Last updated: May 2026
Boltcall is a speed-to-lead SaaS platform that uses AI voice agents and automated messaging to help local service businesses respond to inbound leads instantly.
Data Controller: Boltcall (operated by Noam Yakoby, Israel). Under the Israeli Privacy Protection Law (PPL) 5741-1981, Boltcall is the Database Owner and, where processing data on behalf of customers, also a Database Holder.
Contact: privacy@boltcall.org
Database registration: Boltcall is assessing whether data volumes trigger mandatory registration with the Israeli Registrar of Databases under PPL Amendment 13. We will register when required.
| Purpose | Legal basis (PPL / GDPR) |
|---|---|
| Provide and maintain the AI receptionist platform | Contract performance |
| Process payments and issue tax invoices | Contract & legal obligation |
| Answer inbound calls, send SMS / WhatsApp | Contract & consent (Israeli Communications Law) |
| Improve AI models using anonymised data | Legitimate interest |
| Send marketing communications | Explicit opt-in consent (Israeli anti-spam law) |
| Comply with tax, anti-fraud, and legal obligations | Legal obligation |
We do not sell your personal data. We share data only with the vendors below, each bound by a data processing agreement. Full DPA: boltcall.org/dpa.
| Vendor | Purpose | Data location |
|---|---|---|
| Supabase (AWS) | Database & auth | US East (us-east-1) |
| Retell AI | AI voice agent & call recordings | US (AWS) |
| Twilio | Phone numbers, SMS, call routing | US / Ireland |
| Stripe | Payment processing | US / Ireland |
| Brevo | Transactional email | EU (Germany) |
| ElevenLabs | AI voice synthesis | US |
| OpenAI | Language model inference | US |
| Google Analytics / GTM | Web analytics (consent-gated) | US |
| Microsoft Clarity | Public-site heatmaps and session behavior analytics (consent-gated) | US |
| Greeninvoice | Israeli tax invoice issuance | Israel |
Cross-border transfers to the US are covered by Standard Contractual Clauses (SCCs). Israel has not been designated an "adequate" country by the US. Transfer records available on request.
| Account information | Account closure + 7 years (Israeli tax records requirement) |
| Call recordings & transcripts | 2 years, then permanently deleted |
| Lead & conversation data | Until you delete or account closes |
| Payment records | 7 years (Israeli Bookkeeping Regulations) |
| Technical logs | 1 year |
| Consent records | 3 years from last interaction (Israeli anti-spam law) |
Recording notice: Under the Israeli Wiretapping Law (חוק האזנת סתר, 5739-1979), all parties to a recorded call must be notified before or at the start of recording. Boltcall AI agents are programmed to announce at the start of every call:
English: "Just so you know, I'm an AI assistant and this call may be recorded for quality purposes."
Hebrew (עברית): "שים לב, אני עוזר בינה מלאכותית והשיחה עשויה להיות מוקלטת לצורכי איכות."
AI disclosure: In line with the 2024 Israeli AI Code of Ethics, callers are informed they are speaking with an AI at the start of every interaction. Boltcall agents will never deny being AI when sincerely asked.
Under Israeli PPL Amendment 13 (2025) and GDPR, you have the rights below. Contact privacy@boltcall.org. We respond within 30 days.
Right of access (סעיף 13 לחוק): Request a copy of all personal data we hold about you.
Right to correct: Fix inaccurate or incomplete data.
Right to delete: Request deletion where we have no legal obligation to retain.
Right to portability: Receive your data in a machine-readable format.
Right to object: Object to processing based on legitimate interest.
Withdraw consent: Withdraw marketing consent at any time — one click in any email.
Complaints may be lodged with the Israeli Privacy Protection Authority (רשות הגנת הפרטיות) at gov.il.
• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Row-level security (RLS) so users access only their own data
• Passwords hashed (bcrypt) — never stored in plain text
• Role-based access controls for internal team
• Data breach notification within 72 hours to affected users and relevant authorities as required by PPL Amendment 13
We use a consent banner to obtain explicit permission before placing non-essential cookies. This complies with the Israeli Privacy Protection Authority's guidance on consent.
Essential cookies: Auth session, language preference, cookie consent record. Always active.
Analytics (requires consent): Google Analytics 4 (G-LY9H4ZQW81), GTM (GTM-5LWRPT5N), and Microsoft Clarity. Track pages, feature usage, heatmaps, and public-site session behavior. Clarity is not enabled on authenticated dashboard or setup areas. No personal data shared for advertising.
If you choose Essential only, Boltcall removes the Boltcall-managed analytics cookies it can control on this browser and stops loading GA4, GTM, and Clarity on future page loads. If you already dismissed the banner and want to change your choice, clear the cookie_consent key in your browser's localStorage and refresh to show the banner again.
Israel's Communications Law Amendment 40 (חוק הספאם) requires explicit prior opt-in before sending promotional SMS, email, or WhatsApp messages. Statutory damages are ₪1,000 per unsolicited message with no harm required.
Transactional messages (confirmations, alerts, password resets) are exempt and cannot be individually unsubscribed.
We may update this policy to reflect changes in our services, legal requirements, or best practices. Material changes will be announced by email at least 14 days before taking effect. The current version is always at boltcall.org/privacy-policy.
We use cookies to improve your experience
Essential cookies keep the site working. Analytics cookies help us understand how visitors use Boltcall so we can improve it.