Privacy Policy
Last updated, August 1, 2023
TL;DR Legal: We collect personal data when you use our services. This includes your use of our services as well as your interactions with us.
Some of this information is made available to third parties that allow us to provide you with services, such as our analytics services and AI models. Moreover, no matter what, we do not sell your data but solely use it for the service, and continuous improvement.
Intune Communication LTD (“Hear.ai”) values your privacy and therefore has set up this extensive Privacy Policy in order to notify you when your personal data is stored, what is being processed and what is being disclosed to other entities.
Though Intune Communication LTD is not an EU based organization, its privacy policy is the
spirit of the GDPR and is in full and strict compliance with all Israeli privacy regulations.
Who Are We?
Intune Communication Ltd is an Israeli limited company. We operate the Hear.ai website to provide users the ability to create aggregate business intelligence based on aconversations
Are You Obligated To Provide Us With Personal Data?
No. You are under no legal obligation to provide us with any personal data. However, without providing us with personal data, we may not be able to provide you with our services or any portion thereof.
How Do We Collect Personal Data?
We collect data solely based on your use of our services; meaning by the way you browse and use our service, and the information you fill when engaging with website and forms.
What Personal Data Is Retained About You?
We will retain data about your contact information, which includes your name, email address, phone, the location of your business and similar details provided to us directly. We may also retain payment details. If you use our contact forms, we may also retain your contact information, including name, email address, phone number and contents of the form.
This data may be identifying or non-identifiable.
What Non-Personal Data Is Retained About You?
We retain some non-personally identifiable data, as described below. When you use our service, we retain your activity on the service, and other information we may receive from you, provided that you were notified explicitly on such collection or retention. We retain technical data relating to your browsing such as browser type, extensions, definitions, viewed pages, your use of the service and technical data we receive.
Do We Process Your Personal Data?
We will use the retained data about you to provide you with the services. We may send you updates and newsletters via email or text messages with promotional materials and advertisements, unless you notify us that you withdraw your consent to such message, and all in accordance with section 30A to the Telecommunication Act (Bezeq and
Communications), 1982. Your registration to the website also means your consent to receive marketing calls according to section 16B to the Consumer Protection Act, 1981. You may notify us of your refusal from any future material according to this section either by email or through our system.
Do We Use Cookies In Our Service?
A Cookie is a small file stored on your computer which is used in interaction between your computer and our servers (or third party servers). Cookies may sometimes be used to identify you. We use both first party and third party cookies. Your consent to use the services means you consent for our use of both types of cookies. Some of these cookies are hosted outside the EU.
Who has Access to Your Data?
We provide access to your data, solely to our employees and contractors, that are under strict confidentiality obligations. Our employees and contractors' use of your Personal Data is monitored. When we provide information to third parties who provide us a portion of the services, they are also under an obligation to keep information confidential.
Which third parties do we use to process the Personal Data?
We use several types of third party processors. While we have done our best on our impact assessment to ensure that there is as little personal data submitted as possible, some of these services do use anonymized or de-identified data for their own benefit and you should review their specific data processing agreements and privacy policies.
For AI models, we use Microsoft Azure, Anthropic and OpenAI.
For our own analytics, we use Plausible Analytics, Hotjar, Pipedrive, Mixpanel, Google
Analytics and Datadog.
For hosting we use Landen and AWS.
For emails and communications we use Reply.io, MailChimp and SendGrid.
For payments we use Stripe.
Each of these services is bound to us to protect your data under terms that are adherent to
relevant Data Protection Laws.
Your Personal Data Rights
Right of Access and Rectification
You have the right to know what personal data we collect about you and to ensure that such
data is accurate and relevant for the purposes for which we collected it. You can receive a
copy of your personal data, and to rectify such personal data if it is not accurate, complete, or
updated. However, we may first ask you to provide us with certain credentials to permit us to
identify you before rectifying, deleting, or reviewing.
