Privacy Policy — Doc Chief

Version: 1.0 · Document date: 2026-10-12 · Effective date: 2026-10-12

The short version

• Doc Chief helps businesses collect documents and photos over WhatsApp. A business opens a "case". The person the business asked (the "filler") sends the documents item by item. Doc Chief packages them into a ZIP file and emails it to the business.
• The business that asked for the documents decides about them. We process them on its behalf and on its instructions. You can contact that business, and you can also contact us (section 12).
• After successful delivery we delete the case files (photos, documents, ZIP) from our server. Basic case details are kept: the filler's name, phone number, dates and status. The full retention periods are in section 9.
• Currently there is no AI in the pipeline. No AI system reads, classifies or analyses the content of the documents. The process is fixed and template-based.
• We do not sell personal data. To run the service we use providers: Meta (WhatsApp), Google (email), Oracle (a server in Israel) and Namecheap (domain and email forwarding). Details in section 7.
• Our website uses no cookies, tracking or analytics.
• Questions and requests: docchief.office@doc-chief.com

1. Who we are and how to contact us

"Doc Chief" ("Doc Chief", "we") is operated by Yaakov Kobi Asulin (exempt dealer), who is also the service operator.

• Privacy contact and all requests under this policy: docchief.office@doc-chief.com
• Website: https://doc-chief.com

No Data Protection Officer has been appointed. Privacy requests are handled by Yaakov Kobi Asulin.

2. Who this policy covers and our role

This policy describes how we handle the personal data of several groups. Our role depends on the type of data:

Note for fillers: WhatsApp messages you receive come from Doc Chief's WhatsApp number, which is shared by all businesses using the service. The opening message names the business that asked for your documents. That business decided which documents to request and why, and it is the one that receives them.

3. What we collect

3.1 Business customers and registrants

• Registration and contact details from the website sign-up form or direct contact: business name, contact person's name, phone, email, the chosen plan and templates, and acceptance of the Terms of Service and this policy.
• Business or company registration number, if you provide it. This field is optional. The number is sent to the service mailbox and included in your onboarding documents. It is not stored in the case database.
• Delivery email addresses: a main address plus an optional extra distribution list that closed cases are sent to. These may include named employees.
• Relationship data: customer number, onboarding stage, plan and add-ons, payment status (marked manually), payment reminders sent, delivery-address confirmation, any suspension, and case counts used for plan limits.
• Correspondence and onboarding documents: emails and documents we exchanged, for example the specification form you fill in and return, the order confirmation and the welcome document, and technical support requests.
• Payment details: payment currently happens outside the system and is marked "paid" manually. We do not collect or store payment card details.

3.2 Business representatives

• The representative's WhatsApp phone number and which business it belongs to.
• Messages and commands the business representative sends to Doc Chief: open a case, cancel, reports and support requests, including the filler details the representative enters.

3.3 Fillers

• Name and WhatsApp phone number. These are provided to us by the business when it opens a case, not by you. The business representative may instead share a contact card, in which case we store the phone number from it.
• The documents and photos you send for each item in the case: photos, and files sent as a document in any format, with the time each file was received.
• Text messages and button replies you send in the chat (such as "done", "undo" or a language choice). They are used only to move the process forward and are not stored as separate content.
• Case details: the title the business gave the case, language (Hebrew or English), which items are complete, case status, open and close times, and when reminders were sent.
• Important: depending on what the business requested, documents may contain other personal data. For example, a driving licence photo shows personal details, a photo and an address; other documents show signatures, vehicle numbers or report forms. We do not read, classify or extract information from the documents. We only store them temporarily, package them and deliver them to the business. Files sent as a "document" rather than a "photo" may contain embedded metadata your device added, such as location or capture time. We do not read or remove it.

3.4 Website visitors

• Contact-form details: name, phone and/or email, and your message.
• IP address: to limit form abuse, the server keeps the IP address of anyone submitting a form in memory only. It is never written to disk, and it is cleared when the service restarts.
• No cookies, pixels or analytics (see section 15).

4. Sources

• Directly from you: website forms, email or a WhatsApp conversation.
• From the business customer: filler and business-representative names and phone numbers, and the case title.
• From Meta (WhatsApp Cloud API): messages and files you send to Doc Chief's number reach us through Meta.

