Privacy policy
Updated: 18 October 2026 · This is an English translation. If the Hebrew and English versions differ, the Hebrew version prevails.
This document has two parts. Part A explains what information is collected when you browse e26.ai. Part B is the privacy policy of the E26 service itself, and applies to customers and users of the system.
Part A: Browsing e26.ai
1. Who is responsible. The website is operated by E3E Technologies, licensed dealer no. 209080407, 16 Homa uMigdal St., Tel Aviv, which is the database owner for information collected on it. For any privacy matter: info@e3etech.com.
2. What is collected when you browse. Technical data is collected automatically: IP address, browser and device type, pages viewed, visit length, and where you came from (for example an ad or a search).
3. Enquiries. The website itself does not store forms. The contact buttons open a WhatsApp chat or a calendar for booking a meeting. What you write there reaches us, is saved in our system as an enquiry, and is used only to get back to you and show you the service.
4. Cookies and third-party tools. We use three kinds of cookies and tools:
- Essential: to run the website and remember choices, such as your choice in the cookie banner. Always on.
- Measurement: such as Google Analytics, to understand which pages help and where visitors get stuck.
- Marketing: such as Google Ads and the Meta Pixel, to measure how our advertising performs and to show E26 ads to people who already visited the website (remarketing).
Measurement and marketing cookies load only after you agree to them in the cookie banner. You can change your choice at any time through "Cookie settings" at the bottom of the website.
5. What Google and Meta do with the information. If you agree to marketing cookies, Google and Meta receive information about your visit and may combine it with information they already hold, under their own policies. You can manage your preferences with them directly: Google ad settings · Meta ad preferences. We do not sell personal information to anyone.
6. Transfers abroad. The measurement and advertising providers operate outside Israel, mainly in the United States. Transfers are made under the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
7. How long it is kept. Measurement data is kept for up to 14 months. Enquiries received through the website are kept as set out in section 6 of Part B.
8. Your rights. Under the Privacy Protection Law, 5741-1981, you may access information about you, ask to correct or delete it, and object to marketing. Contact us at info@e3etech.com. If your request is not answered, you may contact the Privacy Protection Authority.
9. Minors. The website and the service are intended for businesses, not for anyone under 16.
10. How this relates to Part B. Section 11 of Part B, which says we do not use advertising cookies, refers to the E26 system itself, that is, the app customers work in. On the marketing website, the rules in this part apply.
Part B: Privacy policy of the E26 service
Version 1.2 · Updated: 22.9.2026
This policy explains what personal information we collect, why, on what basis, how long we keep it, and what your rights are. It complements the Terms of use, the AI agents addendum and the Data processing agreement, and replaces any earlier version.
E3E Technologies (the "Provider", "we") operates the service. For any privacy matter: info@e3etech.com
1. The distinction to understand first
There are two kinds of information in the service, and our role differs for each:
| The information | Database owner | Our role |
|---|---|---|
| Information about the customer: who signed up, contact details, billing, usage | Us | Database owner |
| Customer content: the leads, customers, conversations and files the customer manages with us | The customer | Holder only |
In other words, we are not the database owners of our customers' end customers. We hold that information for the customer and process it only on its instructions, as a "holder" under the Privacy Protection Law, 5741-1981.
This policy covers information for which we are the database owner. For processing of customer content, see the Data processing agreement (DPA).
2. What information we collect
2.1 Information you give us
When opening an account: first and last name · email address · phone · business name · role.
In a commercial engagement: company or licensed dealer number · billing address · contractual contact details, to issue invoices and meet legal obligations.
When you contact us: the content of the enquiry, in any channel.
In your personal profile, if you choose: date of birth · photo · notification preferences.
2.2 Information collected automatically
IP address · browser and operating system type · date and time of access · pages viewed · actions taken in the system · errors · device identifiers for push notifications.
2.3 Information we do not collect
We do not collect or store credit card details. Payment is processed by an external provider, and we receive only a payment confirmation from it.
2.4 Sensitive information
We do not ask for sensitive information: health, political opinions, origin, belief or sexual orientation. If a customer chooses to enter such information into its content, that is its responsibility as database owner, and it undertakes that it has a lawful basis to do so.