Right to Delete Personal Data or Restrict Processing and Right to Withdraw Consent
You have the right to withdraw your consent to the processing of your personal data. Exercising this right will not affect the lawfulness of processing your personal data based on your consent before its withdrawal. Please note that in most cases, withdrawal of your consent would most likely cause us to delete your personal data rather than cease processing.
You have the right to delete your personal data or restrict its processing by ourselves and
third parties. We may postpone or deny your request if your personal data is in current use for
the purposes for which it was collected or for other legitimate purposes such as compliance
with legal obligations.
Right of Data Portability
Where technically feasible, you have the right to ask to transfer your personal data in accordance with your right to data portability. In order to apply for this, please contact us.
The Right to Lodge a Complaint
You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
Your California Privacy Rights and Do Not Track Notices
We do not convey your personal data to third parties for direct marketing purposes. However, if we did, then the California Civil Code Section 1798.83 permits our customers who are California residents to request certain information regarding its disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please send us an email, and we will let you know that none of your personal data was shared. We are only required to respond to one request per customer each calendar year.
Your Brazilian LGPD Rights
Notwithstanding anything in this privacy policy, you may exercise your LGPD rights, including your rights for (i) confirmation of the existence of the processing; (ii) access to the data; (iii) correction of incomplete, inaccurate or out-of-date data; (iv) anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of the LGPD; (v) portability of the data to another service or product provider, by means of an express request and subject to commercial and industrial secrecy, pursuant to the regulation of the controlling agency; (vi) deletion of personal data processed with your consent, except in the situations provided in Art. 16 of the LGPD; (vii) information about public and private entities with which the controller has shared data; (viii) information about the
possibility of denying consent and the consequences of such denial; (ix) revocation of consent as provided in §5 of Art. 8 of the LGPD.
We respond to “Do Not Track” signals
If you do not wish your browser to allow us to use trackers, please use your browser’s “Do
Not Track” option.
Exercising Your Rights
We acknowledge you have the right to access and change the Personal Data we collect and process. If you wish to access or to correct, amend, or delete Personal Data, please send us an email. We will respond within a reasonable timeframe, but in any event, no later than permitted by applicable law.
What Can You Do If You Feel Your Privacy Was Invaded?
If You feel your privacy was invaded, you can always contact our privacy officer, by email or through our contact form, and file a complaint, our privacy officer will inspect the complaints within reasonable time and send you and answer promptly, our privacy officer also publishes periodical reports about such complaints, which you can find on our website or contact us directly. You can contact our privacy officer by email at info@Hear.ai
Duration and Location of Data Retention
We retain the data on AWS’s Europe Servers. We retain data for as long as it is needed, both to provide the service and enforce legal rights. We may anonymize personal data after it is no longer needed.
Data Breach
In an event of a data breach, we will act in accordance to law and notify you if applicable.
Data Protection Officer
You can contact our data protection officer directly at info@Hear.ai
Data Processing Addendum
Hear.ai DPA (Data Processing Addendum)
Hear.ai takes the security of your data very seriously. As part of our effort, we process personal data in accordance with the General Data Protection Regulation (“GDPR”), the EU/US Privacy Shield principles (“Privacy Shield”), the laws of the US governing the handling of various types of personal data, and industry standards.
To better protect personal data, we are providing this Data Processing Amendment (DPA) to govern Hear.ai’ and your handling of personal data. This DPA forms part of Hear.ai’ Terms of Service and its Privacy Policy.
1. Definitions It is important that all parties understand what data and whose data is protected under this DPA. The following definitions explain the scope of this DPA and the commitment for data protection.
1. “Hear.ai”, “we”, “us”, or “our” refers to the provider of the Hear.ai website and services.
2. “You” or “Customer” refers to the company or organization that signs up to use the
Hear.ai service.
3. “Party” refers to Hear.ai and/or the customer, depending on the context.
