Privacy Policy

You are not legally required to provide us with personal information; providing it is voluntary. However, without information marked as required, we may be unable to create an account, identify you, contact you, send invitations, collect RSVPs, process a payment, or provide another part of the Service. If you provide information about someone else, you must be entitled to do so and give them any notice required by law.

"Personal information" means information about an identified person or a person who can reasonably be identified. Aggregated or anonymous information that cannot identify a person is not personal information.

• User and account information: name, phone number, email address where supplied or received through Google sign-in, account identifiers, authentication methods, invited team members, and preferences.
• Event and host information: event type; names, phone numbers, and details of partners or family members; date, time, venue, address, navigation and gift links, invitation image, message copy, custom questions, special requests, and seating information.
• Guest information: name, phone number, household or group association, party size, RSVP status, dietary or accessibility preferences, answers to questions, table number, message content, WhatsApp or SMS correspondence, and phone-call results. Some information, such as dietary or accessibility preferences, may indirectly reveal sensitive information.
• Contacts you choose to import: names and phone numbers from a file, device, or Google account. For WhatsApp import, contact and group discovery runs on your device; group names, memberships, and chat history are not sent to our servers, and only people you approve as guests are sent to the Service.
• Enquiries, leads, and support: details you submit through a form, the onboarding chat, a demo, onboarding, correspondence, or a support call, including the enquiry and internal handling notes.
• Payments and transactions: amount, currency, time, payment status, transaction identifiers, receipt, and campaign attribution. Full card details are processed by SUMIT and are not stored by us.
• Technical and usage information: IP address, device type, operating system and browser, online identifiers, pages and actions in the Service, usage times, performance, errors, referrer, campaign parameters, and security data.
• Recordings and transcripts: phone calls with guests are recorded, including the guest’s voice, statements, and the call result. A call held by the automated calling system also has a written transcript. Recordings and transcripts are used to provide, review, troubleshoot, and improve the Service.

• Directly from you when you register, pay, upload an invitation or list, connect a service, answer a message or call, or contact us.
• From an event host, partner, family member, or other user who adds you or your details to an event.
• Automatically from your device, browser, and use of the Service through logs, local storage, cookies, and similar technologies.
• From providers and services you connect or choose to use, such as Google, WhatsApp, SUMIT, and RSVP.

• To create and manage accounts and events, identify users, and grant access to partners, family, or team members.
• To build and import guest lists, create invitations, send messages and reminders, place calls, collect and update RSVPs, and plan seating.
• To extract details from invitation images, tailor greetings, understand free-form answers, and conduct conversations using automated and AI systems.
• To process payments, issue records, prevent fraud, and handle cancellations, disputes, and service enquiries.
• To provide support, communicate about the Service, and respond to enquiries. Marketing will be sent only as permitted by law and with any required consent, and you can ask us to stop at any time.
• To secure the Service, detect misuse, maintain audit records, troubleshoot, measure performance, and improve the product and user experience.
• To measure advertising and campaigns, understand how users found the Service, and report events such as registration or purchase to analytics and advertising platforms.
• To comply with legal obligations, lawful authority requests, or legal proceedings, and protect rights, property, and safety.

The event host decides which guests are included, which messages are sent, and which information is collected for the event. For that information, the host is responsible for lawful collection and use, accuracy, required notices, and guest rights; we process it to provide the Service under the host’s instructions. We may process limited information for our own purposes, such as security, fraud prevention, legal compliance, and Service administration.

A guest seeking to access, correct, or delete information supplied by an event host should first contact that host. The guest may also contact contact@baeem.co.il, and we will assist or route the request according to our role and applicable law.

The Service uses automated tools and AI services, including Google Gemini, to read invitation details, tailor greetings, and understand answers that ordinary rules cannot parse. The relevant provider may receive an invitation image, guest name, event details, response text, or conversational context only to the extent needed for the task.

