1. Who We Are

LHBOT ("we", "our", "us") is operated by LHDIRECT LTD, a company registered in Israel, with its registered address in Tel Aviv, Israel. We operate the LHBOT platform, accessible at lhbot.app. We provide AI-powered WhatsApp chatbot services for businesses. For privacy-related inquiries, contact us at: [email protected]

2. Information We Collect

Information you provide directly

• Account information: name, email address, WhatsApp phone number, password (hashed, never stored in plain text)
• Bot configuration: system instructions, FAQ content, Q&A knowledge base cards, calendar links, webhook URLs, Gemini API key
• Website URLs submitted for knowledge base scraping
• XML product feed URLs (Google Shopping, WooCommerce, Shopify catalogs)
• Payment information: processed by our payment provider (PayProGlobal); we do not store card numbers

Information generated through your bot

• WhatsApp conversations handled by your bot: contact name, phone number, message content, AI responses
• Message timestamps and language detection results
• Usage statistics: number of messages sent per month
• Performance analytics data: daily message counts, peak activity hours, language distribution, response rates (aggregated per bot, retained for 14 days)
• Media files received from customers: images, voice messages, videos, and documents (processed for AI responses, subject to same retention as messages)

Website scraping data

• When you submit a website URL for the knowledge base, we crawl and extract text content from the pages of that site
• Scraped content is stored as processed text associated with your bot — it is not shared with other users
• Website content is retained for as long as your bot exists or until you remove the URL from your settings
• We do not store raw HTML, cookies, or login-protected content from scraped sites

Technical information

• IP address and browser type when using the dashboard
• WhatsApp session data stored on our servers to keep your bot connected
• Push notification tokens if you install the PWA and enable notifications

3. How We Use Your Information

• To operate the service: authenticate your account, run your WhatsApp bot, deliver AI responses, process media files, and execute auto follow-ups
• To display your inbox: show you conversations your bot had with your customers, including multi-agent activity
• To send OTP codes: verify your WhatsApp number during registration or login
• To enforce plan limits: track monthly message usage against your subscription limit (including API-sent and follow-up messages)
• To process payments: share billing details with PayProGlobal to charge your subscription
• To provide analytics: generate performance dashboards including daily message counts, peak hours, language distribution, and response rates
• To send push notifications: if you install the PWA and opt in, we send notifications for new messages, connection status changes, and usage alerts
• To improve the service: analyze aggregate usage patterns (not individual messages)

3.5 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contract performance: Processing necessary to provide the LHBOT service you signed up for, including account management, bot operation, and message delivery.
• Legitimate interest: Processing necessary for our legitimate business interests, such as improving the service, preventing fraud, and ensuring platform security, where these interests are not overridden by your rights.
• Consent: Where you have given us explicit consent, such as opting in to push notifications or providing website URLs for knowledge base scraping.
• Legal obligation: Processing necessary to comply with legal requirements, such as tax and accounting obligations or responding to lawful government requests.

4. Data Retention

• Conversation messages are retained for 90 days, after which they are automatically deleted
• Each bot retains a maximum of 5,000 most recent messages
• WhatsApp session files for inactive bots are deleted after 30 days of inactivity
• OTP verification codes expire within 10 minutes and are purged within 1 hour
• Website knowledge base content is retained until you remove the URL or delete your bot
• Product feed data is retained and refreshed on each import; removed when you delete the feed or your bot
• Analytics data (charts, peak hours, language split) is retained for 14 days on a rolling basis
• Push notification tokens are retained until you uninstall the PWA or revoke notification permissions
• Account data is retained until you delete your account

5. Data Sharing

We do not sell your data. We share data only with:

• Google Gemini (AI): message content is sent to Google's Gemini API to generate responses. Governed by Google's Privacy Policy.
• PayProGlobal: billing information for payment processing. Governed by PayProGlobal's privacy policy.
• WhatsApp / Meta: Your bot connects to WhatsApp through an unofficial, third-party method (not the official WhatsApp Business API). Message delivery passes through WhatsApp's infrastructure. LHBOT is not affiliated with, endorsed by, or officially connected to WhatsApp Inc. or Meta Platforms, Inc. Your use of WhatsApp is subject to Meta's Terms of Service. For full risk disclosure, see Section 4 of our Terms of Service.
• Your configured webhooks: if you set up a webhook (Make, Zapier, N8N), conversation data is sent to that URL per your configuration.
• Outbound API consumers: if you use the Outbound API, message delivery status and content are processed through our servers to WhatsApp.
• Push notification services: if you enable push notifications via the PWA, notification tokens are processed through standard web push protocols.

