Privacy Policy

Effective: 06/08/2026

NadlanCRM is a service operated by MenuWays Ltd., a private company registered in Israel (HP 514231802), registered address: 1 Snonit st., Caesarea 3079127, Israel. References to "we", "us" or "the Company" mean MenuWays Ltd.. References to "the Service" or "NadlanCRM" mean the SaaS product available at https://www.nadlancrm.co.il.

This policy describes how MenuWays Ltd. collects, uses, retains, and discloses personal data through NadlanCRM, including data we receive from Meta Platforms, Inc. through the Meta Marketing API.

Meta (Facebook) Integration

When a NadlanCRM customer ("the Agent") connects their Meta Business account to NadlanCRM, MenuWays Ltd. receives and processes the following data from Meta.

Data we collect:

• Leads collected through Meta Lead Ads forms created by the Agent (full name, phone, email, and any custom field the Agent added to the form).
• Identifiers and names of Facebook Pages owned by the Agent.
• Ad account identifiers owned by the Agent.
• Access tokens issued by Meta on the Agent's behalf.

How we use the data:

• We forward leads in real time to the Agent's NadlanCRM environment.
• We retain leads in the Agent's NadlanCRM for the duration of the subscription.
• We do not use this data for any purpose other than forwarding it to the Agent who placed the ad.

Storage and security:

• Lead data is held in the Agent's NadlanCRM environment on our production infrastructure in the United States. See Hosting, storage and security below.
• Access tokens issued by Meta are encrypted by the application before they are written to our database.
• We do not share Meta data with any third party other than the Agent.

Retention:

• Lead data is retained for as long as the Agent's account is active, plus 30 days after cancellation.
• The Agent may delete any lead from NadlanCRM at any time.

Your rights:

• If you submitted a Lead Ad form, you may request deletion of your personal data at any time. See https://www.nadlancrm.co.il/data-deletion.

Disconnection:

An Agent may disconnect Meta from NadlanCRM at any time via account settings. We immediately revoke stored access tokens.

Legal basis:

• Israeli Privacy Protection Law, 5741-1981
• EU GDPR where applicable
• Meta Platform Terms

Google Workspace Integration (Gmail and Calendar)

A NadlanCRM customer ("the Agent") may optionally connect their own Google account. Nothing is connected by default, and the Agent chooses which integrations to enable. This section describes the Google user data we receive, what we do with it, and every party it is shared with, transferred to, or disclosed to.

We never read the Agent's mailbox. We do not request permission to read Gmail, and the Service has no ability to do so. Sending is the only Gmail permission we ask for.

All permissions are requested together, in a single Google consent screen, the first time the Agent connects their account. That one approval covers both sending mail and calendar synchronisation. Google shows a checkbox for each permission and the Agent may approve one and decline the other; a declined permission simply means the corresponding feature does not operate.

Scopes we request, and why:

• openid — confirms the identity of the Google account being connected. It grants no access to any Google service.
• https://www.googleapis.com/auth/userinfo.email — reads the email address of the connected account, so the Service can show the Agent which account is connected and send mail from the correct address. We read the address only; we do not request the Agent's name or profile picture.
• https://www.googleapis.com/auth/gmail.send — sends email on the Agent's behalf, so that mail the Agent sends from NadlanCRM comes from the Agent's own address rather than ours. This permission allows sending only. It does not permit reading, searching, listing or deleting any message in the mailbox.
• https://www.googleapis.com/auth/calendar.events — two-way synchronisation of viewings, meetings and reminders with the Agent's primary calendar. This is the Events scope, not the full Calendar scope: it cannot create, delete or share calendars.

How we use the data:

• Google user data is used only to provide the features above to the Agent whose account it is, and to that Agent's office where the office's own visibility settings allow it.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data to build profiles for any purpose beyond the Agent's own CRM records.

With whom we share, transfer or disclose Google user data:

• InterServer, Inc. (United States) — our hosting provider. Message text, calendar event details and encrypted OAuth tokens are stored in our application database on that infrastructure. See Hosting, storage and security.
• Anthropic PBC (United States) — only where the Agent's office has explicitly enabled the optional AI features, and only for the two features that use them: classifying an incoming email as a potential enquiry, and extracting follow-up actions from a conversation. In those cases the text of the message is transmitted to Anthropic to be processed and a result returned. Anthropic does not use it to train its models, under the commercial terms in force between MenuWays Ltd. and Anthropic. AI features are off by default; see AI Processing.
• No one else. Google user data is not shared with, transferred to, or disclosed to any other third party. It is not sold, rented, or made available to advertisers, data brokers, or other customers of NadlanCRM.
• We may disclose data where we are legally compelled to do so, or where it is necessary to investigate abuse or a security incident affecting the Service.

