Privacy Policy

Who we are and what this policy covers

Macy and the website meetmacy.com (“the site”) are operated by Lior Zabari Ltd., a company registered in Israel (company number 516967395), Even Yehuda, Israel (“we”).

Macy is an AI assistant for businesses. She answers a business’s phone, takes messages, books meetings, makes the calls the owner asks her to make and, when the business connects it, answers on WhatsApp. The business runs her from the app at app.meetmacy.com (“the app”). Macy is offered to businesses in the United States and the United Kingdom.

This policy says what personal information is handled, why and on what legal basis, who receives it, where it is kept and for how long, and what you can ask for. It covers three groups of people: visitors to the site; business owners and the people who act for them in the app; and, to explain our part, the people who call or message a business that uses Macy.

For anything about privacy, including a request to use one of your rights: hello@meetmacy.com. We answer a privacy request within one month.

Our two roles

We decide. For visitors to the site and for business owners’ accounts, the controller is Lior Zabari Ltd., a company registered in Israel (company number 516967395), Even Yehuda, Israel. A controller, in the words of the GDPR and the UK GDPR, is the one who decides why and how personal information is used, and who answers for it.

The business decides. For the people who call or message a business that uses Macy (its callers, leads and customers), the business is the controller. It decides what Macy answers, what she books and what is kept, and it is responsible to those people. We handle their information only for the business and on its instructions, as its processor, under the Data Processing Addendum that is part of our terms with every business.

So if you called or wrote to a business and Macy answered, your first address is that business. If you write to us instead, we pass your request to the business and help it answer. We do not decide such a request ourselves.

What we handle, why, and on what legal basis

The site asks you for nothing. The missed-call calculator works only in your browser: the numbers you type never leave the page and are not kept. “Get started” is a plain link to the app.

Macy is set not to save payment card details or passwords in what you teach her, even when asked. Please don’t give her any.

People who call or message a business that uses Macy

For this group the business is the controller and we are its processor (see Our two roles). The legal basis is the business’s to decide and to tell you. This is what Macy handles for it:

Where this information comes from: from you, during the call or the chat; from the phone network and from WhatsApp (your number, the caller ID name, your profile name); from the business, when it asks Macy to phone you or adds a note; and, for a brief before a meeting, from public web pages that a search found.

Whether you have to give it

No law obliges you to give us information. To open an account we need a name and an email address, and to set Macy up we need the details of the business; without them we cannot provide the service. On a call or in a chat you choose what to tell Macy, and you can hang up or stop writing at any moment. You can read the whole site without giving anything.

Who receives it

• The business, in its own app: the calls, messages, meetings and contact cards of the people who contacted it.
• Our own team: the few people who operate the service. To support a business or to find a fault, a member of the team can open that business’s account in a view that only reads, and every such view is written to the server’s log.
• Providers that process it for us, on our instructions (sub-processors): Google Cloud, where the service runs and where its AI models and speech recognition run; Telnyx, which carries the calls; Cloudflare, which serves the site and passes the app’s traffic to the service; and Meta, when a business connects WhatsApp. What each one does, what it handles and where is on the Sub-processors page.
• The person you booked with, through Google Calendar. When a business uses Google Calendar, the meeting goes into the business’s own Google calendar and Google sends the invite to the email address you gave.
• Tools our team uses to build and operate the service, including AI tools for development such as Anthropic’s Claude, which may see information while we look into a fault.
• Professional advisers, such as an accountant or a lawyer, only as far as needed.
• Authorities, when a law or an order requires it.
• A buyer of the business, if it is sold or merged, on condition that the buyer takes on this policy, and after notice on the site.

We don’t sell personal information, we don’t rent it, and we don’t give it to anyone for their own marketing or advertising.

Where it is kept, and transfers

We are established in Israel. The European Commission has decided that Israel provides adequate protection for personal data (Decision 2011/61/EU), and the United Kingdom treats Israel as adequate under its own rules.

The information itself is stored and processed in the United States, by our providers. The service’s server runs in Google Cloud’s us-east4 region (Northern Virginia). The database is Google Cloud Firestore in its United States multi-region (nam5). Call recordings are in Google Cloud Storage in us-east4. The AI models and the speech recognition run on Google Cloud’s United States endpoints. Calls travel through Telnyx. Cloudflare serves the site and passes the app’s traffic through its network, which has servers in many countries.

So if you are in the United Kingdom, or anywhere else outside the United States, your information is transferred to the United States and processed there.

The providers handle it under their own data processing terms with us: Google Cloud’s Cloud Data Processing Addendum, under which the European Commission’s standard contractual clauses apply to transfers that European or United Kingdom data protection law restricts; Telnyx’s Data Processing Addendum, which is part of its terms of service and incorporates the standard contractual clauses; Cloudflare’s Data Processing Addendum, which is part of its customer agreement and applies the standard contractual clauses; and, when a business connects WhatsApp, Meta’s terms for the WhatsApp Business Platform. Each provider’s own page is linked from the Sub-processors page, and you can ask us for a copy at hello@meetmacy.com.

