This is one layered policy. Sections 1–11 apply to everyone. Sections 12–15 add detail about the website, 16–22 about Mia (AI receptionist), 23–29 about SepNets Fleet, and section 30 about our mobile apps. If you only use one service, read sections 1–11 plus that part.
Roles: for website visitors, enquiry contacts, and the callers, chat users and SMS recipients described in sections 16–22, SepNets is the data controller. For customer business data processed in Mia and Fleet under a subscription (sections 16–29), the SepNets customer is the controller and SepNets is the processor — the customer's own privacy obligations are in the Customer Terms, the Mia and Fleet addenda, and the Data Processing Agreement (doc 06).
Contact and account details you give us (name, business, email, phone).
Communications content: emails, support requests, chat messages, and — for phone calls handled by Mia — call audio recordings, transcripts and AI summaries.
Technical data: IP address (processed by our hosting/security provider and telecommunications providers; not retained in our analytics), device/browser type. Under Amendment 13 to the Privacy Protection Law, 5741-1981 (in force since August 14, 2025), geolocation and online identifiers are expressly included in the definition of personal data.
Location data in SepNets Fleet (vehicle GPS positions, driver phone GPS).
3. Purposes and legal bases
We process personal data to: provide and support the services you asked for (contract), meet legal obligations, keep the services secure and prevent abuse (legitimate interest), improve the services, and — only where you consented — send marketing (Communications Law §30A: prior opt-in consent required; withdrawal anytime; see section 7).
4. Subprocessors we rely on
We use third-party providers only to deliver the service. Current list (details per part below):
Provider
Purpose
Data involved
Country
Cloudflare
Website hosting, bot protection (incl. Turnstile on the enquiry form)
Visitor IP (transient, for delivery/protection), request metadata
Global network, incl. USA (no regional data-residency option on our plan)
Customer billing contact + payment data handled by its payment processors; SepNets stores no card numbers
Israel
We may add or replace providers; material changes to this list will be posted here (and, for customer data, notified per the DPA).
5. Cross-border transfers
Our self-hosted infrastructure (Mia databases, recordings, analytics, email, encrypted backups) runs in Germany (EU); transfers from Israel to the EU are straightforward under the EU–Israel adequacy framework. Some providers process data outside Israel — USA: OpenAI, Twilio, Google/Firebase, Firecrawl, Cloudflare, and the Fleet platform provider (section 25). Basis: for customer-data processing, our Data Processing Agreement and equivalent contractual commitments with providers; for direct (controller) processing, it is necessary to perform the service you requested, plus provider contractual safeguards.
6. Retention (per data type)
Website enquiries: the form is delivered by workflow automation to the info@sepnets.io mailbox only — no website enquiry database exists. Enquiries are kept for 24 months from your last contact with us, then deleted.
Mia call recordings, transcripts and AI summaries: a fixed 90 days from the call, then automatically deleted.
Chat and SMS messages handled by Mia: kept while the business's subscription is active (no shorter fixed period today) and deleted with the rest of the business data at subscription end (see below). The business can ask us to delete specific conversations earlier.
Customer data-export files: kept 7 days for download, then deleted.
End of subscription: after a 7-day grace period (during which the customer may cancel or download an export of their data), all business data is deleted — in every case within 30 days of termination.
Fleet GPS history: retained by the Fleet platform provider for up to 12 months; deletion at subscription end is handled together with the provider.
Analytics events: anonymous; currently no deletion period is configured in our analytics store.
Backups: daily encrypted backups of the Mia platform are retained 30 days — data deleted at your request or by retention disappears from backups within about 35 days.
Accounting/invoicing records: 7 years (Israeli bookkeeping law).
7. Your rights and how to exercise them (Israeli Privacy Protection Law)
You may request: inspection/access (s.13), correction or deletion of inaccurate/outdated data (s.14), removal from direct-mail databases (s.17F), and withdrawal of consent (as easily as you gave it).
How: email info@sepnets.io from the address concerned (or tell us who you are in the message) and name the service or business involved. We respond within 30 days. SepNets business customers can also export their own data at any time from their dashboard (a ZIP of their tables and files, kept 7 days for download). If you are a driver or caller of a SepNets customer, we will handle your request together with the customer where the customer is the controller (see Parts C–D).
