Privacy Policy

Particles (“Particles”, “we”, “us”) is a software service for spare-parts businesses. Our website is available at https://particles.parts. This Privacy Policy explains what personal data we process, why we process it, and how you can request access or deletion.

Controller contact: adi@particles.parts · +972-50-8662966

Particles processes data about two groups of people:

• Shop operators (“Customers”): businesses that create a Particles account and connect their WhatsApp Business number, ERP, vehicle-data providers, and (optionally) their own AWS account.
• End users (“WhatsApp contacts”): people who message a Customer’s WhatsApp Business number. Particles receives those messages through Meta’s WhatsApp Business Cloud API on behalf of the Customer, so the shop can identify parts, check stock, and reply.

When a Customer connects WhatsApp, Particles can read incoming messages and send replies using that Customer’s WhatsApp Business credentials. We do this only to provide the service the Customer configured.

Account and shop data (from Customers): name, email, password (stored as a hash), shop/company name, company registration number (if provided), language preference, account status, and usage/plan metadata.

WhatsApp integration data (from Customers): WhatsApp Business access tokens, phone number ID, WhatsApp Business Account ID, app secret, and webhook verify token. Credentials are encrypted at rest (AES-256-GCM) on the server that hosts Particles.

WhatsApp conversation data (about WhatsApp contacts, processed for Customers): WhatsApp phone number / contact ID, optional contact display name, message text, message type, Meta media IDs, voice transcripts, image-analysis text derived for part lookup, outbound replies, and the raw webhook JSON Meta delivers. Media files (voice notes, images) are downloaded temporarily to process them and are not stored as permanent media files in Particles; we keep derived text and Meta media IDs as needed to operate the inbox and AI pipeline.

Vehicle and parts data: license plate numbers, VIN and vehicle specifications resolved via configured providers (including Israeli government open data as a fallback), part descriptions, OEM/catalog numbers, match results, and related request history.

Technical and security data: IP address and related signals used for abuse protection (for example CAPTCHA verification on signup), server logs, and AI usage metering associated with a Customer account.

Optional Customer-configured credentials: ERP API credentials, vehicle-data provider keys, web-search API keys, and AWS keys when the Customer brings their own AWS account. These are encrypted at rest.

• Provide, operate, and improve the Particles service for Customers.
• Receive WhatsApp messages via Meta webhooks, process them (including transcription and vision analysis), look up vehicles and parts, and send replies through the WhatsApp Cloud API on the Customer’s behalf.
• Authenticate users, prevent abuse, and support Customer accounts.
• Meter AI usage and operate optional playground / agent features the Customer enables.
• Comply with law and enforce our Terms of Service.

We do not sell personal data. We do not use WhatsApp message content to train public foundation models. When a Customer uses their own AWS Bedrock account, model inference runs in that Customer’s AWS environment according to their AWS configuration.

Particles is a multi-tenant application that Customers use to connect their own WhatsApp Business accounts. Message content and WhatsApp identifiers are Platform Data subject to Meta’s terms. We process that data only to provide messaging and parts-lookup features to the Customer who owns the WhatsApp Business number, and we honor deletion requests as described below and in our User Data Deletion instructions.

• Contract: processing needed to provide Particles to Customers.
• Legitimate interests: securing the service, preventing abuse, and improving reliability in ways that do not override individual rights.
• Legal obligation: when we must retain or disclose data to comply with law.
• Customer instructions: for WhatsApp contacts’ data, Particles typically acts as a processor / service provider for the Customer (the shop), who determines the purposes of messaging their own customers.

We share data only as needed to run the service:

• Meta Platforms (WhatsApp Business Cloud API) — to receive and send messages for a connected Customer number.
• Amazon Web Services — when AI or storage features are used (Customer-owned AWS account and/or the hosting environment).
• Vehicle-data providers and ERP systems the Customer configures — to resolve vehicles and search/order parts.
• Email delivery providers used to send account emails (for example verification or admin notices).
• Authorities when legally required.

We retain account, conversation, and request data for as long as the Customer account remains active and as needed to provide the inbox, audit trail, and parts workflow. Customers may delete conversations or request account deletion. After a verified deletion request, we delete or anonymize personal data within a reasonable period, except where we must retain information for legal, security, or dispute-resolution reasons.

We use industry-standard measures appropriate to the risk, including encrypted credential storage, HTTPS for the application and WhatsApp webhooks, access-controlled hosting, and hashed passwords. No method of transmission or storage is 100% secure.

Depending on your location, you may have rights to access, correct, export, restrict, or delete personal data. To exercise these rights:

• Email adi@particles.parts with the subject “Data request” or “Data deletion”.
• Tell us whether you are a Particles account holder or a WhatsApp contact, and include the relevant email or WhatsApp phone number.
• We will verify the request and respond. Step-by-step deletion instructions are also published at https://particles.parts/en/data-deletion (Hebrew: https://particles.parts/he/data-deletion).

WhatsApp contacts who messaged a shop should also contact that shop directly, because the shop is the business they interacted with. Particles can assist the shop and process deletion of data stored in Particles.

Particles is a business service and is not directed to children under 16. We do not knowingly collect personal data from children.

Depending on where Particles is hosted and which providers a Customer enables, data may be processed in Israel, the EU, the United States, or other regions. We take steps appropriate to the deployment to protect personal data in transit and at rest.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of Particles after an update constitutes acceptance of the revised policy where permitted by law.

Questions about privacy: adi@particles.parts · +972-50-8662966 · https://particles.parts