ELION Privacy Policy

This Privacy Policy is not a generic website privacy policy. It is an enterprise-grade legal document governing the privacy and data handling practices of ELION SYSTEMS LTD in connection with its website, platform, AI-powered business communication services, front-office automation solutions, and related operations. ELION is primarily a business-to-business (B2B) platform. In the course of providing its services, ELION may process information relating to customers, prospects, leads, patients, consumers, callers, website visitors, and end users who interact with ELION Customers.

“ELION”, “Company”, “we”, “us”, “our”

ELION SYSTEMS LTD, Company Number 517350260, registered in Tel Aviv, Israel.

“Customer”

The business entity that subscribes to, accesses, or uses our Platform.

“End User”

Any individual who interacts with ELION customers through our Platform, including prospects, leads, patients, consumers, callers, and website visitors.

“Platform”

The multi-tenant SaaS platform and related services providing AI-powered business communication and front-office automation solutions.

“Personal Data”

Any information relating to an identified or identifiable natural person, as defined by applicable data protection legislation.

Under applicable data protection laws, the distinction between a Data Controller and a Data Processor is paramount.

ELION as a Data Processor

ELION generally acts as a Data Processor (or Service Provider) when processing Customer Data, End User Data, Call Data, Conversation Data, and other operational data on behalf of our business Customers to provide the Platform services. In such capacities, Customers retain the obligations of a Data Controller.

ELION as a Data Controller

ELION acts as a Data Controller with respect to data processed for account management, billing, support, security, website analytics, marketing, and internal business operations.

ELION operates a multi-tenant SaaS architecture. Customer environments are logically separated as part of the Platform design. Additional security, segregation, and dedicated enterprise deployment options may be introduced over time to address evolving operational, security, and compliance requirements.

We may process the following categories of data:

Processing may be carried out for service provision, account administration, communications handling, analytics, security, support, compliance, and legitimate business operations. Processing activities are conducted subject to applicable law and Customer responsibilities where ELION acts as a Data Processor. ELION relies on appropriate legal bases such as the performance of a contract, legitimate interests, legal obligations, or consent, as strictly applicable under relevant jurisdictional frameworks.

ELION provides AI-powered voice solutions. Voice AI processing includes call recording, speech processing, transcription, AI response generation, appointment scheduling, lead qualification, escalation handling, and call routing. These processing activities are executed strictly in accordance with Customer configurations and instructions.

ELION engages in processing activities related to WhatsApp and business messaging platforms. This involves inbound and outbound message handling, intent detection, and automated conversational flows designed to facilitate business communication on behalf of our Customers.

ELION offers an optional Google Calendar integration. A Customer enables it from the ELION dashboard by authorizing ELION through Google’s OAuth consent screen. This section describes the Google user data ELION accesses, how ELION uses it, and with whom ELION shares, transfers, or discloses it, and applies in addition to the remainder of this Privacy Policy. Where the integration is not connected, ELION accesses no Google user data.

Google User Data ELION Accesses

ELION requests only the narrowest Google Calendar permissions sufficient to operate the feature. Subject to the permissions granted, ELION may access:

• Calendar list — the identifiers, display names, time zones, and primary-calendar marker of the calendars owned by the connected Google account, so that an authorized user can choose which calendar ELION should use (scope: calendar.calendarlist.readonly).
• Free/busy availability — the start and end times of the periods marked busy on the selected calendar, used to determine when appointments may be offered (scope: calendar.freebusy). ELION does not request, receive, or store the titles, descriptions, attendees, organizers, locations, attachments, or any other content of the calendar entries behind those busy periods.
• Calendar events owned by ELION — the appointment entries ELION itself created on the selected calendar, which ELION may read, update, or cancel as required to create, update, reschedule, and cancel appointments (scope: calendar.events.owned). This permission does not allow ELION to read events created by the account holder or by any other application.
• OAuth credentials — the access and refresh tokens issued by Google that authorize the above, together with the list of permissions granted.

The identifier of a primary Google Calendar is the Google account’s email address. ELION stores and displays that identifier so an authorized user can see which account is connected. ELION does not request a Google profile, contacts, Gmail, or Drive permission.

How ELION Uses Google User Data

Google user data is used solely to provide the Google Calendar and appointment functionality the Customer has requested, specifically to:

• Select the calendar the integration will use
• Check availability on the selected calendar
• Prevent double booking and scheduling conflicts
• Create appointments
• Update and reschedule appointments
• Cancel appointments
• Reflect within ELION a change the account holder makes in Google to an appointment ELION created
• Display connection and synchronization status to the Customer’s authorized users

ELION does not use Google user data for advertising, marketing, profiling, credit or lending decisions, or any data-broker purpose, and does not serve advertisements using Google user data. ELION does not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

Google User Data ELION Stores

Within the Customer’s own environment, ELION stores the OAuth tokens in encrypted form, the permissions granted, the identifier and time zone of the selected calendar, the identifier used to label the connected account, the current free/busy snapshot for the selected calendar as start and end times only, and the Google event identifiers of the appointments ELION created so that those appointments can later be updated or cancelled. The free/busy snapshot is replaced each time availability is refreshed. The ELION data model provides no field for calendar event titles, descriptions, attendees, organizers, or locations, and ELION therefore does not store them.