An automated system may suggest or record an RSVP status, party size, or preference based on a guest’s response. The event host can review and correct the result. The Service does not make automated decisions that have legal or similarly significant effects on a person.

Phone calls to guests who have not answered are, by default, made by an AI-based automated calling system, not by a person. The system calls from the baeem line, holds a short conversation in Hebrew in a recorded or computer-generated voice, and records the guest’s answer. An event host may choose, for an additional fee, to have their event’s calls made by human callers on our behalf.

On an automated call, the guest’s voice is streamed in real time to an automated transcription service (Soniox), and the transcribed text is sent to a service that classifies the answer (TypeSafe); an answer that was not understood may also be sent to Google Gemini services. On some calls, Google Gemini holds the whole conversation and hears the guest’s voice directly, without separate transcription. A sentence with no prepared recording is read out in a Google Gemini computer voice, which receives its wording for that purpose; the wording may include the guest’s name and event details.

Calls to guests are recorded, whether made by the automated system or by a human caller. The recording, and the transcript of an automated call, are kept by us with the call result and are available to our team for review and troubleshooting. Guests should avoid sharing information not needed for the RSVP. Where law requires a specific notice or consent for recording or for an automated call, the event host is responsible for ensuring that outreach is lawful.

You can connect your account to ChatGPT or another AI assistant that supports the Model Context Protocol (MCP) and manage your event through it: create an event, add, update, and remove guests, see who is coming, and configure message rounds. A connection is made only at your initiative, after you sign in and explicitly approve it on our consent page, which names the service requesting access and the permissions requested (read only, or also make changes).

When you ask the assistant to act, it receives from us only the information needed for that request, such as event details, guest names, phone numbers, RSVP status, and party size, and what you give it is saved by us as if you had entered it on the website yourself. Information that reaches the assistant is subject to the terms and privacy policy of the assistant’s operator (for example, OpenAI for ChatGPT), an independent party we do not control. We send information to the assistant only in response to your request, and we do not receive your conversations beyond the request itself.

The assistant cannot send messages to guests, make a payment, or access events you are not a member of. For security and to improve the Service, we record which action was taken, when, and from which service, but not the content of the request or the answer. You can disconnect access at any time from the assistant’s settings, or by contacting us.

We use cookies and local storage for authentication, security, language and preference storage, and attribution. We also use PostHog for usage analytics, performance, heatmaps, and session replay, and Meta Pixel, Meta Conversions API, and the Google Ads tag for advertising and conversion measurement. These tools may set or read identifiers such as _fbp, _fbc, and Google’s click identifier (gclid) and receive information about pages, actions, devices, referrers, and campaigns. For visitors who arrived from a Google ad, we may report a registration or purchase to Google by the click identifier only, together with the time and value of the action.

PostHog receives information about use of the Service, including session replays (input fields are masked in recordings), and records of the internal alerts the Service sends to our team, which may include names, phone numbers, and message content of users and guests. We use this information to operate, troubleshoot, and improve the Service. In conversion reports to Meta, an email address or phone number may be sent in cryptographically hashed form, together with browser identifiers, campaign information, and the event type.

You can restrict cookies through browser settings or blocking tools. Blocking essential technologies may impair the Service. Additional advertising controls are available through Meta and Google account settings and tools offered by browsers and platforms.

We do not sell personal information. We disclose it only as needed for the purposes described in this Policy, including to:

