Talk to SoftixRequest access
Home / Legal / Privacy Policy
Gaaba by Softix

Privacy Policy

How Gaaba by Softix collects, uses, shares, secures, and retains personal data.

Request accessLegal center

Last updated: May 28, 2026 Effective date: May 28, 2026

1. Who we are

Softix, an Israeli business ("Gaaba", "we", "us", or "our"), operates the Gaaba Voice CRM platform and related services, including customer notification channels such as Telegram, WhatsApp, SMS, and email where enabled (collectively, the "Service").

  • Business name: Softix
  • Mailing contact address: P.O. Box 7575, 9850009, Israel
  • Privacy contact: privacy@gaaba.ai
  • Privacy / data protection contact: Daniel Turgeman, Founder, privacy@gaaba.ai

Softix designates Daniel Turgeman as its privacy / data protection contact. We monitor regulatory requirements to determine if or when a formal Data Protection Officer, Privacy Protection Officer, or Data Security Officer needs to be designated.

This Policy explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have.

2. Scope and our role

Gaaba provides a business-to-business (B2B) platform. This creates two different relationships, and our role differs in each:

a) Our direct customers (business owners and their authorized users). When a business signs up for Gaaba, we act as a controller of the account holder's data (the people who administer the account: business owners, admins, and technicians). This Policy governs that relationship.

b) End-callers / the business's own customers. When a Gaaba customer (a business) uses the Service to handle inbound calls, leads, and scheduling, the business is the controller of its own customers' data, and Gaaba acts as a processor that handles that data on the business's behalf and instructions. The handling of that data is governed by our agreement with the business (see the Data Processing terms referenced in Section 12), not solely by this Policy.

If you are an end-caller and have questions about how a particular business uses your data, please contact that business directly. We will assist that business in responding to your request where required and appropriate.

3. Information we collect

3.1 Account and user data (controller)

  • Identity and contact details: name, email address, phone number, role (owner / admin / technician), business name.
  • Authentication data: hashed passwords and session tokens. We never store passwords or authentication secrets in plain text.
  • Billing data: subscription plan, billing events, and payment status. Card/payment details are processed by our payment processor (Stripe) and are not stored on Gaaba servers.

3.2 Notification channel data where enabled

When an authorized user links an optional notification channel such as Telegram, WhatsApp, SMS, or email, we collect and store the data needed to deliver and manage those notifications. For Telegram bot linking, this may include:

  • Telegram chat ID and Telegram username.
  • The link between that chat or notification channel and your Gaaba business and user/technician record.
  • Activity timestamps (e.g., last active) and notification preferences (enabled / muted).

We do not receive your Telegram password or contacts from Telegram. Where a channel requires a phone number, such as WhatsApp or SMS, we process it only as needed to provide that channel. Linking uses a single-use, short-lived token or equivalent authorization flow where supported.

3.3 Service operational data (varies by role)

Depending on how the Service is used, we process:

  • Lead and CRM records, job tickets, customer records, appointments, and scheduling data.
  • Call data, which may include call metadata (numbers, timestamps, duration) and, where enabled, call recordings and transcripts.
  • Calendar availability data where calendar integration is enabled.
  • Google Ads reporting and performance data where the customer enables the Google Ads integration, limited to read-only reporting, analytics, and recommendation features.
  • Messaging data sent via WhatsApp / SMS / Telegram through the Service.

3.4 Technical data

  • Log data, IP address, device/browser information, and diagnostic data needed to operate, secure, and troubleshoot the Service.
  • We minimize sensitive identifiers in logs (for example, we truncate identifiers and never log authentication tokens or recovery secrets).

4. How we use information

We use personal data to:

  • Provide, operate, and maintain the Service.
  • Authenticate users and secure accounts.
  • Route, schedule, and notify about leads and appointments (including Telegram, WhatsApp, and SMS notifications you opt into).
  • Provide read-only Google Ads reporting, analytics, and recommendation features where the customer enables that integration.
  • Process subscriptions and billing.
  • Provide support and respond to requests.
  • Detect, prevent, and address abuse, fraud, security incidents, and technical problems.
  • Comply with legal obligations.

We rely on the following legal bases (where applicable, e.g., under GDPR): performance of a contract; your consent (e.g., opt-in notifications and, where required, call recording); our legitimate interests in operating and securing the Service; and compliance with legal obligations.

5. Call recording — important notice

Where call recording or transcription is enabled, recordings and/or transcripts of calls may be created and stored. Laws on call recording vary significantly:

  • In some U.S. states, all parties to a call must consent to recording ("two-party" / "all-party" consent states). In others, one-party consent is sufficient.
  • Other jurisdictions (including under Israeli law and EU/GDPR rules) impose their own notice and consent requirements.

