Privacy Policy

This policy covers the WhatsApp service center that Velto (Erez Shilo, sole proprietor, Israel) builds and runs for public bodies, such as municipalities and local councils ("the Organization"). Residents write to the Organization's WhatsApp number, and the service opens a request, routes it to the right department and keeps the resident updated. Velto connects to the Organization's own WhatsApp Business account through the WhatsApp Business Platform (Cloud API) as its technology provider. The Organization decides what the service is used for; Velto processes the data on its behalf.

What the service accesses

• Messages from residents to the Organization's WhatsApp number: the phone number, the WhatsApp profile name and the content of the messages.
• Request details created from the conversation: department, status, response times and the rating the resident gives at the end.
• The Organization's WhatsApp Business account, after the Organization approves access: phone number details, message templates and message delivery status.

How it is used

Only to answer the resident, open and route the request, notify the responsible staff member, send status updates about the request, and measure how quickly requests are handled. The data is never used for marketing, never sold, and never used to train AI models.

Who processes it

Only the services that run the service center: Meta (WhatsApp Business Platform), Vercel (hosting), Supabase (database, in the EU) and Telegram (notifications to the Organization's staff). Some of them store data outside Israel.

Security

WhatsApp access tokens are kept as server-side secrets and are never shown in the browser. Every incoming WhatsApp event is checked against Meta's signature before it is processed. The database is not reachable from the public internet without server credentials, and only Velto and authorized Organization staff can see requests.

How long it is kept

• Conversation state (where the resident is in the conversation): deleted after 30 days.
• Requests and their messages: deleted after 24 months.
• Access to the Organization's WhatsApp Business account: until the Organization disconnects Velto, which it can do at any time in its Meta business settings.

Data deletion

A resident can ask to see, correct or delete their data by contacting the Organization, or by writing to erezshilo2594@gmail.com with the phone number they wrote from. We reply within 30 days. An Organization that stops using the service can ask for all of its data to be deleted in the same way.