No second route today. The software can send a request for the text model to Google’s Gemini API, which Google does not tie to one region, when Vertex AI turns it down, but only if a key for that service is configured. None is configured, so every request to the models stays on Vertex AI in the United States. If we ever turn that route on, we will say so here and on the Sub-processors page first.

How long it is kept

• Call recordings: deleted 30 days after the call.
• The server’s logs: deleted after 30 days.
• A business’s conversation records (calls with their transcripts, messages taken, past meetings with their briefs, finished outgoing calls, WhatsApp conversations, the update feed and the owner’s chat with Macy): for that business’s retention period, and no longer. The period is 24 months unless the business chooses a shorter one: 3, 6 or 12 months.
• Leads and contact cards: a closed lead, or a card the business marked as not relevant, goes once it has not been touched for the retention period. An open lead, a card that is new or in progress, and a customer stay for as long as the business keeps its account.
• A meeting that is still ahead is never removed because of its age.
• The account itself, its settings, what the business taught Macy, its requests and its usage totals: for as long as the account exists. When a business deletes its account, or asks us to delete it, everything stored for it is deleted: its settings, its conversation records, its recordings, its sign-in details and its connections. What remains is one record that the account was deleted: its id, when, at whose request and how many records went, with no personal information.
• What Macy keeps to continue a WhatsApp conversation (the last turns of it): not used after 24 hours.
• Email you send us: for as long as it takes to deal with what you asked, and to keep a record of it afterwards.

The retention period applies to every business, and a clean-up deletes what is older than it every day. A request to delete something sooner is handled as Your rights describes.

Security

These are the measures in place today:

• Traffic between your browser, the site, the app and the service is encrypted (HTTPS), and an unencrypted address is sent on to the encrypted one.
• Each business’s information is kept under its own account, and every request to the app is tied to the signed-in account by a signed cookie. One business cannot ask for another’s information.
• The tokens of a business’s WhatsApp and Google Calendar connections are encrypted (AES-256-GCM) before they are stored. Passwords are kept by Google Identity Platform, not by us.
• The storage that holds recordings is closed to public access. A recording is played only through the app, to someone who is signed in: the owner of that business, or a member of our team in the read-only view.
• The service accepts a message from the telephony provider or from WhatsApp only when it carries that provider’s valid signature.
• The server’s own log does not carry what was said on a call or written in a message, and phone numbers in it are masked down to their last four digits.
• Sign-in attempts and requests are limited, and a change in the app is accepted only from the app’s own pages.

No system is completely safe. If you suspect a security problem, write to us right away. What we do when something goes wrong is in If there is a security incident.

Your rights, and how to use them

Where the GDPR or the UK GDPR applies to you, you have these rights over your personal information:

• Access: to know whether we hold information about you, and to get a copy of it.
• Correction: to have wrong or incomplete information put right.
• Deletion: to have it deleted, unless a law requires it to be kept.
• Restriction: to have its use paused, for example while a correction is checked.
• Objection: to object to a use that rests on legitimate interests. We then stop, unless there are compelling reasons that the law accepts.
• Portability: to receive what you gave us in a common, machine-readable format, where we use it under a contract or with your consent.
• Withdrawing consent: where a use rests on your consent, to take it back at any time. That does not undo what was done before.

How to use them. Write to hello@meetmacy.com and say what you are asking for. We answer within one month. To make sure the information is yours, we may ask you to confirm from the email address or the phone number it belongs to. Using a right costs nothing, and we will not treat you differently for using one.

Business owners: in the app. The app’s settings are where the same things are done directly: export my data (one file with everything stored for the business), delete my account, erase one person (everything stored about one caller or contact, found by a phone number or an email address), and the retention period. These controls are in the app and act at once. You can also write to us, and we do the same thing for you.

If you called or wrote to a business: ask that business. It can find, hand over or erase what Macy holds about you. If you ask us, we pass your request to it and help it answer.

Your right to complain. You can complain to a data protection authority at any time: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk/make-a-complaint); in the European Economic Area, the authority of the country where you live. A complaint costs nothing and does not stop you from writing to us or going to court. We would be glad to hear from you first.

Privacy laws in California and in several other states of the United States may give you further rights: to know what is collected, to get a copy, to correct, to delete, and to opt out of the sale of your information or of its use for targeted advertising. We don’t sell personal information and we don’t use it for targeted advertising.

Cookies and similar storage

This site sets no cookies and loads no analytics tools, no advertising pixels and no scripts from other companies.

The accessibility options. The button in the bottom corner of every page opens options such as a larger text and high contrast. Your choices are remembered in your browser’s local storage, in one entry, written only after you change something and removed when you set everything back to normal. They stay in your browser: they are not sent to us or to anyone else, and they are not a cookie.

Measurement. No measurement or advertising tool is configured today. If we add one, for example Google Analytics or the Meta Pixel, it will load only after you agree in a cookie banner. Your answer will be kept in your browser’s local storage for up to 12 months and sent to no one, a “Cookie settings” link at the bottom of every page will let you change it at any moment, and before any tool is switched on this section will name it, its cookies and what it receives.

