ChatAdsAI · Palmidos Ltd
Part E - Privacy Policy
Version 2.0 · Effective 1 October 2026
Version 2.0 · English
ChatAdsAI is operated by Palmidos Ltd (Company No. 517210829), Ramat Gan, Israel
| Document | Effective Date |
|---|---|
| Terms of Service | 1 October 2026 |
| Schedule A - Plans, Deliverables and Payment | 1 October 2026 |
| Acceptable Use Policy | 1 October 2026 |
| Cancellation and Refund Policy | 1 October 2026 |
| Service Level and Support | 1 October 2026 |
| Privacy Policy | 1 October 2026 |
| Data Processing Agreement | 1 October 2026 |
| AI Transparency Notice | 1 October 2026 |
This English version is the binding version for Customers whose principal place of business is outside Israel. For Customers in Israel, the Hebrew version is binding (Section 31).
E.1 Who We Are
Palmidos Ltd, Company No. 517210829, Ramat Gan, Israel, the operator of ChatAdsAI, is the Controller of the data described in this document. Privacy inquiries: support@chatadsai.com. Details of the privacy protection officer, if and when appointed, will be published on this page.
E.2 Two Roles
| Data about you as a Customer | We are the Controller - this Policy applies |
| Leads and data from your campaigns | You are the Controller and we are the Processor - the Data Processing Agreement applies |
E.3 Notice under Section 11 of the Privacy Protection Law
The provision of data is voluntary; without the data required, we will not be able to provide the Services. The data is collected for the purposes of providing the Services, billing, support, security and legal compliance. The data will be provided to the Sub-processors listed in Section E.6, solely for the purpose of operating the Services, and to authorities as required by law. You have rights of access and rectification under Sections 13 and 14 of the Law, as set out in Section E.10.
E.4 Data We Collect
Data you provide: name, email, telephone, business name and registration number, position, billing details, Ad Account details, content of inquiries and correspondence. Data collected automatically: IP address, browser and device type, pages viewed, access times, session identifiers, logs. From third parties: performance data from the Ad Platform; payment confirmations from the payment processor. What we do not collect: full credit card details.
E.5 Purposes and Lawful Basis
| Purpose | Basis (GDPR) |
|---|---|
| Providing the Services and managing the account | Performance of a contract |
| Billing and invoicing | Performance of a contract; legal obligation |
| Support and operational communications | Performance of a contract |
| Security and fraud prevention | Legitimate interest |
| Product improvement - on account data and metadata only | Legitimate interest |
| Analytics and marketing | Consent |
| Direct marketing to existing customers | Legitimate interest, with a right to opt out in every message |
| Defense against claims | Legitimate interest |
| Compliance with legal obligations | Legal obligation |
E.6 With Whom We Share
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting and running the platform | USA, with global edge network |
| Neon Inc. | Storage of account data | Frankfurt, Germany (AWS eu-central-1) |
| An Israeli payment acquirer licensed by the Bank of Israel, as identified on the checkout page and invoice | Payment processing | Israel |
| Resend Inc. | System notifications | USA |
| OpenAI, L.L.C. | Content generation (language model) | USA |
| Professional advisers, authorities, acquirer in a corporate transaction | As required | - |
We do not sell Personal Data.
E.7 Artificial Intelligence
We do not use your content, your data or your leads to train models, and we contract with model providers on terms that prohibit this. We do not make decisions based solely on automated processing that produce legal effects concerning you.
E.8 International Transfers
E.8.1. The Company is located in Israel, in respect of which there is an adequacy decision of the European Commission (Decision 2011/61/EU, reaffirmed on 15.1.2024). The transfer of data from the EEA to Israel does not require any additional mechanism for so long as the decision remains in force; in the United Kingdom there is equivalent recognition.
E.8.2. The transfer of data from Israel to a Sub-processor outside Israel is made in accordance with the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001, including by obtaining a written undertaking from the recipient under Regulation 3. For a transfer to a country without a European adequacy decision - SCCs in the appropriate module.
E.9 Retention
| Data | Period |
|---|---|
| Inquiries that did not convert into a customer | Up to 24 months |
| Account data | The engagement + 7 years (tax and accounting) |
| Billing records | 7 years |
| Records of consent, registration and cancellation | 7 years from the end of the engagement - for defense against disputes |
| Technical logs | Up to 12 months |
| Analytics | Up to 26 months |
| Support correspondence | Up to 36 months |
E.10 Your Rights
Under Israeli law: access, rectification and deletion of inaccurate data, under the Privacy Protection Law. Under the GDPR / UK GDPR: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and lodging a complaint with a supervisory authority. Under US state laws: access, deletion, correction and opting out of sale, to the extent applicable. We do not sell data. Exercising your rights: support@chatadsai.com. Response within 30 days, free of charge.
E.11 Cookies
Essential cookies - without consent. Analytics and marketing - only after consent via the cookie banner, which may be changed at any time.
E.12 Security
Encryption in transit and at rest, access control, environment segregation, logs, backups. The Company maintains a database definitions document under Regulation 2 of the Data Security Regulations, and reports serious security incidents to the Privacy Protection Authority under Regulation 11(d).
E.13 Minors
The Services are not intended for persons under 18.
E.14 Representatives
The details of the Company's representative in the European Union (Article 27 GDPR) and in the United Kingdom (Article 27 UK GDPR) - name, address and email - are published at chatadsai.com/legal/representatives and updated upon any change. The representative may be contacted on any matter relating to the processing of Personal Data, in addition to contacting the Company. The appointment of a representative does not derogate from the Company's liability.
E.15 Changes
Any material change will be notified 30 days in advance.