting use made before the withdrawal. You may complain to the data protection authority in the country where you live or work.

In the United States (including California and other states with privacy laws)

We do not sell personal data and do not share it for cross-context behavioural advertising, so there is no need to ask us not to sell. We also honour the Global Privacy Control signal in your browser.
You can ask to know what data was collected and why, get a copy, correct and delete it, and appeal our decision on such a request. A request can also be made through an authorised agent.
We will not discriminate against anyone for exercising their rights.
We do not use sensitive data to infer characteristics about you.

Everywhere else

We will honour the rights your local law gives you. You can contact us with any request.

12. Deleting data

You can ask to delete all your data, including data received from Google or social networks. Full instructions are on the data deletion page. In short: disconnect inside the Service, remove access in the platform's own settings too, and close the account or contact us with a deletion request. You can also remove AutoWriter's access to Facebook and Instagram in your Facebook settings, under "Apps and websites".

13. Cookies and browser storage

We use only necessary cookies: a sign-in cookie and a cookie that protects against CSRF attacks.
The browser also stores convenience preferences, such as the site you selected, language, areas you pinned open and the last email you signed in with, plus a copy of the app's files so it opens quickly and works offline.
We do not use advertising cookies, third-party tracking or external analytics tools inside the Service. If we add non-necessary cookies in the future, we will ask for consent first.

14. Marketing emails

Marketing emails are sent only to people who agreed to receive them, in accordance with Israel's Communications Law, and each includes an unsubscribe option. Operational emails, such as account verification, receipts, alerts and changes to the terms, may be sent without marketing consent.

When a business sends a newsletter or magazine from the service, it goes only to the recipients on its own list. The subject starts with "Advertisement" ("פרסומת" in Hebrew), the email shows the business details, and at the bottom there is an unsubscribe link. The link opens a confirmation page; once confirmed, the address is removed right away and gets no more mail from that business.

15. Information a business provides about others

If you upload information about other people to the Service, or collect it through landing pages, you are responsible for giving them a suitable privacy notice, obtaining consent where required, and providing only data you are allowed to process. Do not upload medical data, identity documents, full payment details or other sensitive data not needed for the Service. If you send customers advertising messages, you are responsible for obtaining their consent as the law requires. The WhatsApp assistant introduces itself as a digital assistant and stops messaging anyone who writes "stop". Send the survey link only to your business's customers. Ask all customers for a Google review the same way, whatever rating they gave in the survey. Add to the mailing list only people who explicitly agreed to get mail from the business, and keep your own record of that consent.

16. Minors

The Service is for businesses and people aged 18 or over, and is not intended for minors. Data about minors may not be collected through the Service without a lawful basis or used for prohibited targeting. If we find such data was collected unlawfully, we will investigate and delete it.

17. Permissions and revoking them

You can reduce or revoke permissions at any time, in the connected platform's settings or by disconnecting inside the Service. Revoking a permission may stop services that depend on it, such as scheduled publishing. Deleting data in the Service does not delete content already published on your site or social networks.

18. Changes to this policy

We may update this policy. We will give advance notice of a material change by email or in the Service, at least 14 days before it takes effect. The last-updated date appears at the top of the page.

19. Contact

Olympus Health Solutions (business no. 027922970), 4 Gruner Dov St., Petah Tikva, Israel. Email: office@autowriter.biz

Privacy requests from anywhere in the world, including the European Union and the United Kingdom, can be sent to the same address. Please write "Privacy" in the subject.