The app at app.meetmacy.com uses cookies only for signing in. All of them are strictly necessary, and none follows you anywhere else:

• The sign-in cookie, which keeps you signed in for up to 7 days. It holds an account id, an expiry time, a random value and a signature, and no script can read it.
• A marker that this browser has opened the app, so the sign-in page opens the right way. It holds no information about you and lasts a year.
• Two short cookies that exist for ten minutes while you sign in with Google or connect Google Calendar, so that the answer from Google comes back to the same browser.

The app also keeps two small conveniences in your browser’s local storage: the volume you chose for listening to a call, and the time of the last WhatsApp line you looked at. It loads no analytics. On the screen that connects WhatsApp, the app loads Meta’s own script for that step, and Meta may set its cookies under its own policy.

Messages

We don’t send newsletters or advertising.

• To a business owner: the emails that confirm your address or reset your password, and Macy’s updates and answers in the app and, if you connected WhatsApp, in your own WhatsApp chat with her.
• To the people who contact a business, Macy writes or calls only for that business: a calendar invite by email, sent by Google, when a meeting is booked through Google Calendar; on WhatsApp, answers to people who wrote first, within 24 hours of their last message, and one reminder shortly before a meeting; and a phone call, only when the business’s owner asked her to make it.

Artificial intelligence and automation

Macy is an artificial intelligence system, not a person. She says so in her first sentence on every call, together with the fact that the call is recorded, and in her first message on WhatsApp. She is set never to say or hint that she is a person.

What is automated. Answering a call or a WhatsApp message from what the business taught her; taking a message; checking the calendar and booking or cancelling a meeting; writing the transcript of a call; writing a one-line summary and a rough reading of interest on a contact card; preparing a brief before a meeting, with a web search; and a reminder before a meeting.

What people decide. The business’s owner decides what Macy may answer, whether she books or only takes messages, and whether a booking on Macy’s own calendar waits for the owner’s approval (with Google Calendar a meeting is booked at once). The status on a contact card is set by the owner. Macy places an outgoing call only when the owner asks for it in the app, and when a decision in such a call belongs to the owner, she asks the owner and waits. A person on our team reviews every request for a phone number or a plan.

No decision that has a legal effect on you, or a similarly significant one, is made by automation alone. What Macy does on her own is answer, take a message and book or cancel a meeting, and the business sees all of it in its app, where it can listen to a call while it happens.

Transcripts, summaries and briefs are written by a model and can contain mistakes. If information about you is wrong, it can be corrected as Your rights describes. We do not use your information to train AI models.

Google user data

When a business owner connects Google Calendar in the app, they give Macy two permissions:

• calendar.events: so Macy can put on the calendar the meetings booked on a call or on WhatsApp, with a meeting link.
• calendar.freebusy: so Macy knows when the owner is busy. This permission returns only the start and end times of busy periods, with no title, description, guests or location.

Signing in with Google uses openid, email and profile, only to identify the business owner.

This is how the data is used:

• Busy times. Macy uses them, without the events’ details, to offer free times on a call or in a chat.
• Event details. The titles and times of calendar events are read from Google only to show the business owner their own calendar in the app, with no description, guests or place.
• Meetings Macy booked. We keep the time of the meeting, what was said about it in the conversation, the meeting link, and the id of the event in Google Calendar.
• Google’s access grant (the refresh token) is stored encrypted (AES-256-GCM), separately for each business, and is passed to no one.
• Data from Google is not used for advertising, is not sold and is not passed to others, apart from the processing on Google Cloud described in this policy. We don’t use it to train AI models.
• The owner’s calendar events are shown to the owner only. A member of our team who opens an account to support it cannot open them.
• Disconnecting the calendar in the app asks Google to revoke the permission, and deletes the grant on our side in any case. You can also revoke the permission directly in your Google account, at myaccount.google.com/permissions.

Macy’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Children

Macy, the app and the site are for businesses and for the adults who act for them. We don’t knowingly open an account for anyone under 18. A business’s callers can be of any age: their information is the business’s to answer for, as Our two roles describes. If you believe a child gave us information directly, write to us and we will delete it.

If there is a security incident

If a breach of security affects personal information that we answer for, we tell the people affected and the authorities as the law requires. A business customer is told of a personal data breach that affects its data without undue delay: what happened, what information was involved, what we did and what we suggest it does.

Changes to this policy

We update this policy when the law, the product or the way we work changes. Every version carries its number and the date it comes into force at the top of the page. A material change is announced on the site before it takes effect. A copy of an earlier version is sent to anyone who asks.

Contact and complaints

• Email, for anything: hello@meetmacy.com
• The company: Lior Zabari Ltd., a company registered in Israel (company number 516967395), Even Yehuda, Israel
• A privacy request is answered within one month.

If our answer was not enough, you can complain to a data protection authority, as Your rights describes.

In force from October 19, 2026. Version 1.1. See also the Terms of Use, the Data Processing Addendum, the Sub-processors and the Accessibility Statement.