2.5 Information received from your Google account
Connecting a Google account is entirely your choice and is not a condition for using the system. If you connect it, this is exactly what we touch and what we keep:
| Permission requested | What it allows | Why | What we keep |
|---|---|---|---|
View calendar events (calendar.events.readonly) |
Read-only access to your primary calendar. We read all events from today up to 180 days ahead, not only meetings with customers, and create records from them in the system. Birthdays and "working location" events are not read | So that a meeting you booked in Google, including from your phone, also appears in the system and gets a reminder to the customer, without duplicating what you already booked | The event time, title, description, location, Google event ID and time zone. We have no write permission to your primary calendar, and we do not change or delete anything in it. An event that ended more than 30 days ago is deleted from our side automatically |
Calendar created by the app (calendar.app.created) |
Create, update and delete only in a separate calendar named E3E opened in your account | So that a meeting you book in the system appears in your calendar and on your phone | The events we ourselves wrote there, and their IDs. This permission gives no access to your personal calendar or any other calendar. |
Account email address (userinfo.email) |
Reading the email address only | To show you which account is connected and to link the connection to the right person | The email address only |
Sign in with Google (openid, userinfo.email, basic profile) |
Signing in and opening an account with your Google account instead of a password. This is separate from connecting the calendar and is available to anyone, including those who did not connect a calendar | So you do not need to manage another password | Email address, your Google ID, and profile name and photo if Google returns them. We do not import contacts, files or any other information |
These are all the permissions we request from your Google account: the first three for connecting the calendar, plus basic identity details if you chose to sign in with Google. We do not request access to your mailbox, your files (Drive), your contacts or any other Google service.
What we do not do with this information:
- We do not sell it or pass it to any third party for its own purposes.
- We do not use it for advertising, or pass it to advertising networks.
- We do not use it to develop, improve or train artificial intelligence or machine learning models, including generalised, non-personalised models, ours or anyone else's, and we do not allow any of our subprocessors to do so.
- We do not let a person read it, except in three cases: when you gave explicit prior permission to view that specific information to resolve an issue you reported, when it is needed for security or fraud prevention, or when the law requires it.
What is sent to the language model provider, and why: if you turned on the AI manager and the "Tasks and calendar" source is on, the event title and time are sent to our model provider to generate the answer you see on screen, and for that purpose only. The provider is contractually bound not to train on the content. You can turn this source off at any time in the AI manager screen, and then calendar content is not sent at all.
How it is stored and how to disconnect: the access tokens to your account are stored encrypted. You can disconnect at any time in two ways: in the system settings, and on your Google account permissions page. Disconnecting deletes the access tokens on our side and we stop accessing the account immediately. Information already saved in your customer records, such as a meeting that was created, stays in your system until you delete it, and you can delete it at any time.
Limit on transfers of Google data: the general exceptions in this policy, including product improvement and usage analysis, disclosure to professional advisers, and a merger or sale of business, do not apply to information received from Google APIs. Such information is used only to provide or improve features visible to you in the interface, and is passed on only in four cases: to provide such a feature with your consent, for security and fraud prevention, when the law requires it, and in a merger or sale of business only with your explicit prior consent.
Changes in the use of Google data: if we want to use information received from your Google account in a new way not described in this section, we will notify you in advance and ask for your explicit consent to an updated policy before making the new use. Until you give such consent, we will continue to use the information only for the purposes listed here. This also applies to requests for additional Google permissions: they will be shown to you for separate approval, and not consenting does not affect your use of the service.
If we change the way E3E Technologies uses Google user data, we will notify users and prompt them to consent to an updated privacy policy before making use of Google user data in a new way.
Google's Limited Use policy: our use of information received from Google APIs, and its transfer to any other app, adheres to the Google API Services User Data Policy, including the Limited Use requirements.
E3E Technologies' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. What we use the information for
| Purpose | Legal basis |
|---|---|
| Setting up the account, providing and maintaining the service | Performance of contract |
| Billing, invoicing and collection | Performance of contract · legal obligation |
| Support and answering enquiries | Performance of contract |
| Information security, fraud detection and preventing misuse | Legitimate interest |
| Product improvement and usage analysis | Legitimate interest |
| Essential service messages | Performance of contract |
| Marketing messages | Consent · can be withdrawn at any time |
| Complying with requests of a competent authority | Legal obligation |
We do not sell personal information to third parties. Ever.
4. Where the information is stored
The information is stored and processed in the European Union:
| Component | Provider | Location |
|---|---|---|
| Database, files, authentication | Supabase | Ireland (eu-west-1) |
| Running the app | Vercel | Frankfurt (fra1) |
The State of Israel has been recognised by the European Commission as a country with an adequate level of protection for personal data. Transfers between Israel and the European Union are therefore transfers between two jurisdictions with a recognised level of protection.
Some of our subprocessors operate outside the EU. Transfers to them are made under the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and under suitable contractual commitments.
5. Who we share with
Only with service providers required to deliver the product, and only to the extent needed:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Data storage and authentication | Ireland |
| Vercel | Running the app | Germany, USA |
| Anthropic | Running the AI agents (default provider) | USA |
| OpenAI | Running the AI agents, reading documents and transcription | USA |
| Meta / WhatsApp | Sending and receiving messages | USA |
| GreenAPI | WhatsApp infrastructure | Cyprus |
| Calendar connection, at the customer's choice. See section 2.5 | USA | |
| Resend | Sending and receiving email | USA |
| Morning (GreenInvoice) | Payment processing and issuing documents | Israel |
| iCount · Rivhit | Bookkeeping, at the customer's choice | Israel |
| 019 Mobile | SMS messages | Israel |
| Microsoft Clarity | Measuring interface usage, with full masking | USA |
Each provider is contractually bound to confidentiality, information security, and using the information only to provide the service to us.