5. Purposes and legal bases

We do not use filler data for any purpose of our own (no marketing, advertising, profiling or model training), and we do not analyse document content. There is no automated decision-making in the pipeline that affects individuals. The only fixed rules apply to businesses: blocking new cases because of unpaid fees or quota, and suspension because of abnormal volume.

Providing data is voluntary for a filler. There is no legal duty to give us anything. If you do not send the documents, they simply do not reach the business through us, and what follows from that is between you and the business. Providing details is voluntary for a business customer too, but without contact details and a delivery address we cannot provide the service.

6. WhatsApp and Meta

• Conversations with fillers and business representatives run through Meta's WhatsApp Business Platform (Cloud API). Messages and files pass through Meta's infrastructure before they reach our server.
• According to Meta's documentation, when it provides the Cloud API Meta acts as a processor on behalf of the business that operates the number, which is Doc Chief. For filler data, where the business customer is the controller, Meta is therefore our sub-processor. According to the same documentation, Meta keeps messages and media files for up to 30 days for operational purposes, messages it stores are encrypted, and it states that it does not use the content of these messages for advertising. Data about the account and use of the service may also go to Meta group companies under Meta's terms.
• Your use of the WhatsApp app itself (account, contacts, settings) is governed by WhatsApp's own Terms of Service and Privacy Policy, not by this policy. We have no control over data that Meta collects as a controller.
• We download files from Meta to our server over an encrypted, authenticated connection. We do not receive your contact list, profile photo or location from Meta.
• Messages we initiate, such as case opening or cancellation, use templates pre-approved by Meta, and are sent only when a business customer opens a case for you. We do not send marketing messages to fillers.

7. Sharing and service providers

We do not sell, rent or trade personal data. We share data only as follows:

Each provider has access only to what its role needs, and its use of the data is governed by its own terms and privacy policy.

We currently have no invoicing or payment provider, and delivery to Google Drive is not active. If either is added, we will update this policy first.

8. International transfers

• Our server, which holds the database and the case files until delivery, is located in Israel.
• Meta, Google and Namecheap also process data outside Israel. Such transfers follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

9. Retention

"Within 8 days": the clean-up runs once a day and compares whole dates, so an email is deleted 7 to 8 days after it was sent.

When a retention period ends, we delete the data unless the law requires us to keep it. Copies already delivered to the business customer are held by that business and governed by its own policy.

10. Security

These measures are actually in place:

• Encryption in transit: the website and the WhatsApp endpoint are served over HTTPS. Connections to Meta are encrypted too (HTTPS), and sending from Doc Chief's server to Google's mail server is encrypted (STARTTLS). This covers our hop only: the ZIP file itself is not separately encrypted, and the rest of the email's path to the recipient's mailbox depends on the email providers.
• Encrypted backups: the daily backup is encrypted (with the age tool) before it leaves the server. The decryption key is not stored on the server and not in the mailbox.
• Verifying where messages come from: every incoming message from Meta is checked against a cryptographic signature (HMAC-SHA256) before it is processed. A message without a valid signature is rejected, and when the signing secret is not configured the server rejects all messages.
• Separation between businesses: every case belongs to one business. Before each delivery the system checks that the destination matches the business that opened the case and that the business confirmed the address, and blocks the delivery if they do not match.
• Access control: application services listen only inside the server. The management interface is not exposed to the internet, and access to it is over an encrypted channel (SSH). Access to the server, the management interface, the service mailbox and the management of the service's Meta account is limited to the service operator. Technical secrets such as API keys are kept in a file with restricted permissions, not in code.
• Form protection: per-address rate limiting, a bot trap, and an overall hourly cap on new leads.
• Data minimisation: files are deleted after delivery, backups exclude case files, and service emails are deleted under section 9.
• Audit log in which records cannot be changed or deleted, for sensitive actions.

No system is completely secure, and we cannot guarantee absolute security. We act under the Privacy Protection (Data Security) Regulations.

11. Security incidents

If a security incident involves personal data:

• we will act to contain it and investigate what happened;
• if filler data is involved, we will notify the business customer without undue delay, so it can meet its own obligations;
• we will report to the Privacy Protection Authority where the law requires it, and notify affected individuals where the law requires it or the Authority directs us to.