4. “Personnel” refers to those individuals who are employed by or are under contract to perform a service on behalf of one of the parties. Personnel may have rights in their personal data (including business contact information) if they reside in the EU.
5. “Data Subjects” refers to individuals residing in the EU who are consumers or users of Hear.ai services (also “consumers”).
6. “Personal Data” is given the same meaning as in the GDPR which we summarize here as: any data relating directly or indirectly to an identifiable data subject. Personal data does not include any data that is anonymized, aggregated, de-identified and/or compiled on a generic basis and which does not name or identify a specific individual, directly or indirectly.
7. “Processing” is given the same meaning as in the GDPR, which we summarize as including:
1. collecting, recording, using, storing, amending, adapting, disclosing, transferring
or transmitting,
2. structuring, using, combining, deleting or destroying, personal data (“Process”
and “Processed” shall have similar meanings).
8. “Controller” is given the same meaning as in the GDPR, which we summarize as the party that determines the purposes and means of the processing of personal data – the customer is the controller with respect to consumer personal data. Each party may be the controller of personal data it processes about the other’s personnel.
9. “Processor” is the party that processes personal data on behalf of the controller – Hear.ai is the processor of the personal data we process about your consumers.
10. “Incident” means: (a) a complaint or a request with respect to the exercise of an individual’s rights under the GDPR; (b) an investigation into or seizure of the personal data by government officials, or a specific indication that such an investigation or seizure is imminent; or (c) any breach of the security and/or confidentiality as set out in this DPA leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the personal data, or any indication of such breach having taken place or being about to take place. Our mission to protect personal data
2. Each party agrees that personal data shall be treated as confidential information under this DPA. In addition, each party shall at all times comply with applicable laws relating to data protection in the relevant jurisdiction with respect to each other’s personal data.
3. Personal Data shall remain the property of the disclosing party. Hear.ai acknowledges that customer is the controller and maintains control over data subject’s personal data.
4. Hear.ai will process customer’s personal data only to the extent strictly necessary for the purpose of providing the services in accordance with the Terms of Service and any further written instructions from the customer that are mutually agreed upon in writing.
5. Hear.ai agrees that:
1. it will implement and maintain a reasonable and appropriate security program comprising adequate security, technical and organizational measures to protect against unauthorized, unlawful or accidental processing, use, erasure, loss or destruction of, or damage to, customer personal data;
2. it will not modify, alter, delete, publish or disclose any customer personal data to any third party, nor allow any third party to process such personal data on Hear.ai’s behalf unless the third party is bound to similar confidentiality and data handling provisions;
3. only its personnel who “need-to-know” will be given access to customer personal data to the extent necessary to perform its obligations under the Terms of Service it shall provide adequate training to its staff and ensure that they comply with the obligations in this DPA; and
4. it will only process customer personal data to the extent necessary to perform its obligations under the Terms of Service, upon written instructions of the customer (only as mutually agreed upon), and in accordance with applicable laws.
6. Upon termination of your account you may contact Hear.ai and instruct to delete or anonymize the personal data it has stored. Hear.ai will then complete your personal data deletion/anonymization.
7. Customer efforts and Hear.ai’ assistance
1. Customer warrants that it has all necessary rights to provide to Hear.ai the personal data for processing in connection with the provision of the Hear.ai Services.
2. To the extent required by applicable law, customer is responsible for ensuring that any data subject consents that may be necessary to this processing are obtained, and for ensuring that a record of such consents is maintained, including any consent to use personal data that is obtained from third parties. Should such consent be revoked by a data subject, customer is responsible for communicating the fact of such revocation to Hear.ai, and Hear.ai remains responsible for implementing any customer instruction with respect to the further processing of that personal data, or, as may be in
accordance with any of Hear.ai’s legal obligations.
