oToK Privacy Policy
Last updated: July 2026
This policy explains what information is collected when you use the oToK platform — the web application at app.otok.io, the oToK mobile apps for iOS and Android, and the marketing website otok.io — how that information is stored and processed, and what rights you have. oToK is operated by Cnergia Education Ltd., an Israeli company, company no. 515780724 ("oToK", "we", "us"). Using the service constitutes acceptance of this policy.
1. Our two roles
oToK is a business communication platform. We handle personal information in two distinct roles: • As a controller — for information about you as our customer or website visitor: your user account, billing details, support communications, and affiliate-program participation. • As a processor — for the content our customers manage inside their workspaces: their contact lists, conversations, campaign recipients, and similar records. For that content, the business operating the workspace is the controller and decides why and how it is processed; we process it on their behalf and under their instructions. If you are a customer, subscriber, or contact of a business that uses oToK, that business is responsible for the data it holds about you. Requests about that data (access, correction, deletion, unsubscribing) should be directed to that business; we assist it in fulfilling them. Every marketing email sent through oToK includes an unsubscribe link, and consent choices are recorded per channel.
2. Information we collect
Account and profile information. Name, email address, password (stored as a salted hash — never in plain text), avatar, phone number where provided, two-factor authentication settings, passkey public keys, trusted devices, active sessions, and notification preferences. Workspace content (processed on behalf of our customers). Contacts and their attributes (names, phone numbers, email addresses, tags, custom fields, consent records), conversations and messages — including media files — across connected channels (WhatsApp via Meta's Cloud API, email, web widget), campaigns and their delivery logs, newsletters, sales records such as deals, orders, quotes, and payments the business collects from its own customers, as well as customer and order data synced from an online store the business connects, event registrations, scheduled meetings and bookings, and call logs and call recordings where a telephony integration is connected, form and landing-page submissions, and website-activity events collected by the customer's tracking pixel on the customer's own site. Where a business collects payments from its customers through oToK, the payer's card details are entered directly on the secure payment page of the payment provider the business connected and never reach our servers; we store only charge records and, with the payer's consent, an encrypted payment token and non-sensitive card details (card brand, last four digits, and expiry). Billing information. Payment card data is entered directly into our payment provider's secure form and never reaches or is stored on our servers — we hold only a payment token, charge history, and invoice references. Technical and usage information. Server logs, IP addresses (used for security and rate limiting), error reports, and aggregate usage counters used for plan limits and product improvement. Mobile app information. Push-notification tokens for your device, the app platform and version details and a random device identifier (sent when the app checks for updates), and login session tokens stored in the device's secure keychain. The mobile apps contain no advertising SDKs and no third-party analytics, and they do not read your device's address book, location, or files beyond what you explicitly attach. Data from Google integrations. If you connect a Google account (Google Analytics, Google Ads, or Google Calendar), we access and handle data as described in section 6 ("Google user data"). Affiliate program. If you join our affiliate program: your referral code, referral and commission records, and bank details for payouts (stored encrypted; accessible only to authorized staff for payout processing, with every access recorded in our audit log).
3. How we use information
We use information to operate and secure the service; authenticate users; deliver messages, emails, and notifications our customers send; process payments and manage subscriptions; provide support; enforce sending limits and anti-abuse rules (including suppression and blacklists); comply with legal obligations; and improve the product. We do not sell personal information, and we do not use workspace content for advertising.
4. AI features
Some features use AI models to generate content (for example email drafts, flow suggestions, and analytics summaries). When a workspace uses these features, relevant content is sent to the configured AI provider — Anthropic, OpenAI, or Google for text generation, and Higgsfield for image generation — either through our platform account or through API keys the customer connects. Such requests are subject to each provider's API data-use terms; under those terms, content submitted through the API access we use is not used to train the providers' models. Where a customer connects their own API key, the customer's own agreement with that provider governs, and some free API tiers may permit the provider to use submitted content to improve its services. AI features are optional and can be left unused.