The business operating the account is responsible for ensuring that appropriate notice is given and any required consent is obtained from callers before recording, in every jurisdiction in which it operates. Where the Service offers features that help the business present notices or capture consent, those features are provided as a convenience only; the legal obligation to record lawfully rests at all times with the business.

Because calls may capture whatever a caller chooses to say, recordings and transcripts may incidentally contain sensitive information. The business is responsible for handling such information lawfully and for instructing us accordingly.

6. How we share information

We share personal data only as needed to run the Service:

  • Service providers / sub-processors acting on our instructions, including:
    • Amazon Web Services (AWS) — cloud hosting and infrastructure (United States).
    • Twilio — voice, SMS, and (where enabled) WhatsApp messaging.
    • Stripe — payment processing.
    • Telegram — delivery of bot notifications you opt into, where enabled.
    • WhatsApp / Meta — the underlying WhatsApp platform and related delivery services, where WhatsApp messaging is enabled.
    • AI providers — Anthropic, OpenAI, and Google, for AI-assisted call handling and processing (where enabled), subject to their terms. We use these providers under terms that do not permit them to use your data to train their models.
    • A current, maintained list of sub-processors is available at https://gaaba.ai/legal/subprocessors.
  • Within your business — authorized users see data according to their role. Technicians see only data assigned to them; owners and admins see business-wide data.
  • Legal and safety — where required by law, regulation, legal process, or to protect rights, safety, and security.
  • Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell personal data.

7. International transfers

Your data is processed in Israel (where we are based) and in the United States and other countries where our sub-processors operate (see Section 6). Where data is transferred across borders, we rely on appropriate safeguards:

  • For transfers from the EEA, the UK, or Switzerland to Israel, we rely on the applicable adequacy decisions recognizing Israel's level of data protection, where available.
  • For onward transfers to sub-processors in countries without an adequacy decision (for example, the United States), we rely on Standard Contractual Clauses or other lawful transfer mechanisms, as set out in our Data Processing Agreement (see Section 12).

8. Data retention

We keep personal data only as long as needed for the purposes described here, or as required by law. Our default retention periods are below; a business may configure shorter or longer periods for its own account data where the Service allows:

  • Account, lead, CRM, scheduling, customer, and operational data: retained while the business account is active. After account termination or non-payment, the account and related Customer Data may be deleted in accordance with our account deletion routines, subject to legal, billing, dispute, fraud-prevention, export, and backup requirements.
  • Notification channel link data: until you unlink the channel or the account is deleted, after which the binding is revoked and removed in line with our deletion routines.
  • Call recordings and transcripts: by default thirty (30) days, unless a different retention period is configured for the business account or required by law.
  • Audit logs: up to six (6) months for security, audit, and troubleshooting, unless longer retention is required by law or needed for a dispute or security investigation.
  • Backups: retained for up to thirty (30) days, after which they are overwritten or deleted according to our backup rotation.

9. Your rights

Depending on where you live, you may have rights to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete data ("right to erasure").
  • Restrict or object to certain processing.
  • Data portability.
  • Withdraw consent at any time (e.g., unlink the Telegram bot or mute alerts).

Israel: Under the Israeli Protection of Privacy Law, 5741-1981 (as amended, including Amendment No. 13), you may request to review and correct your data held in our databases, and you may lodge a complaint with the Israeli Privacy Protection Authority (PPA).

United States (incl. California): Depending on your state, you may have rights to know, access, delete, correct, and to opt out of certain data sharing; and a right not to be discriminated against for exercising them.

EU/EEA/UK (if applicable): You have the rights listed above under the GDPR / UK GDPR, and may lodge a complaint with your supervisory authority.

To exercise any right, contact us at privacy@gaaba.ai. If your request concerns data where a business is the controller (see Section 2b), we will refer you to, or assist, that business.

10. Security

We use technical and organizational measures to protect personal data, including encryption of sensitive fields, hashed credentials, role-based access controls, tenant isolation between businesses, single-use link tokens, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Service is not directed to children and is intended for business use. We do not knowingly collect data from children under the age of 16. If you believe a child has provided us personal data, contact us at privacy@gaaba.ai and we will take appropriate steps to delete it.

12. Business customers and data processing

If you are a business using Gaaba to process data about your own customers, our processing of that data on your behalf is governed by our agreement with you, including our Data Processing Agreement (DPA), available at https://gaaba.ai/legal/dpa. You are responsible for having a lawful basis and appropriate notices/consents for the data you put into the Service.

Where the Google Ads integration is enabled, our use of Google Ads API data is described in our Google Ads API Usage Notice, available at https://gaaba.ai/legal/google-ads-api-usage.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, notify you.

14. Contact

Questions or requests: privacy@gaaba.ai Softix, P.O. Box 7575, 9850009, Israel