The Site and our services are intended for businesses; we do not knowingly process personal data of persons under 18. If you believe a minor has provided us personal data, contact info@sepnets.io and we will delete it.
9. Security
We apply the Israeli Data Security Regulations (2017) — for our role and data types we operate at least the Basic level controls (access control, logging, backup, written procedures) and apply Medium-level practices (encryption in transit and at rest, access reviews) to customer databases. See doc 06 for the DPA-level commitments.
10. No sale or rent of your data
We do not sell or rent your personal data. We also run no advertising pixels or cross-site ad tracking on the Site. Data is shared only with the subprocessors listed in section 4, as needed to provide the service, or as required by law.
11. Changes to this policy
Material changes will be posted here with a new revision date. For customer-data processing, notice of material changes is also given per the DPA.
Part B — Website (sepnets.io)
12. What we collect on the Site
Hosting & security (Cloudflare): your IP address and basic technical details are processed to deliver pages and block abuse.
Analytics (self-hosted Rybbit): pages visited, session duration, referrer, campaign parameters, browser/device, approximate location (country/region/city). Location is derived from your IP at visit time and the IP is then discarded; visitor identifiers are anonymous and reset daily. No cookies are set by analytics. Analytics is on by default; opt out anytime via the ribbon at the bottom of any page or "Privacy Preferences" in the footer. If you opt out, analytics does not run for your future visits.
Forms (trial/contact/fit-check): name, organization, phone, email, message. Phone contact about your enquiry only with the consent checkbox you ticked; a separate optional checkbox for product updates (unticked by default — Communications Law §30A).
Mia widget on this site: the widget stores an anonymous visitor ID in localStorage so a returning chat can be recognized. It is not shared with advertisers and is cleared when you clear your browser storage.
Analytics Preferences
We use privacy-friendly, cookieless analytics. You can opt out at any time.
Our analytics provider (Rybbit) does not set cookies and does not store your IP address.
13. Cookies and local storage
The Site itself sets no cookies. Your analytics choice and the widget's anonymous visitor ID live in localStorage. Cloudflare's bot-protection check may set strictly-necessary cookies of its own.
14. AI features on the Site
The chat/voice widget is answered by Mia, an AI system (see the Terms of Use, section 4). Chat conversations answered by the AI carry a visible notice that you are chatting with an AI. Voice calls started from the widget open with a short spoken disclosure that the call is handled by an AI system and is recorded, and are recorded and transcribed.
15. Website retention
Form enquiries: see section 6 (mailbox only; 24 months from last contact). Analytics events: anonymous, no deletion period currently configured (section 6). Cloudflare logs: per Cloudflare's own retention policy.
Part C — Mia, the AI receptionist (callers, chat users, SMS recipients)
16. Who is who
Mia serves our business customers. For their callers, website-chat visitors and SMS recipients, the customer is the data controller and SepNets is its processor. For the customer's own account, SepNets is controller.
17. Mia is an AI
Calls and chats are answered by an automated AI system, not a person. Every phone and website voice call opens with a short spoken disclosure: the call is handled by an AI system and is recorded. Customers can customize the wording of this disclosure for their business, but cannot remove it. Calls are recorded and transcribed; chat conversations answered by the AI display a notice saying so.
18. What we process about callers, chat users and SMS recipients
Phone number, name and other details stated in the conversation.
Call audio recording, transcript, and AI-generated summary.
SMS messages sent (confirmations/reminders) and the number they were sent to.
Chat messages typed into the customer's website widget, plus the anonymous visitor ID.
Appointment details booked (name, phone, time) written to the customer's Google Calendar via the Google Calendar API (Google LLC, USA — the customer connects their own Google account; Google's terms also apply).
Website content of the customer fetched via Firecrawl (USA) to build Mia's knowledge base (public pages only, at customer direction).
