Privacy Policy — Locallynk

Who we are

Locallynk Community Manager (community.locallynk.io) is operated by [LEGAL ENTITY NAME], company no. [COMPANY NUMBER], [REGISTERED ADDRESS], Israel ("Locallynk", "we").
Privacy contact: [PRIVACY EMAIL]

Your account data (your Google sign-in details, WhatsApp number, settings, consents and how you use the service): Locallynk is the controller (the database owner).
Community members' data you add (names, phone numbers, emails, and anything you write about them in tasks, drafts and messages): you [or the community organization you name at sign-up — pending decision D1] are the controller. Locallynk is the processor (the holder): we process this data only on your behalf and under your instructions, as set out in "Community members' data" in the Pilot Terms below.

Google account (name, email, profile picture): to sign you in to the dashboard.
Google Calendar access (create and edit events only): to create and manage the events you ask for.
Gmail send access [if Gmail send is enabled in the pilot — pending decision D3]: only to send the emails you ask the service to send. We never read your mailbox.
WhatsApp number and text messages: to understand and answer your requests. The assistant handles text only. We do not download or store voice notes, audio or other media.
Community members' data you add (names, phone numbers, emails): to keep people, groups and tasks for you.
Content created for you (tasks, drafts, summaries): to provide the service.
Draft link opens: when you open a "send to…" link, we record that it was opened, to mark the message as handed off.
Technical data (logs, session cookies): to run, secure and fix the service. Our logs do not contain message text, phone numbers or names.
Pilot feedback: to improve the product.

No law requires you to provide this data; it is voluntary.
Without Google sign-in, your WhatsApp number and messages, we cannot provide the service. Without Calendar access, calendar features won't work.

Israel: we process data under the Privacy Protection Law, 5741-1981 (as amended, including Amendment 13) and the Privacy Protection (Data Security) Regulations, 2017. For account data, this is based on your consent and on providing the service you asked for. For members' data, we act on your instructions.
EU residents (GDPR): for account data, contract (providing the service), legitimate interests (security, improvement) and consent where requested, which you may withdraw anytime. For members' data, we act as your processor (Art. 28).

We process it only to provide the service to you, and only on your instructions.
By adding members' data, you confirm that you are allowed to share it with us, that you have told the members it is stored here, and that you will use it lawfully.
Don't add sensitive details (health, allergies, religion, family status and the like), and don't add a minor's phone number without a parent's consent.
The assistant never messages community members. It talks only to you. (If someone who isn't a registered manager writes to it, it sends one reply with a sign-up link.)
A community member can ask us to delete their details by emailing [PRIVACY EMAIL]. We complete the deletion within 30 days [and notify the manager — pending decision D6].
When a member's details are deleted, we remove their record and search for their name and phone everywhere else in the service. For free text you typed yourself (for example, a misspelled name in a task title or note), deletion is best effort: we may not find every variation, so please check and edit your own notes too.

Cloudflare: hosting; data stored in the EU [pending decision Q18].
Meta: WhatsApp Cloud API, to deliver messages. Meta keeps its own copies under its own terms.
OpenAI and/or Google (Gemini) [provider pending decision Q3]: AI features that understand your text messages. Phone numbers, emails and links are removed in code before a message reaches the AI provider, but names you type do reach it.
Google: sign-in, Google Calendar [and Gmail send, if enabled — pending decision D3].
Providers handle data under their own terms and may process it outside Israel and the EU (e.g., in the US), with appropriate safeguards [SAFEGUARDS].
[PENDING DECISION D2 — keep only the wording that matches the signed provider terms:] Our AI providers do not use your data to train their models. They may keep inputs for up to 30 days for abuse monitoring [unless zero data retention is approved in writing — pending D2].
We do not sell your data. We may disclose data where required by law.

Locallynk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Calendar data is used only to create and manage the events you request, never for advertising.
[If Gmail send is enabled in the pilot — pending decision]: Gmail access is limited to sending the emails you ask us to send. We don't read, store or analyze your mailbox, don't use it for advertising, and don't let people read it, except with your consent, for security, or as required by law.
Events we create in your Google Calendar stay in your calendar under Google's terms. Deleting data in Locallynk doesn't remove them from your calendar.

Message text you send us is deleted within 30 days. AI processing results are deleted within 7 days.
Members' data is kept until you delete it or a member asks us to delete it, and in any case is deleted when your community's data is deleted.
Pilot data is deleted within [30] days after the pilot ends, unless you sign up to continue.
You can ask us to delete your data at any time. We respond within [30] days.
Deleted data rolls off our backups within 30 days. Copies held by Meta and by the AI provider expire under their terms (see above).

Israel: access your data (section 13) and ask to correct or delete inaccurate, incomplete, unclear or outdated data (section 14).
EU residents: access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent.
To make a request, email [PRIVACY EMAIL]. Requests about members' data are handled as described in "Community members' data".
You may complain to the Israeli Privacy Protection Authority; EU residents, also to their local supervisory authority.

We use reasonable measures, including encryption in transit and access controls.
No system is fully secure; we cannot guarantee security.

The dashboard uses only essential session cookies for sign-in. [IF ANALYTICS ARE USED: describe and obtain consent.]

The service is for users aged 18 and over only.
Don't send sensitive data (health, religion and the like) about yourself or others.