Data Processing Addendum

What this addendum is

This addendum is between Lior Zabari Ltd., a company registered in Israel (company number 516967395), Even Yehuda, Israel (“Macy”, “we”) and the business that opened an account in the app (“you”). It forms part of the Terms of Use and applies from the moment those terms bind you.

It covers the personal information of the people who call or message your business, and of the people you ask Macy to call (“your data”). For your data you are the controller, the one who decides why and how it is used, and we are your processor, the one who handles it for you. If you handle it for someone else, you are their processor and we are yours. It is written to meet Article 28 of the GDPR and of the UK GDPR.

It does not cover your own account’s information or a site visitor’s. For those we are the controller, and the Privacy Policy applies.

What is processed

Your instructions

We process your data only on your documented instructions. Your instructions are the Terms of Use, this addendum, the way you set Macy up in the app, what you do in the app, and what you ask us in writing. We do not use your data for our own purposes, we do not sell it, and we do not use it to train AI models.

If a law that applies to us requires us to process your data in another way, we tell you first, unless that law forbids it. If we think an instruction of yours breaks data protection law, we tell you.

Confidentiality

Your data is open only to the few people on our team who operate the service, and they are bound to keep it confidential. A member of the team opens a business’s account only to support that business or to find a fault, in a view that only reads, and every such view is written to the server’s log.

Security

These are the technical and organizational measures in place. We may improve them, and we will not make them weaker.

• In transit. Traffic between a browser, the site, the app and the service is encrypted (HTTPS), browsers are told to use only the encrypted address, and an unencrypted request is sent on to it.
• At rest. The database and the recordings are in Google Cloud, which encrypts stored data. On top of that, the tokens of your WhatsApp and Google Calendar connections are encrypted by the service itself (AES-256-GCM) before they are stored, under a key kept in Google Secret Manager.
• Passwords. A password is kept and checked by Google Identity Platform. The service does not store or log it. A spoken code word, if you set one, is kept only as a salted one-way hash.
• Separation. Each business’s data is stored under its own account. A request to the app is tied to the signed-in account by a signed cookie, and the service refuses a request that names another account.
• Signing in. The sign-in cookie cannot be read by scripts, travels only over HTTPS and only to the app, and lasts up to 7 days. Signing out ends it. Repeated failed sign-ins are locked out for a time, and a change in the app is accepted only from the app’s own pages.
• Our team’s access. Only named members of our team, signed in with their own Google accounts, can open another business’s account, and only to read. Their views, and the decisions they make on requests, limits and an account’s status, are written down.
• Recordings. The storage that holds them is closed to public access. A recording is played only through the app, to a signed-in owner of that business or to a member of our team in the read-only view, and it is deleted 30 days after the call.
• Messages from providers. The service accepts an event from the telephony provider or from WhatsApp only when it carries that provider’s valid signature.
• Logs. The server’s own log carries ids, counts and codes. It does not carry what was said on a call or written in a message, phone numbers in it are masked down to their last four digits, and keys and tokens are kept out of it.
• Secrets. Keys and provider credentials are kept in Google Secret Manager, and the service runs under an account of its own that holds only the permissions it needs.
• Limits. The service limits the calls an account can have in a day and how long a call can run, and Macy dials only regular phone numbers of your business’s own country.

Sub-processors

You agree that we use the outside services listed on the Sub-processors page to process your data. Each one handles it under a written contract with us that puts data protection duties on it, and we answer to you for what they do with your data.

Before we add or replace a sub-processor, we change that page and tell you at your account’s email address, ahead of the change, so that you can object. If you object on reasonable data protection grounds and we cannot offer you a way around the new service, you may close your account.

Requests from people

A person may ask you to see, correct, delete, restrict or receive the information you hold about them, or object to its use. We help you answer:

• In the app. The app’s settings are where this is done directly: “Erase one person” finds everything stored about one caller or contact by a phone number or an email address, hands it over or erases it, and “Export my data” gives you one file with everything stored for your business. These controls are being added to the app as this version is published. Where a control is in your app, it acts at once.
• By email. Where a control is not in your app yet, or does not reach what you need, write to hello@meetmacy.com and we do it for you.
• A person who writes to us. If someone asks us directly about your data, we pass the request to you and tell them that you are the one to answer. We do not answer it for you.

A personal data breach

If we become aware of a personal data breach that affects your data, we tell you without undue delay, at your account’s email address: what happened, what data and which people it concerns as far as we know, what it is likely to mean, and what we have done and suggest. We add what we learn later. It is for you to decide whether to tell an authority or the people concerned, and we help you with the facts you need.

Other help we give you

Taking into account what the processing is and what we know, we help you meet your own duties about the security of your data, about an assessment of the processing’s effect on privacy, and about consulting an authority before it, by giving you the information this addendum and the Sub-processors page hold and by answering reasonable written questions.

Where the data is, and transfers

We are established in Israel, which the European Commission has decided provides adequate protection for personal data (Decision 2011/61/EU), and which the United Kingdom treats as adequate under its own rules.

Your data is stored and processed in the United States, by the sub-processors: the service’s server in Google Cloud’s us-east4 region, the database in Google Cloud’s United States multi-region, the recordings in Google Cloud Storage in us-east4, and the AI models and speech recognition on Google Cloud’s United States endpoints. So data of people in the United Kingdom, or anywhere else outside the United States, is transferred to the United States. The sub-processors handle it under their own data processing terms with us, which are named and linked on the Sub-processors page.

Deletion or return at the end

• Return. Before your account ends you can take a copy of your data: with “Export my data” in the app where that control is available, or by asking us for it.
• Deletion. When your account ends, we delete your data without undue delay: with “Delete my account” in the app where that control is available, or by us when you write. Everything stored for the account goes: its settings, its calls, transcripts, messages, meetings, contact cards and WhatsApp conversations, its recordings, its sign-in details and its connections.
• What stays. One record that the account was deleted: its id, when, at whose request and how many records went, with no personal data. And anything that a law obliges us to keep, for as long as it does.
• During the account. A recording is deleted 30 days after its call, and the other conversation records are kept no longer than your retention period, as the Privacy Policy describes.

Information and audits

We give you the information needed to show that we meet this addendum: this page, the Sub-processors page, and answers to reasonable written questions.

Where the law gives you a right to audit and that information is not enough, you may audit how we handle your data, yourself or through an independent auditor who is bound to confidentiality: on reasonable written notice, in working hours, without disturbing the service or exposing another business’s data, not more than once a year unless an authority requires it or after a breach, and at your own cost.

Your part

• You have a reason the law accepts for handling your data with Macy, and you tell the people concerned what the law of their place and yours requires, including about call recording and about being answered by an AI assistant.
• Your instructions to us, and the way you set Macy up, are lawful.
• You answer the people who ask about their information, with the help this addendum describes.
• You keep your sign-in details safe and tell us at once of a problem with your account.

Order, liability and changes

Where this addendum and the Terms of Use disagree about the handling of your data, this addendum prevails. The Terms of Use govern everything else, including liability, the governing law and the courts.

We update this addendum when the law, the product or the sub-processors change. Every version carries its number and the date it comes into force at the top of the page, and a material change is announced as the Terms of Use describe.

Contact

• Email, for anything about your data: hello@meetmacy.com
• The company: Lior Zabari Ltd., a company registered in Israel (company number 516967395), Even Yehuda, Israel

In force from October 19, 2026. Version 1.1. See also the Terms of Use, the Privacy Policy, the Sub-processors and the Accessibility Statement.