8. Customer understands, as a controller, that it is responsible (as between customer and
Hear.ai) for:
1. determining the lawfulness of any processing, performing any required data protection impact assessments, and accounting to regulators and individuals, as may be needed;
2. making reasonable efforts to verify parental consent when data is collected on a data subject under 16 years of age;
3. providing relevant privacy notices to data subjects as may be required in your jurisdiction, including notice of their rights and provide the mechanisms for individuals to exercise those rights;
4. responding to requests from individuals about their data and the processing of the same, including requests to have personal data altered, corrected, or erased, and providing copies of the actual data processed;
5. implementing your own appropriate technical and organizational measures to ensure and demonstrate processing in accord with this DPA;
6. notifying individuals and any relevant regulators or authorities of any incident as may be required by law in your jurisdiction.
9. Hear.ai shall assist the customer by implementing appropriate technical and organizational measures, insofar as this is reasonably and commercially possible (in Hear.ai’s sole determination and discretion), in fulfilling customer’s obligations to respond to individuals’ requests to exercise rights under the GDPR.
10. Hear.ai shall make available to the customer information reasonably necessary to demonstrate compliance with Hear.ai’s obligations under this DPA.
11. Incident management
1. When either party becomes aware of an incident that impacts the processing of personal data, it shall promptly notify the other about the incident and shall reasonably cooperate in order to enable the other party to perform a thorough investigation into the incident, to formulate a correct response, and to take suitable further steps in respect of
the incident.
2. Both parties shall at all times have in place written procedures which enable them to promptly respond to the other about an incident. Where the incident is reasonably likely to require a data breach notification under applicable laws, the party responsible for the incident shall notify the other no later than 24 hours of having become aware of such an
incident.
3. Any notifications made under this section shall be made to info@globalHear.ai.com (when made to Hear.ai) and to our point of contact with you (when made to the customer), and shall contain:(i) a description of the nature of the incident, including, where possible, the categories and approximate number of individuals concerned and the categories and approximate number of records concerned; (ii) the name and contact details of the point of contact where more information can be obtained; (iii) a description of the likely consequences of the incident; and (iv) a description of the
measures taken or proposed to be taken to address the incident including, where appropriate, measures to mitigate its possible adverse effects.
12. Liability and indemnity
1. Each party indemnifies the other and holds them harmless against all claims, actions, third party claims, losses, damages and expenses incurred by the indemnified party and arising directly or indirectly out of or in connection with a breach of this DPA.
13. Duration and termination
1. 1. This DPA shall come into effect on May 25, 2018 and shall continue until it is changed or terminated in accordance with the Terms of Service.
2. Termination or expiration of this DPA shall not discharge the parties from the confidentiality obligations herein.
14. Incorporation of the Standard Contractual Clauses.
1. The parties hereby incorporate the EU Standard Contractual Clauses of 2021, with the following choices and references.
2. In respect to section 7, “Docking”, the parties agree that Docking is an option to the SCC. Module Two is selected. However, if other activities shall apply, the relevant module shall be incorporated.
3. In respect to section 9, Option 2, of a general written authorization for sub-processors is agreed to undertake between the parties.
4. In respect to section 11, complaints may be lodged with the relevant authority.
5. In respect to section 17 an 18, the governing law shall be Ireland.
6. In respect to the APPENDIX, the following shall be incorporated: The Data Importer and Exporter details are as stated in this DPA.
7. The Categories of Data Subject are the Customer’s end-users and customers.
8. The Categories of Personal Data transferred are as required and specified in Hear.ai’ privacy policy.
9. The frequency of the transfer is upon demand.
10. The nature of processing is as stated in the Privacy Policy and Data Processing Agreement.
11. The purpose of processing is as stated in the Privacy Policy and Data Processing Agreement.
12. The period of processing is as stated in the Privacy Policy and Data Processing Agreement
13. The sub-processors are as stated in the Privacy Policy and Data Processing Agreement.
14. The supervisory authority is the Irish data protection committee.
15. The Sub-processors are as stated in the Privacy Policy.
16. In respect to ANNEX II, The technical and organizational measures to ensure the security of the data are as stated in the Privacy Policy.