1. Who we are and what the product is

Ventus is a conversation, customer and appointment management system for businesses. It is operated by Ventus Workspace, registered sole proprietor (Osek Murshe) no. 208985358, Dolev 32, Beit Aryeh, Israel ("we", "us" or "Ventus").

Ventus connects to the business's CRM account and to its telephony (PBX) provider, and brings the business's messages, phone calls, contacts and appointments into one place. Ventus can also connect to the business's WhatsApp Business, Facebook and Instagram accounts through Meta's platforms.

This policy applies to the Ventus application and to the website ventusworkspace.com. It explains what data we collect, why, who we share it with, how long we keep it, and what your rights are.

2. What data we collect

• User details: name, email address, phone number, role in the business, and the account details of the business that invited you.
• Contacts and conversations of the business's customers: names, phone numbers, email addresses, message history, tags, opportunities and appointments, as they appear in the business's CRM account.
• Phone call records and recordings: caller and callee numbers, time and duration of the call, the call recording, its transcript and summary, as received from the business's telephony provider.
• Data from Meta platforms: see section 3 below.
• Usage data and access logs: login times, IP address, browser and device type, actions performed in the system, and error logs. Used for security, troubleshooting and improving the service.
• Website enquiries: if you submit the form on our website, we store your name, phone number, the answers you gave, and how you reached the site.

3. Data from Meta platforms (WhatsApp, Facebook, Instagram)

When a business connects its WhatsApp Business account, Facebook Page or Instagram account to Ventus, we receive the following data from Meta through its official interfaces (WhatsApp Business Platform, Messenger Platform and Instagram Messaging API):

• Messages: the content of inbound and outbound messages between the business and its customers, including attached media, timestamps and delivery status.
• User and profile identifiers: the phone number or platform ID (PSID / IGSID / WA-ID), display name and profile picture of the customer who contacted the business.
• Business data: the WhatsApp Business Account (WABA) ID, Page or business account ID, the business's phone numbers, message templates, and the access tokens required for the connection.

This data is collected solely to provide the service to the business that connected the account: showing messages to the business's staff, replying to customers, tracking conversations, and updating contacts in the business's CRM account.

We do not sell data received from Meta, do not share it with advertisers, and do not use it for advertising, audience building, profiling or model training. Our use of this data is subject to the Meta Platform Terms, the WhatsApp Business Policy and the Meta Developer Policies, and we are committed to complying with them.

A business can disconnect Meta from Ventus at any time, from within Ventus or from its business settings on Meta. Upon disconnection, access tokens are deleted immediately, and remaining data is deleted according to the schedule in our Data Deletion Instructions.

4. Why we use the data

• To show the business's staff its messages, calls, contacts and appointments in one place.
• To let the business's staff reply to customers, call them and book appointments.
• To track conversations and enquiries so nothing falls through the cracks.
• To transcribe phone calls and produce summaries, at the business's request and according to its settings.
• To secure the system, prevent abuse, troubleshoot and provide support.
• To bill the business for the service and meet legal obligations.

The business is the owner of its customers' data and is responsible for it towards them. We process the data on the business's behalf and according to its instructions only. The terms of this processing are in section 9 of our Terms of Service.

5. Call recording

Phone calls made through Ventus may be recorded, transcribed and summarised, according to the business's settings. The business is responsible for notifying the other party of the recording and for complying with the law that applies to it, including the Israeli Wiretapping Law. Recordings and transcripts are accessible only to authorised users of the business's account. We do not listen to recordings and do not use them for any purpose other than providing the service.

6. Who we share data with

We share data only with providers needed to run the service, and only to the extent required:

• Cloud hosting and infrastructure providers: the servers, database and file storage the system runs on.
• Email provider: for system notifications, user invitations and confirmations.
• Transcription provider: for transcribing call recordings and producing summaries, when the business has enabled that feature.
• Meeting recording provider: a bot that joins video meetings once the host admits it, and records and transcribes them.
• Payment processor: to charge the subscription. Card details go directly to the processor and are stored only there. We never store card numbers.
• The CRM provider and the business's telephony provider: which Ventus connects to on the business's behalf, using accounts the business itself holds.
• Meta: for sending and receiving messages on the channels the business has connected.
• Meta, to measure Ventus's own advertising: when you submit a form on our website, we send Meta your phone number and email in hashed form, your IP address and browser type, so we know which campaign brought the inquiry. This applies only to inquiries to us through our website, not to data of the businesses that use Ventus.

The full list of subprocessors, what each receives and where it is located, is on our Security page. Data of businesses and their customers is not shared with advertisers, sold or rented. We may disclose data if required by law, a court order or a demand from a competent authority.

7. How long we keep data

We keep data for as long as the business is an active Ventus customer. After the engagement ends, data is deleted from our systems within 30 days, except for data we are legally required to retain (such as accounting records) and technical backups, which are purged in the normal backup cycle.

Call and meeting recordings, transcripts and summaries are kept while the business is active, so they can be revisited. The business may at any time ask us to delete a specific recording or set a shorter retention period.

Transfer of data abroad: some of our subprocessors store or process data outside Israel, in Europe and the United States. Our servers and database are in Europe. We work only with providers contractually bound to protect the data and use it only to provide the service. The full list, including where each provider is located, is on our Security page.

Data that originates in the CRM remains in the business's CRM account after deletion on our side, because it belongs to the business and we only display it.

8. Your rights

Anyone whose data is processed in Ventus has the right to:

• Access the data held about them.
• Correct inaccurate or outdated data.
• Delete their data, subject to legal retention obligations.

To exercise a right, email [email protected] and we will respond within 7 business days. If you are a customer of a business that uses Ventus, we may refer you to that business, as it is the data owner. Full deletion instructions are in our Data Deletion Instructions.

9. Security

• All traffic between users, Ventus and our providers is encrypted in transit (HTTPS / TLS).
• Access tokens and phone-system keys are encrypted before storage. Other data, including recordings and transcripts, is kept in our cloud provider's encrypted storage in Europe.
• Passwords are stored only as Argon2 hashes, and accounts are temporarily locked after repeated failed sign-ins.
• Each business's data is isolated: every database query is automatically scoped to the business it belongs to.
• Access is role-based and enforced on our server: each user sees only what their business has allowed them to see.
• Administrative actions and deletions are recorded in an audit log.
• Access to infrastructure is limited to a small team.

Full details are on our Security page. No system is completely immune. If a security incident affecting your data is discovered, we will notify the affected business and the authorities as required by law.

10. Cookies and analytics on the website

ventusworkspace.com sets one strictly necessary cookie that stores your choice, and Meta cookies to measure Ventus's own ads, only if you accept. You can refuse or change your choice at any time; see our Cookie Policy. The Ventus application uses strictly necessary cookies only, for sign-in, security and your preferences.

11. Children

Ventus is intended for businesses and their staff and is not intended for use by anyone under 18.

12. Changes to this policy

If we change this policy materially, we will notify registered businesses by email and update the date at the top of this page. The current version is always available at https://ventusworkspace.com/privacy.

13. Contact

For any privacy question or request: [email protected]. For data deletion instructions: ventusworkspace.com/data-deletion.