19. Where your data flows
Telephony and SMS metadata via Twilio (USA/global) — calls are not Twilio-recorded: our gateway receives the live audio stream and records it itself (TwiML streaming, no carrier-side recording), so Twilio holds no recording copy. AI conversation, voice processing and summaries via OpenAI (USA); API data is not used to train OpenAI's models. Storage of recordings, transcripts and contacts on our self-hosted infrastructure in Germany (EU), with daily encrypted backups retained 30 days (section 6).
20. Outbound calls and SMS
Mia makes outbound calls/SMS only to the customer's existing clients, candidates or sign-ups who agreed to be contacted. No cold calls. Marketing SMS requires prior explicit opt-in under Communications Law §30A (doc 04); reply STOP to stop marketing messages.
21. Your rights as a caller, chat user or SMS recipient
Contact the business you called, or us at info@sepnets.io; we will coordinate the response. You may ask to listen to or receive a copy of a recording/transcript of your call, correct it, or request its deletion (subject to the customer's legal retention duties). Withdrawal of marketing consent: reply STOP or contact the business / info@sepnets.io.
22. Retention in Mia
Call recordings, transcripts and AI summaries are kept for a fixed 90 days and then automatically deleted (customers may ask us for earlier deletion). When a subscription ends, the customer's business data — including recordings, transcripts and contacts — is deleted within 30 days (after a 7-day grace period in which the customer can export their data; the export file is kept 7 days). Some customers may be under sector retention duties, e.g. healthcare or legal — addendum 04.
Part D — SepNets Fleet (customer users, drivers, vehicle location)
23. Who is who
Fleet serves fleet-operating businesses. The customer (employer) is the controller of fleet data — including driver and vehicle-location data; SepNets is its processor. For the customer's own account/users, SepNets is controller.
24. What the platform processes
Vehicles: ID, plate, model, odometer readings (auto-collected), service and repair history, documents.
Drivers (via the customer's web platform): name, driver code, license dates, health-declaration renewal dates, shift status. The app stores no Israeli ID numbers.
Driver app (Android only; "SepNets Driver"): phone-number login (SMS verification), GPS location pings about every 10 minutes while tracking is on, background location while the foreground tracking service runs, device push-token for notifications, in-app messages, on-device queue of unsent pings.
Optional GPS-chip hardware tracking ("coming soon") — will be covered by a policy update before launch.
25. Where Fleet data is hosted
The Fleet platform is operated for SepNets by a third-party platform provider, which hosts all Fleet data on its own servers in the USA (sepnets.com). Driver-app location pings travel over Google Firebase (Authentication, Firestore, Cloud Functions — project hosted in us-central1, USA; Google LLC) to that platform. Vehicle, driver and location records are stored there and displayed to the employer's dispatchers. This US hosting is disclosed in section 5 and covered by the cross-border analysis in doc 06.
26. Employer monitoring notice
Driver location is visible to the employer. Our customers are contractually required to (a) inform drivers in writing that the app tracks location, including off-shift behavior of the app; (b) use tracking for lawful, proportionate fleet purposes only; (c) not track drivers off-shift (the app's tracking is driver-started/stoppable via an on-screen privacy toggle — see doc 05); and (d) handle driver data-access requests.
27. Retention in Fleet
GPS location history is retained by the Fleet platform provider for up to 12 months; vehicle and service records are kept while the subscription is active. Deletion at subscription end is handled together with the provider and confirmed with the customer.
28. Driver rights
Drivers may ask their employer, or us at info@sepnets.io (we will coordinate with the employer), for access to their location history, correction, deletion, and to stop marketing messages. The in-app privacy toggle stops GPS tracking at any time.
29. App-store disclosures
The driver app is Android-only; it declares background-location permissions and Google Play requires a prominent in-app disclosure and a privacy-policy link, which the app provides via its permissions screen. If an iOS version is released, this policy will be updated.
Part E — Mobile applications
30. Our apps
LinkPark (parking reminder app) keeps all data on the device only — parking GPS coordinates and paired Bluetooth device names — and never transmits it to servers. Its own policy: https://sepnets.io/linkpark-privacy-policy.html. The app contains no analytics, advertising or crash-reporting SDKs of its own. (Google Play may collect its own aggregate statistics under Google's terms.)
