Privacy Policy

Last updated: October 25, 2026

The "Kesher Kasher" service delivers your WhatsApp messages to your email. By its nature, the system processes personal content - so we treat your privacy as a core commitment, not a legal clause. This document explains transparently what we store, why, with whom, and what your rights are under Israel's Protection of Privacy Law, 5741-1981. This English version is provided for convenience; in case of any discrepancy, the Hebrew version prevails.

1. What Information We Store

• Message content and metadata: message text, sender names, group names and send times. This storage is required to render the "conversation pages" in your email - showing the most recent messages in a chat as context for each email. (Legal basis: performance of the service agreement.)
• Media files (images, documents, voice notes): stored in order to deliver them to your email and deleted automatically after 30 days. (Legal basis: performance of the service agreement.)
• WhatsApp connection credentials (linked-device credentials): stored encrypted with AES-256-GCM. We do not store your WhatsApp password - no such password is ever transmitted to us. (Legal basis: performance of the service agreement.)
• Admin-area account: email address and password - the password is stored as a one-way hash only, never as plain text. (Legal basis: performance of the service agreement.)
• Sign in with Google (your choice): if you choose to sign up or sign in with a Google account, Google gives us only your verified email address and your name. We get no access to your mailbox, contacts or anything else in the Google account. (Legal basis: performance of the service agreement.)
• Billing data: payment is made on a secure page of the payment and receipts provider SUMIT (Israel); card details are entered there only and never reach our servers. We keep the amount, date, payment status and receipt. (Legal basis: performance of the agreement and the legal duty to keep accounts.)
• Record of acceptance of the terms: at registration we keep the time of acceptance, the version of the documents accepted, the IP address and the browser type - as proof of consent. (Legal basis: legitimate interest in documenting consent, and compliance with the law.)
• Telegram channel: the list of channels and groups you asked to receive, the public content of approved channels (kept once, for every user following it), and if you connected a personal bot - the bot token, encrypted. (Legal basis: performance of the service agreement.)
• Free lane (free WhatsApp sending): name, email address (verified with a one-time code), phone number, the recipient's number and name, and the content of the messages sent and the replies received - see section 11. (Legal basis: performance of the service agreement.)
• Contact-form enquiries: the details given in the form (name, email, phone and the enquiry) are used solely to answer the enquiry. (Legal basis: legitimate interest in answering enquiries.)

2. What We Do Not Do

3. Sub-Processors

To provide the service we rely on established infrastructure providers, acting as data processors on our behalf:

• Service servers and database: cloud servers in the European Union (EU).
• Email sending and receiving: Brevo (Sendinblue SAS, France) and Amazon Web Services (SES, European data center) - according to the active configuration.
• Payments and receipts: SUMIT (Israel) - receives name, email, phone and amount for the charge and the receipt.
• Media file storage: on the service's servers in the European Union, encrypted, with automatic deletion after 30 days.

Our engagement with sub-processors is subject to data-processing agreements, and transfers of data outside Israel are made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001. Each sub-processor receives only the minimum information needed for its role, and is bound by confidentiality undertakings and by a restriction to the purposes for which the data was given.

4. AI Features - Only When You Enable Them

Two features of the service use external artificial-intelligence providers, and they are off by default or active only at your choice:

• Voice-note transcription - audio files are sent for transcription to OpenAI (Whisper), which processes the data in the United States.
• Daily group summary ("what you missed today") - the message content of the relevant groups is sent for summarization to Anthropic, which processes the data in the United States.

Message content is transferred to these providers only when you have enabled the feature. Turning the feature off stops the transfer immediately.

5. Cookies

The admin area uses a single authentication cookie, whose purpose is to recognize you between visits. The free lane keeps one cookie of the same kind, identifying the email address you verified, for up to 90 days. The site has no advertising cookies.

A partner or friend code you arrived with is kept in your browser only (localStorage), to prefill the registration form; the admin area's display preferences (language, view) are also kept locally in the browser. None of these is passed to any third party.

The site also measures visits in a privacy-preserving, first-party way: the page path, the referrer, the browser family and whether the device is mobile are recorded - with no IP address and no identifying detail. The measurement honours the browser's Do-Not-Track setting: when it is on, nothing is created and nothing is sent.

Local measurement identifiers. So that we can tell how many different people visited the site and not only how many pages were opened, two random identifiers are kept in your browser: one in localStorage (the same browser over time) and one in sessionStorage (one browsing session, removed when the tab closes). They are random numbers only - not derived from you, your device or your IP address, contain no personal data, are not cookies, and are not readable by any other site. They serve only our aggregate counts and are not passed to any third party. Clearing site data in the browser (or browsing in a private window) removes them completely.

Alongside our first-party measurement, the site uses Google Analytics 4 (Google) to understand how visitors use the site and to improve it. It sets cookies in your browser and may transfer usage data (such as your IP address and actions on the site) to Google's servers, including outside Israel. You can opt out through your browser settings and cookie blocking, or with Google's official opt-out add-on.