We do not train models on customer content, and we do not allow our subprocessors to do so. The AI agents run on commercial API terms in which use of content for training is contractually blocked, and not through the consumer interfaces of those providers, where the terms differ.
We may also disclose information to professional advisers (lawyers, accountants), to a competent authority under an order or legal obligation, and in a merger or sale of business.
6. How long we keep it
| Information | Period |
|---|---|
| Active account | For the duration of the engagement |
| Conversation content (WhatsApp, chat, agent) | 24 months |
| Email in the system | 12 months |
| Activity logs | 90 days |
| Admin access and security logs | 12 months |
| Usage and consumption data | Up to 400 days |
| Recycle bin for deleted records | 30 days |
| Export after termination | 7 days of access |
| Deletion from the system | 3 months after the engagement ends |
| Deletion from backups | 9 months after the engagement ends |
| Accounting records | 7 years, required by law |
| Consent records | As long as needed as evidence |
| Trial account not converted | 30 days after the trial ends |
| Support enquiries | Duration of the engagement + 12 months |
7. How we protect it
- Encryption in transit with TLS 1.2 or higher, with HTTPS enforced.
- Encryption at rest at the infrastructure level of the storage provider.
- Tenant isolation at the database level (Row Level Security), not only in the app. One customer's information is not accessible to another even through a direct query to the database.
- Role-based access control with least privilege.
- Private file storage. Every access goes through a signed, time-limited link.
- Audit log for sensitive actions.
- Rate limiting and signature verification on every external interface.
- Separate environments for development and production.
- Backups according to the storage provider's policy.
Access to information is limited to those who need it for their role.
No system provides absolute security. Please keep your password safe and report any suspected misuse to us immediately.
7.1 Support access to your account
For support, troubleshooting, maintenance or handling a security incident, an authorised representative of ours may enter your account and see the screens as you see them.
Conditions:
- Only for the purposes listed above. Not for any other purpose.
- Every entry is logged with the representative's identity, time and IP address. An entry that fails to be logged is blocked.
- You will be notified of every entry by email, and by device notification if you enabled it.
- You can get the log of entries to your account at any time.
- Information that comes from your Google account is not viewed during support access except with your explicit prior approval for that issue, and not on the basis of the after-the-fact notice alone.
8. Your rights
Under the Privacy Protection Law, 5741-1981 and its amendments:
| Right | What it means |
|---|---|
| Access | See the information we hold about you |
| Correction | Correct information that is wrong, incomplete or out of date |
| Deletion | Delete information no longer needed, subject to retention duties under law |
| Objection to marketing | Remove yourself from direct marketing at any time |
To exercise them: info@e3etech.com. We will handle your request within the period set by law. We may first ask to verify your identity.
If your request was not handled to your satisfaction, you may contact the Privacy Protection Authority.
Important: if you are an end customer of one of our customers and want to exercise a right regarding your information, contact the business you corresponded with directly. It is the database owner; we only hold the information for it. We will help it handle your request.
9. Marketing and opting out
You can remove yourself from marketing messages at any time: through the link at the bottom of the message, in your account settings, or by contacting us.
Essential service messages cannot be opted out of: security alerts, billing messages, material changes to the terms, and outage notices. They stop when the account is closed.
10. Automated decision-making and AI
The service includes automated agents that analyse information and draft communications.
For information under our control: no decision with a material effect on a person will be made by automated means alone, without the possibility of human review.
For customer content: the customer decides whether to turn on an agent, what is fed into it, and the operational meaning of its output. Responsibility for transparency, human review and answering requests for explanation towards its end customers lies with the customer. See the AI agents addendum.
11. Cookies and usage measurement
Essential cookies: to keep you signed in and remember display preferences. Required to run the service.
Usage measurement: we use Microsoft Clarity to understand where users run into difficulty: repeated clicks, clicks on things that are not clickable, and errors in the browser.
The tool runs with full masking, meaning screen content is not sent, only the page structure and the interaction.
We do not use advertising cookies, and we do not pass information to advertising networks.
12. Minors
The service is intended for business use only and is not intended for anyone under 16. We do not knowingly collect information from minors. If you learn of such a case, contact us and we will act to delete it.
13. Changes to the policy
We will update this policy from time to time. A material change will be notified 30 days in advance, by email or by a prominent notice in the system. Continued use after the change takes effect constitutes consent.
Exception: information received from your Google account. A change in how such information is used does not take effect by silent consent. It requires your explicit prior approval, as set out in section 2.5.
14. Contact
E3E Technologies Company / licensed dealer no. 209080407 16 Homa uMigdal St., Tel Aviv info@e3etech.com Support: Sunday to Thursday, 09:00 to 18:00
Version 1.2 · Last updated: 22 September 2026