Privacy Policy

Who we are

Taseli is a service operated by Go-Top Marketing and Media Ltd (Hebrew: גו טופ שיווק ומדיה בע״מ), company number 51-XXXXXXX, registered in Israel ("Taseli", "we", "us").

This policy explains what personal data we collect when you visit taseli.co.il, create an account or connect an advertising account, why we collect it, who we share it with, how long we keep it, and what rights you have.

Taseli is sold to businesses. Most of the data we handle is business data, but it can include personal data such as a name, an email address, or information about people who interact with your ads. We treat all of it with the care this policy describes.

Our two roles: controller and processor

• As a controller, we decide how and why we process data about our own visitors and customers: your account details, billing records, support conversations and site analytics.
• As a processor, we process the data in your connected advertising accounts on your behalf and only to provide the service you asked for. You (the advertiser) remain the controller of that data. Our Data Processing Agreement sets out the terms.

What data we collect

We do not ask for, and do not want, sensitive data such as health information, biometric data or government ID numbers of individuals.

How we use data

Israeli law and the GDPR

We process personal data in accordance with the Israeli Protection of Privacy Law, 5741-1981, including Amendment 13 (in force since August 2025), and the Protection of Privacy (Data Security) Regulations, 5777-2017. This includes maintaining a data security procedure, role-based access, access logs, a penetration test before launch and at least once a year, and reporting serious security incidents to the Privacy Protection Authority as the law requires.

If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) or its local equivalent also applies. The legal bases listed above are the bases we rely on under the GDPR. Before we offer the service in the EU, we will appoint an EU representative and publish their details here.

Google user data and the Limited Use requirements

When you connect Google (sign-in, Google Ads, and later Google Analytics, Search Console or Merchant Center), we receive data through Google APIs only with the access you approve on Google's consent screen.

Taseli's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means:

• We use Google data only to provide and improve the user-facing features you see in Taseli.
• We do not sell Google data, transfer it to advertisers, data brokers or information resellers, or use it for advertising, retargeting or interest-based ads.
• We do not use Google data to train or improve general-purpose AI or machine-learning models.
• No person at Taseli reads your account data unless you give explicit, time-limited consent for support access, it is necessary for security purposes (such as investigating abuse), or the law requires it. Every such access is logged.
• We transfer Google data only as needed to provide the service, to comply with law, for security, or as part of a merger or acquisition with notice to you.

The same principles apply to data we receive from Meta and TikTok, in line with their platform terms.

We do not sell your data

We do not sell, rent or trade personal data or advertising data. We do not use your advertising data to advertise to you or to anyone else.

AI processing

Taseli uses large language models to explain findings, write proposal descriptions, answer questions in chat, and produce reports. Detecting anomalies and calculating savings is done by deterministic statistical methods, not by the language model.

• AI processing is performed by Anthropic as our processor (subprocessor), under a data processing agreement, with zero data retention and no training on customer data.
• We send the model only what the specific task needs. OAuth tokens are never sent to an AI model.
• We do not train AI models on customer data, ours or anyone else's.
• Statistics across customers' outcomes are disabled until a documented privacy and platform-policy review permits them.

If you connect your own AI agent to Taseli (for example through our MCP server), the data your agent reads is processed by your agent's provider under your agreement with them. See the Terms of Service.

Who we share data with

We share data only with:

• Subprocessors that help us run the service, such as hosting, database, email, messaging, AI processing and billing providers. They are bound by data processing agreements and may use the data only to serve us. The current list is on the Subprocessors page.
• Payment providers: SUMIT for customers in Israel, and Paddle for customers outside Israel. Paddle acts as the merchant of record and processes your billing data under its own privacy notice.
• The advertising platforms you connect, when you approve a change and we execute it in your account.
• People you authorize, such as teammates or an agency's clients through the client approval portal.
• Authorities, when the law requires it, and only to the extent required.
• A buyer or successor, in a merger, acquisition or sale of assets, subject to this policy and with notice to you.

For our own advertising, after marketing consent, we may send Google, Meta or TikTok conversion events for people who signed up through our ads, with the email address in hashed form. This uses our own ad accounts only and never your advertising data.

International transfers

Some of our subprocessors store or process data outside Israel, including in the United States and the European Union. We transfer data only where the destination ensures an adequate level of protection, or with appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, and in accordance with the Israeli Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

How long we keep data

We keep only the records the law requires, with a documented reason. We do not keep all advertising data or AI prompts for years just because invoices must be kept.

Deleting your data

You can delete your workspace at any time under Settings, Privacy, or by writing to privacy@taseli.co.il. When you do:

1. New processing stops immediately and our access to your ad accounts is revoked.
2. Your workspace data, files, caches and queued jobs are deleted on a tracked schedule, including at our subprocessors.
3. Backups are not restored without first re-applying deletions.

We keep only what the law requires us to keep, such as invoices.

You can also revoke Taseli's access at any time from your Google, Meta or TikTok account settings. Revoking access stops data collection; it does not by itself delete data we already hold, so please also delete your workspace if you want that.

Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data.
• Export your workspace data in a machine-readable format (JSON), from Settings, Privacy.
• Object to or restrict certain processing, including direct marketing at any time.
• Withdraw consent where processing is based on consent, without affecting earlier processing.
• Complain to the Israeli Privacy Protection Authority, or, if you are in the EU, to your local data protection authority.

To exercise a right, write to privacy@taseli.co.il. We may need to verify your identity first. We respond within the time the law sets.

If you are an individual whose data appears in a customer's advertising account (for example, in a lead form), please contact that advertiser first. They are the controller; we will help them respond.

Security

We protect data with measures that include encryption in transit and at rest, envelope encryption of OAuth tokens in a dedicated vault, strict separation between the services that read data and the services that can make changes, least-privilege access, multi-factor authentication, audit logs, a web application firewall, dependency and secret scanning, encrypted backups, and regular penetration testing. No system is perfectly secure; if an incident affects your data, we will notify you and the authorities as the law requires.

You can report a security issue to security@taseli.co.il.

Children

Taseli is a business service and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

We may update this policy. Each version is published with its version number and effective date, and earlier versions remain available. If a change is material, we will notify account holders by email or in the app before it takes effect.

Contact

Go-Top Marketing and Media Ltd, company number 51-XXXXXXX, Israel.

• Privacy questions and requests: privacy@taseli.co.il
• Security reports: security@taseli.co.il
• Legal notices: legal@taseli.co.il, or the voicemail line +972-3-000-0000 (for cancellation and legal notices only)