Privacy Policy
This policy explains what Lomif.ai collects, why, who helps us, and your rights, wherever you are. Lomif.ai is run by Halawani Tech Plus (HT+), Licensed Dealer (Osek Murshe) no. 207049065, Baladi Mall, Beit Hanina, Jerusalem. HT+ is the controller (under Israeli law, the database owner) of your account data. For the messages and customer data you handle through Lomif.ai, you (the business) are the controller and we process that data for you under the Data Processing Terms in section 6 of our Terms; see "Your customers' data" below.
What we collect
- Account: your name, email, password (stored hashed), business name and details, region and language settings, the staff or clients you invite, and whether you agreed to receive marketing from us.
- Connected platforms (only the ones you connect): Facebook Pages and Instagram (profile, posts, comments, messages, insights); WhatsApp Business (messages, customer phone numbers and names, templates); TikTok (basic profile, counts, your video list, and videos you choose to publish); Google Business Profile (locations, reviews, posts); YouTube, LinkedIn, X, Threads, Bluesky, Reddit, Pinterest, Snapchat and Mastodon (your profile, the posts you publish, and the comments and messages they send back); Discord (messages in the channels you choose); your email mailbox (messages and attachments); and website chat (messages visitors send).
- Calls (if you use the AI phone receptionist): the caller's number, call audio and transcripts of calls and voice messages the AI receptionist answers.
- Content you upload or create: pictures, videos, captions, products, characters, storyboards. Photos of people (for example a photo you use for a character or a presenter) are used only to make the picture, video or cut-out you asked for. We do not use them to identify anyone, we do not create face templates or other biometric data from them, and we do not use them to train AI models. Only upload photos of people who agreed to it.
- Payments: your plan, invoices and the last four digits of a saved card. Card numbers are handled by our payment provider, Tranzila, and never reach us.
- Usage: which pages of the app you open and for how long, buttons used, errors, credits used, and security logs (IP address at sign-up and sign-in).
- Visitors to lomif.ai before signing up: if you chat with Lomi on lomif.ai, the messages you type and Lomi's answers, kept for 30 days to answer you and fix errors. If you use "Let Lomi read it", the Instagram account you paste and the public profile information Lomi reads from it, used only to show you the preview and deleted within 24 hours. Only paste an account you run. We count visits to lomif.ai with our own statistics, without storing IP addresses.
- Advertising measurement (only if you tap Allow on our cookie banner): if you came from one of our ads, the Meta Pixel on lomif.ai and on the sign-up pages tells Meta that a visit, sign-up or payment happened, so we can see which ads work. Meta handles this under its own privacy policy. We never share your content, messages or customers with advertisers.
- Claude and ChatGPT: if you run Lomif.ai from Claude or ChatGPT, that assistant sends us your requests and receives our answers under its own privacy policy.
What you must give us
To open an account you must give your name, business name, email and a password, and confirm you are 18 or older. Without them we cannot open an account. Everything else (connecting platforms, uploading content, agreeing to marketing) is your choice; if you do not give it, the features that need it will not work. No law obliges you to give us any of this data.
Where we get data from
Most data comes from you. We also receive data from:
- the platforms you connect, for example messages and comments your customers send through Instagram or WhatsApp;
- Google or Facebook, if you sign in with them (your name and email);
- our payment provider Tranzila (whether a payment succeeded); and
- public Instagram profiles you paste into "Let Lomi read it".
Why we use it (legal bases)
- To provide the Service you signed up for (contract): inbox, AI replies, posting, broadcasts, results, billing.
- To answer your questions on lomif.ai and show you the Instagram preview before you sign up (steps you ask us to take before a contract, and our legitimate interest in showing what Lomif.ai does).
- To keep the Service secure and working, and to improve it using usage statistics and de-identified or aggregated data (legitimate interests: running a secure and reliable service). We do not use your messages, your customers' data or your chats with Lomi to improve the Service, unless you send them to us in a support request.
- To meet legal duties, such as tax and accounting records (legal obligation).
- To measure our ads with the Meta Pixel (your consent, which you can withdraw at any time in Cookie settings). For collecting this data on our pages and sending it to Meta, HT+ and Meta Platforms Ireland Ltd are joint controllers under an agreement that makes HT+ your first point of contact; Meta is responsible for what it does with the data afterwards.
- To send you news and offers about Lomif.ai, only if you ticked the marketing box at sign-up or opted in later (your consent). Every marketing message has an unsubscribe link, or you can reply STOP. Messages about your account, billing, security or changes to our terms are not marketing and do not need this consent.
- We do not sell your data, use your content or messages for advertising, or use your content to train AI models.
Who in our team can see your data
Our team can see your account activity, including what you ask Lomi and the answers, pictures and videos it gives you, to support you, to keep the Service secure and working, to check the quality of what Lomi makes and to fix errors. Access is limited to staff who need it, is logged, and is covered by confidentiality obligations. The activity log is kept for up to 90 days.
AI and your customers
When you turn on suggested or automatic replies, the messages being answered are sent to our AI providers so they can write the reply. By default, when replies are sent automatically, each new conversation starts with a short notice that the business uses an AI assistant. These messages go only to Anthropic and OpenAI, whose terms do not allow them to train their models on the data we send them. In No-AI mode, nothing is sent to any AI service.
