Privacy Policy

SpyCom is an e-commerce platform built for Israeli businesses: online stores, tax invoices, Israeli payment providers, WhatsApp customer service and marketing tools. SpyCom was previously called Listora; it is the same service under a new name. This policy explains what we collect, why, who we share it with, how long we keep it and how to have it deleted. The Hebrew edition follows below.

1. Who is responsible

The service at spycom.co.il is operated by SpyCom (formerly Listora). Privacy contact: pluschatgpt856@gmail.com.

2. What we collect

• Your SpyCom account: name, email address and, if you set one, a password. Passwords are never stored: we keep only a salted one-way hash (PBKDF2-SHA256).
• Sign in with Google: if you choose it, Google shares your Google account ID, name and email address with us, and whether Google has verified that email. We request only the basic openid, email and profile scopes. We never receive your Google password, contacts, Gmail, Drive or any other Google data.
• Billing: subscriptions are paid through Stripe. Card details are entered on Stripe's own secure page and never reach our servers. We keep the Stripe customer and subscription identifiers, your plan, billing cycle, subscription status and renewal date.
• Consent records: when you accept our terms or agree to receive marketing email, we record the exact text you agreed to, the time, your IP address and browser type, as a tamper-evident record of that consent.
• Store data: the store's own products, orders and customer records, within the access the merchant granted.
• Connected services: access tokens for platforms the merchant connects themselves (Shopify, Meta Business, Google and others), used only to operate those integrations.
• Operational logs: requests, errors and timestamps, used to keep the service secure and working.

3. How we use it

• To create and secure your account, sign you in and keep you signed in.
• To run your store and the features you turn on.
• To bill your subscription and show its status in your account.
• To send service messages about your account, billing and security.
• To send marketing email only if you ticked the box to receive it. You can withdraw that consent at any time from any message or by contacting us.

We do not sell personal information and we do not use it to show you third-party advertising.

4. Google user data

SpyCom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data received through Sign in with Google is used only to create your account and sign you in.

5. Cookies

spycom.co.il uses one essential cookie, spy_sid, to keep you signed in (HttpOnly, secure, up to 30 days), and a short-lived cookie that protects the Google sign-in step (up to 10 minutes). We set no advertising or cross-site tracking cookies. Page fonts are loaded from Google Fonts, which receives your IP address when the fonts load.

6. Meta data use

When a merchant connects their Meta Business account via Facebook Login for Business, we receive a scoped access token used exclusively to display their ad accounts, create and manage campaigns, read performance data, and take actions the merchant explicitly initiates within our platform. We do not sell Meta data, do not share it with third parties, and do not use it for SpyCom's own marketing.

6a. WhatsApp Business Platform data use

SpyCom acts as a Meta Tech Provider on the WhatsApp Business Platform. The merchant remains the owner of their WhatsApp Business Account (WABA). With the permissions whatsapp_business_messaging and whatsapp_business_management we process the following on the merchant's behalf and at their explicit instruction:

• Data types: Phone numbers (the merchant's and their customers'), message content (text, media, templates), display names, conversation metadata (timestamps, delivery status), WABA IDs and Phone Number IDs.
• Purpose: Replying to customer inquiries on the merchant's behalf, sending merchant-initiated business messages (order confirmations, shipping and tracking updates), AI auto-reply when the merchant has enabled it, message-template lifecycle management, and WABA-level analytics.
• Retention and deletion: Messages are stored for up to 24 months from receipt, or until the merchant deletes the conversation, whichever comes first. Disconnecting the WABA from SpyCom triggers full deletion of message content and tokens within 30 days.
• Sub-processors: Cloudflare (D1/KV/R2 storage), Meta WhatsApp Cloud API, and an AI provider (OpenAI / Anthropic) only when the merchant has enabled AI auto-reply.
• We do not use WhatsApp data for our own commercial purposes and do not share it with third parties beyond what is required to operate the service. SpyCom complies with the WhatsApp Business Messaging Policy and the WhatsApp Business Solution Terms.

7. Who we share data with

Only the service providers needed to run SpyCom, each for its own part: Cloudflare (hosting, storage and security), Stripe (subscription payments), Google (Sign in with Google, fonts), Sentry (error monitoring), and, when a merchant turns an integration on, only the data relevant to that integration (for example Meta or Shopify). We may also disclose information when the law requires it.

8. Storage and security

Data is stored on Cloudflare infrastructure (Workers KV, D1, R2) with encryption at rest and TLS in transit. Passwords are stored only as salted hashes, sign-in tokens are stored only as hashes, and third-party access tokens are stored encrypted.

9. How long we keep it

Account and store data is kept while your account is active. After you ask us to delete your account we delete it within 30 days, except records we must keep by law (for example billing, tax and accounting records) and consent records, which are kept as evidence for as long as the law requires.

10. Deleting your data

1. Email pluschatgpt856@gmail.com from the address on your account. We handle the request within 30 days.
2. For Meta data: disconnecting the app in Meta's own settings triggers our Data Deletion Callback at https://listora-backend.ahava-shop.workers.dev/data-deletion. Meta tokens and derived data are deleted within 30 days.
3. To remove SpyCom's access to your Google account at any time, visit myaccount.google.com/permissions.

11. Your rights

Under the Israeli Protection of Privacy Law 5741-1981 (including Amendment 13), and for users in the European Union and the United Kingdom under the GDPR and UK GDPR, you may ask to access, correct or delete your personal information, and to receive a copy of it. Contact pluschatgpt856@gmail.com.

12. Changes to this policy

Material changes are announced by email and inside the product 30 days before they take effect.