5.5 International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. Specifically:

• Google Gemini (AI processing): United States
• PayProGlobal (payment processing): International
• Railway (hosting): United States
• WhatsApp/Meta (message delivery): United States

Where data is transferred outside the EEA, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission and adequacy decisions where applicable. You may request a copy of the relevant safeguards by contacting us at [email protected].

5.6 Sub-Processors

We use the following sub-processors to provide our services:

Sub-Processor	Purpose	Location
Google Gemini	AI response generation	United States
PayProGlobal	Payment processing	International
WhatsApp / Meta	Message delivery	United States
Railway	Application hosting	United States

We will provide at least 14 days' prior notice before adding any new sub-processor, by updating this page and notifying active users by email.

6. Your Rights

Depending on your location (including under GDPR and the Israeli Protection of Privacy Act (PPA)), you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data and account.
• Right to restriction: Request that we limit how we process your data in certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time (this may require closing your account).
• Right to lodge a complaint: File a complaint with a supervisory authority. For EEA residents, this is your local Data Protection Authority. For Israeli residents, this is the Israeli Privacy Protection Authority (PPA).

To exercise any of these rights, email us at [email protected]. We will respond to your request within 30 days. If we need additional time, we will notify you of the extension and the reasons for the delay.

7. Controller-Processor Relationship

When your bot interacts with your customers on WhatsApp, their messages and phone numbers are stored in your account.

• You (the user) are the data controller for your customers' data. You determine the purposes and means of processing your customers' personal data through the bot.
• LHBOT (LHDIRECT LTD) acts as a data processor on your behalf. We process your customers' data solely to provide the LHBOT service as instructed by you.

As the data controller, you are responsible for:

• Ensuring you have a lawful basis to process your customers' data (e.g., consent, legitimate interest)
• Providing your customers with appropriate privacy notices
• Responding to your customers' data subject requests
• Complying with all applicable data protection laws in your jurisdiction

A Data Processing Agreement (DPA) is available upon request. Contact [email protected] to obtain a copy.

8. Security

• Passwords are hashed using bcrypt and never stored in plain text
• Gemini API keys are stored encrypted at rest and are never exposed in the dashboard after initial entry
• Outbound API keys are generated securely and can be regenerated at any time from your settings
• All connections use HTTPS/TLS
• WhatsApp sessions are stored on persistent volumes with restricted access
• Webhook URLs and third-party integration credentials are stored encrypted

8.5 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify affected users by email within 72 hours of becoming aware of the breach
• Notify the relevant supervisory authority where required by law
• Provide details of the nature of the breach, the data affected, likely consequences, and the measures taken to address it

9. Cookies & Local Storage

LHBOT does not use cookies. We use your browser's localStorage to store your authentication token and keep you logged in. Specifically:

• We do not use tracking cookies or advertising cookies
• We do not use analytics cookies (no Google Analytics, no third-party trackers)
• The only client-side storage used is localStorage for session management
• No cookie consent banner is required because we do not set any cookies

10. Children's Privacy

LHBOT is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email or by displaying a notice in the dashboard. Continued use of the service after changes constitutes acceptance.

12. Trademark Notice

'WhatsApp' and 'Meta' are registered trademarks of Meta Platforms, Inc. 'Google' and 'Gemini' are trademarks of Google LLC. LHBOT is an independent product and is not affiliated with, endorsed by, sponsored by, or officially connected to Meta Platforms, Inc., WhatsApp Inc., or Google LLC. All trademarks referenced herein belong to their respective owners.

13. Contact

Questions about this policy? Email us at [email protected]