Privacy Policy

This Privacy Policy is not a generic website privacy policy. It is an enterprise-grade legal document governing the privacy and data handling practices of ELION SYSTEMS LTD in connection with its website, platform, AI-powered business communication services, front-office automation solutions, and related operations. ELION is primarily a business-to-business (B2B) platform. In the course of providing its services, ELION may process information relating to customers, prospects, leads, patients, consumers, callers, website visitors, and end users who interact with ELION Customers.

“ELION”, “Company”, “we”, “us”, “our”

ELION SYSTEMS LTD, Company Number 517350260, registered in Tel Aviv, Israel.

“Customer”

The business entity that subscribes to, accesses, or uses our Platform.

“End User”

Any individual who interacts with ELION customers through our Platform, including prospects, leads, patients, consumers, callers, and website visitors.

“Platform”

The multi-tenant SaaS platform and related services providing AI-powered business communication and front-office automation solutions.

“Personal Data”

Any information relating to an identified or identifiable natural person, as defined by applicable data protection legislation.

Under applicable data protection laws, the distinction between a Data Controller and a Data Processor is paramount.

ELION as a Data Processor

ELION generally acts as a Data Processor (or Service Provider) when processing Customer Data, End User Data, Call Data, Conversation Data, and other operational data on behalf of our business Customers to provide the Platform services. In such capacities, Customers retain the obligations of a Data Controller.

ELION as a Data Controller

ELION acts as a Data Controller with respect to data processed for account management, billing, support, security, website analytics, marketing, and internal business operations.

ELION operates a multi-tenant SaaS architecture. Customer environments are logically separated as part of the Platform design. Additional security, segregation, and dedicated enterprise deployment options may be introduced over time to address evolving operational, security, and compliance requirements.

We may process the following categories of data:

Processing may be carried out for service provision, account administration, communications handling, analytics, security, support, compliance, and legitimate business operations. Processing activities are conducted subject to applicable law and Customer responsibilities where ELION acts as a Data Processor. ELION relies on appropriate legal bases such as the performance of a contract, legitimate interests, legal obligations, or consent, as strictly applicable under relevant jurisdictional frameworks.

ELION provides AI-powered voice solutions. Voice AI processing includes call recording, speech processing, transcription, AI response generation, appointment scheduling, lead qualification, escalation handling, and call routing. These processing activities are executed strictly in accordance with Customer configurations and instructions.

ELION engages in processing activities related to WhatsApp and business messaging platforms. This involves inbound and outbound message handling, intent detection, and automated conversational flows designed to facilitate business communication on behalf of our Customers.

Our platform includes tools for business analytics, operational optimization, lead management, and customer communication. To this end, the system processes interests, preferences, customer intent, lead prioritization, lead scoring, conversation categorization, sentiment analysis, AI-generated recommendations, conversion likelihood indicators, and follow-up recommendations. ELION does not make fully automated decisions producing legal or similarly significant effects concerning End Users.

ELION may use Customer Data to configure, personalize, optimize, and improve the performance of the AI agent exclusively for that specific Customer. ELION does not use Customer Data to train a general-purpose AI model for other customers unless expressly authorized or otherwise disclosed. ELION may utilize one or more AI providers and reserves the right to replace, supplement, or modify AI providers over time.

The Customer retains all rights, title, and interest in Customer Data. ELION does not acquire ownership of Customer Data. Any Customer-provided knowledge bases, documents, workflows, prompts, instructions, and configurations remain solely associated with the specific Customer environment.

ELION unequivocally does not sell Customer Data to third parties.

Our Platform may be utilized by Customers operating in regulated sectors, including healthcare, medical, dental, physiotherapy, veterinary, legal, and financial sectors. ELION is strictly a technology platform and not a healthcare provider, medical practitioner, law firm, financial advisor, insurer, licensed professional, or regulated decision-maker. Customers remain solely responsible for determining the appropriate legal bases, obtaining required consents, providing sufficient notices, and fully complying with applicable sectoral laws and regulations.

To deliver our services effectively, ELION utilizes third-party infrastructure and service providers. Current providers may include Supabase, Vercel, Vapi, OpenAI (through Vapi and related AI services), Twilio, Meta / WhatsApp Business, PostHog, Google Workspace, Google Drive, GitHub, GoDaddy, and Stripe (planned future billing provider). ELION may add, replace, or remove subprocessors, AI providers, infrastructure providers, and service providers as the Platform evolves.

The current primary data region utilized by ELION is Supabase, located in US-East-1, North Virginia, United States. Over time and subject to enterprise requirements, ELION may support United States hosting, European hosting, dedicated enterprise hosting, and customer-specific hosting arrangements.

ELION serves Target Markets including Israel, the European Union, the United Kingdom, the United States, the United Arab Emirates, and Australia. Cross-border transfers of personal data may occur where required for service delivery, support, infrastructure operations, analytics, communications, or other legitimate business purposes. Where applicable, such transfers may be supported by contractual safeguards, data processing terms, recognized adequacy or transfer mechanisms, or other lawful measures recognized under the GDPR, UK GDPR, Israeli law, applicable United States frameworks, UAE privacy requirements, Australian privacy law, and related implementing rules or guidance.

We may deploy cookies, web beacons, and similar tracking technologies in connection with website analytics, marketing data, and consent management (e.g., PostHog), subject to applicable notices and consent mechanisms as required by law.

ELION retains personal data in accordance with the following schedule, subject to lawful extension provisions for security, fraud prevention, dispute resolution, legal compliance, backups, business continuity, platform improvement, and legitimate business purposes:

Customers may request the export of their data prior to account termination by formally contacting privacy-request@elionagent.com.

ELION implements reasonable technical and organizational measures to safeguard data, which include authentication, access controls, encryption in transit, provider-level encryption at rest, logging, monitoring, and backups. Notwithstanding these measures, ELION does not guarantee absolute security. Additional security measures may be introduced over time.

ELION may disclose information only where strictly required by applicable law, binding court order, lawful governmental request, or to protect the rights, safety, security, or integrity of ELION, its Customers, or the public.

ELION maintains reasonable technical and organizational safeguards and is committed to complying with applicable legal and contractual obligations regarding data breach notifications.

Data subject rights may vary significantly by jurisdiction. Individuals seeking to exercise privacy rights may direct their inquiries to privacy-request@elionagent.com. Where ELION acts solely as a Data Processor, such requests may need to be directed through and addressed by the relevant Customer acting as the Data Controller.

The Platform is intended for individuals aged 18 years or older.

ELION reserves the right to update this Privacy Policy from time to time to reflect operational, legal, or regulatory modifications.