12. Your rights, and how to request access, correction or deletion

What the law gives you. Under the Protection of Privacy Law, 1981, every person may access data about them and ask to correct or delete data that is inaccurate, incomplete, unclear or out of date. The law does not give a general right to have any data deleted on request.

What we commit to beyond that. This is Doc Chief's own commitment, not a duty under the law: on request we will also delete accurate data we hold about you, unless the law requires us to keep it or we need it to defend a legal claim. This applies to everyone, including people who never signed up to the service.

How to submit a request:

1. Email docchief.office@doc-chief.com with the subject "Privacy request" or "Deletion request".
2. Say what you are asking for (access, correction or deletion) and give the WhatsApp phone number or email address you used with Doc Chief. Fillers: also give the name of the business that contacted you and, if you have it, the case number.
3. Verification: so that we do not disclose or delete someone else's data, we will ask you to reply from the same email address, or send a one-time code to it and ask you to send it back. We will compare the details you gave with our records. If we cannot link the request to you with reasonable certainty, we will ask for more details and will not disclose data until that is resolved. We will not contact you on our own initiative over WhatsApp for verification.
4. We will reply within 30 days at most.

If you are a filler (someone a business asked for documents):

• You can contact the business that requested the documents, and you can contact us as described above. No account or registration is needed.
• When deleting, we: close an open case, delete the files we still hold, and replace your name and phone number in the cases with an "erased" marker. The case title is replaced with the same marker.
• We will also pass the request to the business that opened the case, because it is the controller of the data. For a case not yet delivered to the business, we coordinate with the business before deleting.
• What deletion on our side does not cover: copies already delivered to the business and held by it (contact the business); backups and email copies, which are deleted on their own under section 9; the copy at Meta, up to 30 days according to its documentation; and audit-log records, which cannot be deleted (see below).

If you are a business customer or a business representative: on request we will delete the business's details, its representatives, delivery addresses and cases. We handle such a request manually, subject to record-keeping duties under the law (for example for tax purposes), and except the audit log. A business that asks for deletion thereby ends its use of the service.

A note about the audit log: the log is built so that records cannot be changed or deleted, so that no one, including us, can hide an action. So even after deletion it keeps records of actions taken, such as a case number and the deletion action itself. We use the log for no purpose other than security and oversight.

Stopping messages: you can stop replying or block the number in WhatsApp. If you do not want us to contact you again, email us.

Complaints: if you believe we did not handle your request properly, you can complain to the Privacy Protection Authority at the Israeli Ministry of Justice.

13. Marketing messages

We do not send advertising to fillers. To business customers and registrants we send service-related emails: onboarding documents, address confirmation, deliveries and payment reminders. If we ever send advertising, we will do so only as section 30A of the Communications (Telecommunications and Broadcasting) Law allows, meaning with prior consent and a way to unsubscribe.

14. Minors

The service is for businesses and adults acting on their behalf, and is not directed at minors. We do not knowingly collect data about minors. A business customer must not request documents from a minor through the service without a legal basis and lawful consent.

15. Cookies, tracking and analytics

doc-chief.com sets no cookies and uses no analytics, social-media pixels or advertising tools. The website's fonts are served from our own server, so loading the page does not send your IP address to a third party.

16. Responsibilities of the business customer towards fillers

A business that uses Doc Chief undertakes several things in the Terms of Service (section 5 there), including:

• It has a legal basis to request the documents, and requests only what is necessary.
• It has given the filler the notice required by section 11 of the Protection of Privacy Law: why the data is collected, who will receive it, and whether providing it is mandatory.
• The filler agreed in advance to receive WhatsApp messages from it through Doc Chief, before the business opens a case for them.
• It handles fillers' privacy requests as the controller of the data.

17. Changes to this policy

We may update this policy. The current version is published on this page with a version number and date, and the update log at the end of the page records every change. We will notify business customers of a material change by email at least 14 days before it takes effect. A change required by law or for security reasons may take effect sooner.

18. Governing law and jurisdiction

This policy is governed by the laws of the State of Israel. The competent courts of the Haifa district have exclusive jurisdiction.

19. Language

This policy is published in Hebrew and English. If the two versions conflict, the Hebrew version prevails.

20. Update log