• Cloudflare — database, storage, hosting, security, and delivery of the website.
• Meta and WhatsApp — authentication, message delivery, receiving replies, temporary media hosting, and advertising and conversion measurement.
• ActiveTrail or Twilio — SMS delivery; our telephony provider — connecting calls to the phone network.
• Soniox — real-time automated transcription of the guest’s voice on automated calls.
• TypeSafe — automated classification of the guest’s answers on automated calls, from the transcribed text.
• Google — sign-in, contact selection, Gemini services for the content processing described above, including holding automated calls and reading lines in a computer voice, and advertising and conversion measurement in Google Ads.
• SUMIT — Service payment processing and fraud prevention.
• PostHog and Sentry — analytics, operational monitoring, error diagnosis, performance, and security.
• Email, operational-messaging, and support providers, and professional advisers such as accountants, lawyers, and security providers, as needed and under appropriate obligations.
• RSVP — the independent provider of card-gift registration, identity verification, compliance, processing, and settlement. Information is transferred only after a separate choice and approval and is subject to RSVP’s terms and privacy policy.
• A competent authority, court, or other party where disclosure is legally required, necessary to protect rights or safety, or connected with a reorganization, transfer of operations, or business transaction, subject to law and appropriate safeguards.

Some providers operate outside Israel, so information may be stored or processed in other countries, including the United States and Europe. Privacy laws there may differ. Transfers will be made in accordance with applicable law using contractual commitments, transfer mechanisms, or other appropriate safeguards as relevant.

We retain information for as long as needed for the purpose for which it was collected: maintaining the account and event, providing support, security, transaction records, protecting rights, and legal compliance. Retention depends on the data type, sensitivity, event status, and legal obligations. Information is then deleted or anonymized unless further retention is permitted or required. You may send a deletion request to contact@baeem.co.il.

For transparency: raw webhook bodies are generally deleted after 14 days; an unused anonymous account draft is generally deleted after 30 days; and an onboarding chat where no phone number was provided is generally deleted after 24 hours. Transaction, security, and backup records may be kept longer where needed or required by law.

For RSVP gift-service registration information, we act only as a transient technical conduit: bank details and compliance answers are cleared after transfer and no later than 60 minutes after collection begins; identity documents are deleted after the registration attempt with a scheduled deletion backstop within 60 minutes; and gift-giver and amount details are displayed to the verified event host in memory for under 15 minutes without storage in our database. RSVP’s own retention policy applies to the copy delivered to it.

We use reasonable and customary technical and organizational measures, including access controls, encryption in transit, role separation, logging, data minimization, and scheduled deletion where appropriate. No system is completely secure, however, and we cannot promise that information will never be exposed, lost, or compromised. You must protect your sign-in methods and promptly notify us of suspected unauthorized use.

Subject to Israel’s Protection of Privacy Law, 1981 and applicable law, you may request access to personal information held about you. If it is inaccurate, incomplete, unclear, or outdated, you may ask us to correct or delete it. You may also request account closure, deletion, or an end to marketing; some rights may be limited by others’ rights, retention duties, fraud prevention, or the defense of claims.

Where another law such as the GDPR applies, you may have additional rights, including restriction, objection, portability, withdrawal of consent, and the right to complain to a supervisory authority. To exercise a right, email contact@baeem.co.il with enough detail to identify you and the requested information. We may verify your identity before responding.

A request concerning RSVP’s gift service—including gift-giver, transaction, processing, settlement, or refund information—should be sent directly to RSVP at rsvp@rsvpevents.co.il or WhatsApp +972 54-2512465. We will assist with routing where needed, but RSVP decides requests concerning information it controls.

Opening an account and using the Service as an event host are limited to people aged 18 and over. The Service is not directed to minors for account creation. An event host may nevertheless enter limited information about minor guests, such as a name, family association, and dietary preference, to manage the event. The person providing it must be entitled to do so and obtain parental or guardian consent where required. Contact us if you believe a minor’s information was provided unlawfully.

The Service may link to or integrate with services we do not control, such as bit, PayBox, RSVP, Google, WhatsApp, and venue websites. Their terms and policies apply, and we recommend reviewing them. This Policy does not apply to processing by an independent third-party controller.

We may update this Policy to reflect changes in the Service, providers, or law. The updated version will be posted here with a revised date. For a material change, we will take reasonable steps to notify users before it takes effect where required.

The controller of the Service's databases is Y.S. Software (י.ש תוכנה), Israeli exempt dealer no. 323881417. For privacy questions, requests, or complaints, email contact@baeem.co.il.