5. Sharing and sub-processors
We share information only with service providers needed to operate the platform, to the minimal extent required and under confidentiality obligations: • Meta Platforms — WhatsApp Business Cloud API message delivery • Amazon Web Services (SES) or the configured SMTP provider — email delivery • Sumit — payment processing and invoicing (Israel) • Google Firebase — mobile push-notification delivery • Sentry — error monitoring • Cloudflare — content delivery and network security • ZeroBounce — email-address validation, when a customer uses list validation • Dropcontact — contact-data enrichment, when a customer uses the enrichment feature • Mapbox — rendering map previews for location messages • Gravatar (Automattic) — default account avatars (a hash of your email address is used to look up an avatar) • AI providers (Anthropic, OpenAI, Google, Higgsfield) — only when AI features are used (see section 4) • Hosting and infrastructure providers on which the service runs In addition, customers may choose to connect third-party integrations to their workspace (for example Zoom, Salesforce, ActiveTrail, Hunter, e-commerce platforms such as Shopify, Wix, and WooCommerce, payment providers such as Sumit and Cardcom, telephony providers, Meta Conversions API, or Google Analytics). Data flows to or from those services only when the customer connects them, per the customer's configuration and the third party's own terms. How oToK itself handles data from the Google integrations (Analytics, Ads, and Calendar) is described in section 6. We may disclose information where required by law, to protect our rights or users' safety, or as part of a corporate transaction (in which case this policy continues to apply to the transferred data). Our engagement of sub-processors when processing data on our customers' behalf — including advance notice before materially adding or replacing a sub-processor and the customer's right to object — is governed by our Data Processing Agreement (DPA), available at otok.io/en/dpa and incorporated by reference into the Terms of Service.
6. Google user data
oToK offers optional integrations with your Google account, connected only with your explicit approval through Google's OAuth consent screen. There are two separate connections — a marketing-data connection (Google Analytics and Google Ads), held at the workspace level, and a booking-calendar connection (Google Calendar), held at the level of the connected user — and each requests only the permissions it needs. In both, your Google account email address is used solely to display which account is connected. oToK does not access Gmail or Google Drive, and does not offer signing in with a Google account. Marketing data (Google Analytics and Google Ads): • Google Analytics (GA4) — a daily, read-only import of aggregate reporting data only (sessions, users, key events, and revenue, broken down by date, source, medium, and campaign), which powers the in-product attribution dashboards. We store no user-level Analytics data. • Google Ads — reads the list of Google Ads accounts you can access and daily campaign performance (cost, impressions, clicks, conversions, and conversion value), for attribution and return-on-investment reporting. • Conversion export to Google Ads — a separate permission requested only if you explicitly enable this feature; it is off by default. When enabled, oToK uploads conversion events for the business's converting contacts into the business's own Google Ads account, at the business's direction. Email and phone identifiers are SHA-256-hashed at the moment of sending, per Google's rules; neither the raw nor the hashed identifiers are stored by the export mechanism, which records delivery status only, with no identifying details. Only contacts who pass the workspace's consent checks (subscribed, and not blocked or blacklisted) are ever exported. Booking calendar (Google Calendar): • Reads — your calendar list (so you can choose which calendars determine availability and which calendar receives bookings) and free/busy times only: bare "busy" intervals (start and end times only), held in a short-lived in-memory cache for about two minutes and never written to our database. The titles, attendees, and contents of your other calendar events are never read into or stored by oToK. • Writes — creates, updates, and cancels calendar events only for meetings booked through oToK. Storage and security. Google access and refresh tokens are stored encrypted at rest (AES-256-GCM) and are subject to the access controls described in the "Security" section. Alongside the tokens we keep only basic connection details: the connected account's email address, and the identifier of the selected GA4 property or Ads account, or the identifiers of the calendars you selected (availability-gating calendars and the destination calendar). Disconnecting and deletion. You can disconnect any Google connection at any time from oToK's settings; on disconnect we delete the stored tokens and the connection record, and for the marketing-data connection we also ask Google to revoke the tokens (on a best-effort basis). Aggregate GA4 and Ads statistics already imported are retained as the workspace's attribution history — they are deleted with the workspace or on request. Calendar events