6. Data Security

• Transport encryption (TLS/HTTPS) for all communication with the service. WhatsApp connection credentials are encrypted with AES-256-GCM; message content and files are kept on secure servers in the European Union, protected by access control, and deleted automatically according to the schedule in section 8.
• WhatsApp connection credentials are encrypted with AES-256-GCM, with the encryption key kept separate from the data.
• Message content is stored encrypted in the database, so a copy of the file (a backup, say) is unreadable without the encryption key.
• Full separation between user accounts (isolated multi-tenancy).
• The operator accesses message content only for technical support at your request or to resolve a fault, and every such access is written to a dedicated access log, with the reason and the name of the person who looked.
• A device held by the operator (premium and "plug and forget" tracks): your WhatsApp account runs on a device located with the operator and serving you alone. The operator technically has access to that device; it is used solely to keep the connection alive and for support, subject to the access log above.

Important to know: WhatsApp's end-to-end encryption ends at the service's servers, where the message is converted into an email. Transport is encrypted (TLS) and sensitive credentials are encrypted at rest - but ordinary email is not an end-to-end encrypted channel.

7. Data Location and Backups

Data is stored on servers in the European Union. Regular encrypted backups are made for resilience and recovery, also in Europe. Data deletion also applies to backup copies as part of the regular backup cycle.

8. Data Retention and Deletion

• Message content (text, transcripts and media captions) - stored encrypted for the limited period needed to show the conversation pages in your email, up to 90 days by default, then deleted automatically in a daily sweep.
• In your account settings you can choose to keep message content for less: a month, a week, a day or an hour. When the chosen time ends, the message is deleted from the site and from our server, and only after it has been sent to your email. Messages that already reached your email inbox and WhatsApp itself stay there.
• After the content is deleted, only a minimal technical record remains - the message ID at WhatsApp, the chat it belonged to, and when and in which direction it was sent. It holds no message content, sender name or phone number, and it is needed so that WhatsApp does not deliver the same old messages to your inbox again after the device reconnects.
• Media files - deleted automatically after 30 days, and together with the content of the message they belonged to.
• Login tokens and password-reset links - deleted automatically when they expire or after they are used.
• Site visit measurements (first-party, no personal identification) - deleted after 180 days.
• Billing data and receipts - kept as required by law for accounting and tax records (as a rule, up to 7 years), also after the account is closed.
• Enquiries through the contact form and the cancellation page, and support enquiries - kept for up to 3 years for record-keeping and replies, and deleted automatically at the end of that period.
• The record of acceptance of the terms (section 1) - kept while the account exists, and after its closure for the limitation period (7 years), as proof of consent.
• Free lane - a conversation inactive for more than two days may be deleted when another user writes to the same recipient; message content is subject to the same automatic deletion as any other message (up to 90 days), and the cookie expires after 90 days.
• Technical system logs - deleted within 30 days at most, unless a short additional period is needed to diagnose a fault or for information security.
• On account closure - all account data, including message content, media files and WhatsApp connection credentials, is deleted when the closure is carried out, and in any case within 30 days (except data we are legally required to keep, such as billing data). Where an accounting record must be kept, only a numeric identifier remains in the system to link the record - no email address, name, phone or any other identifying detail.

9. Your Rights

Under the Protection of Privacy Law, 5741-1981 (including Amendment 13), you have the following rights:

• Access - to receive information about the data stored about you.
• Correction - to request correction of inaccurate or outdated information.
• Deletion - to request deletion of information, subject to retention obligations under law.
• Restriction of processing - to ask that certain processing of your data be restricted, subject to what the service needs in order to operate.
• Data portability - to receive the data you provided in an accessible, common format, as far as technically possible.

We aim to acknowledge every request within 2 business days, to handle it within 21 business days, and to carry out a deletion within 7 business days of approving the request - and in any case no later than the deadlines set by law.

To exercise these rights, write to us: info@kesher-kasher.co.il. Requests are free of charge; to protect the data we will ask you to verify your identity, for example by writing from the account's email address.

10. Information about Third Parties

When people write to you on WhatsApp, their messages - including names and identifiers - are processed in the system solely in order to deliver them to your inbox, as part of providing the service (legal basis: legitimate interest in providing the service). We make no other use of that content. The responsibility to use the service lawfully and fairly towards your contacts - including obtaining any consent the law requires from them - rests with you.

11. The Free Lane and Sending Messages to Third Parties

On the free lane, messages are sent from a shared WhatsApp number of the service, in your name, to the recipient you enter. We keep your details (name, verified email, phone), the recipient's number and name, and the content of the conversation, so that we can deliver the replies to your email and enforce the daily quota. A refused send (over quota, for example) is recorded with the reason and the recipient's number, without the message text. The recipient sees the service's number and the contact name you entered. You are responsible for the sending being lawful: an "advertisement" may not be sent to anyone who has not consented to receive it (section 30A of the Communications Law), and harassment is prohibited.

12. Minors

The service is intended for adults (aged 18 and over) only. We do not knowingly collect information about minors on our own account. If we learn that information about a minor was collected unlawfully, we will delete it promptly. A parent who uses the service for family communication that includes their minor children is responsible for the content transmitted about them.

13. Changes to This Policy

We will update this policy from time to time. Material changes - for example, adding a sub-processor that processes message content - will be announced in advance by email or in the admin area.

14. Enquiries and Complaints

If you are not satisfied with how we handled your privacy enquiry, you have the right to apply to the Privacy Protection Authority at the Ministry of Justice: privacy@justice.gov.il, tel. 076-8809999, gov.il.

15. Contact

For privacy matters: info@kesher-kasher.co.il