Sharing, Transfer and Disclosure of Google User Data

• ELION does not sell Google user data.
• ELION does not transfer Google user data to third parties for advertising, marketing, profiling, or data-broker purposes.
• Google user data is stored and processed using the hosting, database, and infrastructure providers ELION uses to operate the Platform, as described in the sections on Service Providers, Technology Stack and Subprocessors and on Hosting and Data Residency. Those providers process the data solely as necessary to operate the Platform on ELION’s behalf and are subject to appropriate confidentiality and data protection obligations.
• Within the Platform, Google user data obtained through a Customer’s connection is available only to that Customer’s authorized users. ELION personnel do not access it except where necessary to operate, support, or secure the service, to address a Customer request, or where required by law.
• ELION may disclose Google user data where strictly required by applicable law, binding court order, or lawful governmental request, or to protect the rights, safety, security, or integrity of ELION, its Customers, or the public, as described in the section on Government Requests and Legal Disclosures.
• ELION does not otherwise share, transfer, or disclose Google user data to third parties.

Retention, Disconnection and Deletion

Google user data is retained only as long as necessary to provide the integration and to meet legal, security, and record-keeping requirements, and is otherwise handled in accordance with the retention schedule set out in this Privacy Policy. An authorized user may disconnect the integration at any time from the Google Calendar page of the ELION dashboard. On disconnection, ELION asks Google to revoke the authorization and deletes the stored access and refresh tokens, the calendar selection, and the stored free/busy snapshot, so that no further Google access occurs through that authorization.

An account holder may also revoke ELION’s access at any time directly from the Google Account permissions page at myaccount.google.com/permissions.

Requests for deletion of stored personal data may be directed to privacy-request@elionagent.com as described elsewhere in this Privacy Policy.

Google API Services User Data Policy

ELION’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our platform includes tools for business analytics, operational optimization, lead management, and customer communication. To this end, the system processes interests, preferences, customer intent, lead prioritization, lead scoring, conversation categorization, sentiment analysis, AI-generated recommendations, conversion likelihood indicators, and follow-up recommendations. ELION does not make fully automated decisions producing legal or similarly significant effects concerning End Users.

ELION may use Customer Data to configure, personalize, optimize, and improve the performance of the AI agent exclusively for that specific Customer. ELION does not use Customer Data to train a general-purpose AI model for other customers unless expressly authorized or otherwise disclosed. ELION may utilize one or more AI providers and reserves the right to replace, supplement, or modify AI providers over time.

The Customer retains all rights, title, and interest in Customer Data. ELION does not acquire ownership of Customer Data. Any Customer-provided knowledge bases, documents, workflows, prompts, instructions, and configurations remain solely associated with the specific Customer environment.

ELION unequivocally does not sell Customer Data to third parties.

Our Platform may be utilized by Customers operating in regulated sectors, including healthcare, medical, dental, physiotherapy, veterinary, legal, and financial sectors. ELION is strictly a technology platform and not a healthcare provider, medical practitioner, law firm, financial advisor, insurer, licensed professional, or regulated decision-maker. Customers remain solely responsible for determining the appropriate legal bases, obtaining required consents, providing sufficient notices, and fully complying with applicable sectoral laws and regulations.

To deliver our services effectively, ELION utilizes third-party infrastructure and service providers. Current providers may include Supabase, Vercel, Vapi, OpenAI (through Vapi and related AI services), Twilio, Meta / WhatsApp Business, PostHog, Google Workspace, Google Drive, GitHub, GoDaddy, and Stripe (planned future billing provider). ELION may add, replace, or remove subprocessors, AI providers, infrastructure providers, and service providers as the Platform evolves.

The current primary data region utilized by ELION is Supabase, located in US-East-1, North Virginia, United States. Over time and subject to enterprise requirements, ELION may support United States hosting, European hosting, dedicated enterprise hosting, and customer-specific hosting arrangements.

ELION serves Target Markets including Israel, the European Union, the United Kingdom, the United States, the United Arab Emirates, and Australia. Cross-border transfers of personal data may occur where required for service delivery, support, infrastructure operations, analytics, communications, or other legitimate business purposes. Where applicable, such transfers may be supported by contractual safeguards, data processing terms, recognized adequacy or transfer mechanisms, or other lawful measures recognized under the GDPR, UK GDPR, Israeli law, applicable United States frameworks, UAE privacy requirements, Australian privacy law, and related implementing rules or guidance.

We may deploy cookies, web beacons, and similar tracking technologies in connection with website analytics, marketing data, and consent management (e.g., PostHog), subject to applicable notices and consent mechanisms as required by law.

ELION retains personal data in accordance with the following schedule, subject to lawful extension provisions for security, fraud prevention, dispute resolution, legal compliance, backups, business continuity, platform improvement, and legitimate business purposes:

Customers may request the export of their data prior to account termination by formally contacting privacy-request@elionagent.com.

ELION implements reasonable technical and organizational measures to safeguard data, which include authentication, access controls, encryption in transit, provider-level encryption at rest, logging, monitoring, and backups. Notwithstanding these measures, ELION does not guarantee absolute security. Additional security measures may be introduced over time.

ELION may disclose information only where strictly required by applicable law, binding court order, lawful governmental request, or to protect the rights, safety, security, or integrity of ELION, its Customers, or the public.

ELION maintains reasonable technical and organizational safeguards and is committed to complying with applicable legal and contractual obligations regarding data breach notifications.

Data subject rights may vary significantly by jurisdiction. Individuals seeking to exercise privacy rights may direct their inquiries to privacy-request@elionagent.com. Where ELION acts solely as a Data Processor, such requests may need to be directed through and addressed by the relevant Customer acting as the Data Controller.

The Platform is intended for individuals aged 18 years or older.

ELION reserves the right to update this Privacy Policy from time to time to reflect operational, legal, or regulatory modifications.