Limited Use:

• NadlanCRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
• We do not use Google Workspace APIs user data — raw, aggregated, or derived — to develop, train, or improve any foundational or generalized artificial intelligence or machine learning model. Where such data is transmitted to Anthropic PBC as described above, it is sent solely so that a result can be returned for the Agent, and is not used by Anthropic to train its models.

Retention and deletion:

• Detected enquiries that the Agent has not acted on are purged automatically after the retention period configured for the Service.
• Inbox scanning has been withdrawn and we no longer request permission to read Gmail. Where an Agent used it previously, disconnecting Google deletes the detected enquiries and the inbound mail we held only because we read the mailbox; the same deletion is available on demand from the Agent's email settings. Mail the Agent sent through NadlanCRM is kept: the Agent authored it, and it is the office's own record of what it told a client.
• Correspondence threaded onto a contact card, and synchronised calendar events, are retained for as long as the Agent's account is active, and are deleted when the account and its office data are deleted.
• The Agent may delete any individual record from NadlanCRM at any time.

Disconnection and revocation:

An Agent may disconnect Google from NadlanCRM at any time in account settings. On disconnection we call Google's token revocation endpoint to invalidate the grant, and we delete the stored tokens. The Agent may also revoke our access directly at https://myaccount.google.com/permissions.

AI Processing (Anthropic)

NadlanCRM offers optional features that process text using a large language model operated by Anthropic PBC (United States). These features are off by default. An office enables them explicitly and can switch them off at any time.

What is sent, and when:

• Content the Agent writes or requests — property descriptions, translations, comparative market analysis, client summaries, drafts of emails and messages, and the in-product assistant. Sent when the Agent uses the feature.
• Incoming email from unknown senders — sender address and name, subject and message body, sent only for messages that pass a relevance filter applied first in our own systems, in order to identify enquiries that should become leads.
• Conversation content, where the office enables conversation action extraction — WhatsApp conversations held on the office’s own business number, and email correspondence with contacts already recorded in the CRM. Used to identify meetings, tasks and follow-ups that were agreed, and to present them to the Agent for approval.

What is not sent:

• Full client, property or transaction records. Only the text being processed, and the names needed to attribute it.
• Payment details, identity document numbers or authentication credentials.
• Content from an office that has not enabled these features, or from an Agent who has opted out.

Processing terms:

• Anthropic processes the text to return a result and does not use it to train its models, under the commercial terms in force between MenuWays Ltd. and Anthropic.
• This processing takes place on Anthropic's infrastructure in the United States. Our own hosting is also in the United States, with InterServer in New Jersey (see Hosting, storage and security). Both involve a transfer of personal data outside Israel and the European Economic Area.
• No automated decision produces a legal or similarly significant effect. Every suggestion is presented to the Agent, who accepts, edits or rejects it; nothing reaches a calendar, a task list or a client profile without that approval.

Controls:

• The office manager enables or disables AI features for the whole office.
• Conversation action extraction is enabled separately, per office, and the office chooses which channels are read.
• An individual Agent may opt out, after which their conversations are not sent at all.

Retention:

• Conversation content and the suggestions derived from it are stored in the office’s NadlanCRM environment for as long as the account is active, and are deleted with it.
• Anthropic’s retention of submitted text is governed by its own terms and is not controlled by MenuWays Ltd.
• An Agent may delete any conversation, message or suggestion from NadlanCRM at any time.

Hosting, storage and security

Where the Service runs:

• NadlanCRM runs on infrastructure provided by InterServer, located at the 365 Data Centers NJ3 facility in Carlstadt, New Jersey, United States. The application database is held there.
• Backups are held at a separate data centre in the United States.
• Because MenuWays Ltd. is established in Israel and this infrastructure is in the United States, storing and processing data through the Service involves a transfer of personal data outside Israel and the European Economic Area.

Files and images:

• Files uploaded to the Service — property photographs, contract documents and office logos — are stored on Cloudflare R2, part of Cloudflare’s global network, and are encrypted at rest by Cloudflare.
• The storage region hint is set to Eastern Europe. This is a placement hint, not a jurisdiction restriction: no jurisdiction restriction is configured, so files may be held or served from Cloudflare locations in other countries.

Security measures:

• Traffic between your browser and the Service is encrypted in transit using HTTPS. The Service sends HTTP Strict Transport Security with a duration of one year, including subdomains.
• Access credentials and third-party access tokens — Google, Meta and WhatsApp OAuth tokens, mail server passwords, and integration secrets — are encrypted by the application before they are written to the database.
• Each office’s data is separated at the database level, and access within an office follows the role of the signed-in Agent.

Data controller:

MenuWays Ltd. (HP 514231802)
1 Snonit st., Caesarea 3079127, Israel
Contact: [email protected]