created for meetings that were actually booked remain on your calendar. You can also revoke oToK's access at any time directly from your Google account, at https://myaccount.google.com/permissions Use limitations. We do not transfer Google user data to third parties except as necessary to provide or improve the features described above, with your explicit consent, for security purposes and abuse investigation, or to comply with applicable law — and we never sell it. We do not use Google user data for our own advertising, including ad targeting or personalization (the explicitly enabled conversion export sends hashed identifiers into the business's own Google Ads account, at the business's direction — that is the feature described above). No human at oToK reads Google user data except with your explicit consent, for security and abuse investigation, or as required by law. We do not use Google user data to develop, improve, or train generalized AI and/or machine-learning models. oToK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Full policy: https://developers.google.com/terms/api-services-user-data-policy
7. The mobile apps
The iOS and Android apps are a companion to the web platform and add only what a mobile device requires: • Notifications — with your permission, we store a push token for your device to deliver workspace notifications. Revoking notification permission or logging out disables this. • Camera, photo library, and microphone — used only when you actively attach a photo, file, or voice message to a conversation. The app never scans your library or records in the background. • Secure storage — your login session is kept in the operating system's keychain/keystore. • Update checks — the app periodically asks our servers whether a newer in-app bundle is available, sending only technical details of the check: the app platform, app and OS version information, and a random device identifier (generated by the update plugin, not linked to your account) that we use to roll updates out gradually. This information is not stored. • No tracking — the apps contain no ads, no advertising identifiers, and no cross-app tracking.
8. Cookies and local storage
The platform uses essential cookies and browser storage only: authentication tokens, an HttpOnly session cookie, and interface preferences (such as language and sidebar state). The marketing website uses essential cookies only; if analytics tools are added, this policy will be updated accordingly.
9. Tracking performed for our customers
Some oToK features collect data about our customers' audiences on the customer's behalf: email open and click tracking, landing-page form submissions, and a website tracking pixel the customer may install on their own site. This data belongs to the customer's workspace and is governed by the customer's own privacy practices. If you believe a business is tracking you through oToK improperly, contact that business or write to us at [email protected] and we will assist.
10. Data retention and deletion
• Account data is retained while your account is active and deleted after account closure. • Deleting a workspace permanently removes its content — contacts, messages, media, campaigns, and related records. • Encrypted off-site backups are retained on a fixed rotation schedule and then destroyed; deleted data disappears from backups as the rotation completes. • Unsubscribe and suppression records are deliberately retained even after other data is deleted — keeping them is what guarantees a person who opted out is not contacted again. • Payment and invoicing records are retained as required by tax and accounting law.
11. Security
We apply industry-standard safeguards: TLS encryption in transit, encryption at rest for sensitive secrets and tokens (AES-256-GCM), salted password hashing, role-based access controls, workspace isolation, encrypted backups, audit logging, and optional two-factor authentication and passkeys for every account. Payment card details never touch our servers. No system is perfectly secure; we encourage strong, unique passwords and enabling two-factor authentication.
12. International transfers
Our sub-processors may process data in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards such as the providers' standard contractual clauses and equivalent mechanisms.
13. Your rights
Subject to applicable law — including Israel's Protection of Privacy Law and, where applicable, the EU GDPR — you may request access to, correction of, deletion of, or a copy of personal information we hold about you as a controller, and you may object to or restrict certain processing. Workspace owners can export key workspace records (contacts, campaigns, deals, orders, and payments) from within the platform. To exercise these rights, contact [email protected]. If your request concerns data held by a business using oToK, we will refer you to that business and assist it in responding. You may also lodge a complaint with your data-protection authority (in Israel, the Privacy Protection Authority).
14. Children
oToK is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. Material changes will be announced on the website or by email. The "Last updated" date above reflects the current version.
16. Contact
Cnergia Education Ltd. (company no. 515780724) Email: [email protected]