Who processes it
We share data only with the providers below, and only to do what you asked. The current list is always on our sub-processor page at https://lomif.ai/subprocessors/; we update it before adding or replacing a provider.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Newfold Digital (Bluehost) | Hosting, database and email sending | All Service data | United States |
| Cloudflare | Network security and delivery | Traffic to the site and app | Global network (United States company) |
| Anthropic (Claude) | AI text, replies and analysis | Content you use AI on; messages being answered | United States |
| OpenAI | AI pictures, transcription, voices, Free-plan AI writing | Content you use AI on; messages being answered | United States |
| Sawtak | Arabic voices | Text to be spoken | Germany |
| Higgsfield | AI video, using the LTX-2.5 model by Lightricks (Israel) | Prompts, pictures and video you use | United States |
| Sync Labs (sync.so) | Lip-sync for talking scenes in videos | Video clips and voice lines of those scenes | United States |
| bundle.social | Connections to Instagram, Facebook, TikTok, YouTube, LinkedIn, X, Threads, Snapchat, Pinterest, Google Business, Reddit and Bluesky | What you publish, and the comments and messages Lomif.ai reads or sends | Poland (European Union) |
| Twilio | Phone and WhatsApp numbers, calls | Phone numbers, messages, call audio | United States |
| Tranzila | Card payments | Card details (we never see them), amounts | Israel |
| Meta (Pixel, only with your consent) | Advertising measurement | That a visit, sign-up or payment happened | Ireland and United States |
The platforms you connect (Meta, WhatsApp, TikTok, Google, Discord and others) receive what you publish or send through them, under their own policies.
Transfers abroad. Some providers are outside your country. For data sent out of Israel, we rely on the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, including written undertakings from recipients. The European Commission recognises Israel as providing adequate protection, so data can come to us from the EU. For onward transfers to countries without such recognition, we use the EU Standard Contractual Clauses and the UK Addendum, or the EU-US Data Privacy Framework where a provider is certified under it. You can ask us for a copy of these safeguards.
Cookies and storage
Lomif.ai uses cookies to keep you signed in and to remember your cookie choice. Only if you tap Allow on our cookie banner, we also set a cookie that remembers which ad or link brought you (30 days) and the Meta Pixel cookies (advertising measurement, see above). If you choose Only necessary, none of these are set, and you can change your choice at any time in Cookie settings at the bottom of every page. Your browser's storage keeps settings like language, theme and pinned pages. Our fonts are served from our own servers, so loading a page does not send your IP address to Google.
Security
- Access tokens for connected platforms are stored encrypted and used only for your account.
- Data is encrypted in transit (HTTPS), and access tokens and keys are also encrypted when stored.
- Staff and agency access follows the permissions you set; our own staff access is limited by role and logged.
- We keep backups, a written security procedure and an incident log, in line with the Israeli Privacy Protection (Data Security) Regulations, 2017.
- If a security breach affects your data, we tell you without undue delay, and the authorities where the law requires.
How long we keep it
| Data | How long |
|---|---|
| Account and business data | While your account is active |
| Messages and posts | While your account is active; temporary copies of platform data are refreshed or removed automatically |
| Usage statistics, activity log and staff access log | Up to 90 days |
| Chats with Lomi on lomif.ai (before sign-up) | 30 days |
| Instagram preview ("Let Lomi read it") | 24 hours |
| Marketing consent records | While your consent applies, and afterwards as long as needed to show we had it |
| Payment and invoice records | As long as tax law requires |
| Everything else, after you delete your data or your account | Erased from live systems within 30 days and from backups within a further 30 days |
Your rights
Wherever you live, you have the right to:
- see the data we hold about you and get a copy (in Israel, under section 13 of the Protection of Privacy Law);
- correct data that is wrong or incomplete (in Israel, under section 14);
- have your data deleted;
- restrict how we use it;
- receive your data in a portable format, or have it sent to another provider;
- object at any time to our use of your data based on legitimate interests, and to marketing; and
- withdraw any consent you gave (for marketing or cookies) at any time, without affecting what we did before.
Using these rights is free. If we cannot act on a request, we tell you why and how to complain.
How to use them:
- Delete everything yourself in Credits & billing → Delete all my data, or write to us using the contact details below.
- We answer within 30 days. We may ask you to confirm that the account or data is yours before acting.
- In Israel you can complain to the Privacy Protection Authority at the Ministry of Justice. In the EU, the UK and similar places you can complain to your data protection authority.
Automated decisions
Lomif.ai does not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Scores and suggestions, such as the presence score and suggested replies, are tools to help you decide.
Your customers' data
If you use Lomif.ai to talk to customers, you are the controller of their data and we process it only on your instructions, under the Data Processing Terms in section 6 of our Terms. You are responsible for telling your customers how you use their data, for having a lawful reason to message them, and for sending marketing only to people who agreed to it. Your customers' messages may contain sensitive information, such as health details. We process it only to provide the Service to you, and protect it like all other customer data.
If one of your customers writes to us about their data, we pass the request to you within 5 business days and help you answer it, for example by deleting that customer's chats. We act directly only where the law requires us to. See also our Data deletion page.
Children
The Service is for businesses and is not meant for people under 18.
Changes
We will show the new date here and tell you in the app or by email about important changes before they take effect.
Contact
Halawani Tech Plus (HT+), Licensed Dealer (Osek Murshe) no. 207049065, Baladi Mall, Beit Hanina, Jerusalem · info@lomif.ai · WhatsApp +1 707 878 5664 · Phone +972 2-540-5530
Privacy contact: Adam Halawani, Co-Founder & CTO · info@lomif.ai (subject "Privacy")