This policy explains how MLAIA collects, uses and protects your personal data, in compliance with the Israeli Privacy Protection Law (Amendment 13, effective August 2025) and applicable regulations.
We added the section Chat assistant and live demo. It describes the AI chat on this site and on ultrabot.ai, the voice demo at talk.mlaia.com, and the services they use: Amazon Web Services and Amazon Bedrock, Cloudflare Turnstile, ElevenLabs and Simli. We also describe Ultrabot's WhatsApp bot, which uses Meta's WhatsApp Business Platform.
What changed on 7 October 2026
We corrected this policy to describe the services the site actually uses. Analytics are provided by Google Analytics, only with your consent, not by Cloudflare, which we do not use. We also added Formspree, which operates the contact form, and Microsoft 365, which hosts our email. We have not started collecting or sharing any new data.
1. Introduction — Who We Are
MLAIA (mlaia.com) is an AI and data science consulting firm operating under Israeli law. As the operator of this website, MLAIA is the data controller (בעל מאגר המידע) responsible for all personal data collected through this site.
We collect only data that you actively provide or that is generated automatically when you use the site. We do not collect sensitive personal data (health, financial, biometric) through this website.
Data Type
Examples
Source
Contact details
Full name, email address, phone number (if provided)
Contact form submission
Message content
The text of your inquiry or message
Contact form submission
Technical / device data
IP address, browser type and version, operating system, device type, screen resolution
Automatically via analytics / server logs
Usage data
Pages visited, time on page, referral source, links clicked, general geographic region (country level)
Automatically via Google Analytics, only if you accept analytics cookies
Cookie preferences
Your response to our cookie consent banner; language preference
Stored locally in your browser
3. Purposes of Data Collection
We use your data only for the specific purposes listed below:
Responding to inquiries: to read, process and reply to messages submitted via the contact form.
Providing services: to deliver AI consulting, data science or related professional services to clients who have engaged MLAIA.
Analytics and website improvement: to understand how visitors use the site, identify errors and improve user experience.
Legal compliance: to meet obligations under Israeli law, including maintaining records where required.
Marketing communications: we do not currently send marketing emails. Should this change in the future, we will obtain your explicit consent beforehand.
4. AI Usage Disclosure
MLAIA is an AI consulting company and uses AI tools in our professional work. The following disclosures apply to how AI may interact with personal data in the context of this website and our services:
Website contact form: messages submitted via the contact form are not automatically processed by AI. They are read and responded to by a human.
Chat assistant: the "Ask us" chat on this site answers with AI. See Chat assistant and live demo below.
WhatsApp: Ultrabot's WhatsApp bot also answers with AI. See Chat assistant and live demo below.
Consulting engagements: where MLAIA uses AI tools (such as large language models or automated data analysis tools) to process client data as part of a consulting project, this is governed by a separate written agreement with the client, which specifies the tools used, purposes and safeguards.
No automated individual decision-making: we do not make automated decisions that produce legal or similarly significant effects about individuals based on data collected through this website.
Chat assistant and live demo
Pages on this site show an "Ask us" chat assistant, which MLAIA builds as Ultrabot. This section also covers the chat on ultrabot.ai and the live demo at talk.mlaia.com. Answers are written by AI and can be wrong. Please do not type personal, medical or confidential information into the chat.
Where your messages go: the text you type is sent to MLAIA's demo server on Amazon Web Services, in the eu-central-1 region (Frankfurt, Germany).
How answers are written: by Anthropic's Claude models, accessed through Amazon Bedrock with inference in the EU. Bedrock invocation logging is turned off, and Amazon Bedrock does not use prompts to train models.
Search: to find the relevant parts of our site content, the chat uses Cohere embedding models on Amazon Bedrock, also in eu-central-1.
Bot protection: Cloudflare Turnstile runs a check inside the chat window to tell people from automated bots. Like other bot checks, it processes technical information from your browser, such as your IP address.
Storage: we do not log or store conversations. A conversation is kept in memory only for the open session, at most 10 minutes, and is then discarded. Server logs record counts only, such as how many messages were sent, which avatar was chosen and how many answers were spoken, never what was said, and are kept for 14 days.
Cookies: the chat sets no cookies on the site you are visiting. The demo page at talk.mlaia.com remembers only which avatar you picked, in your browser's local storage.
Analytics: if you accepted analytics cookies, Google Analytics receives two events, chat_open and chat_message_sent. They record that the chat was opened or that a message was sent, never what was written.
Voice demo: the live voice demo at talk.mlaia.com also sends what you say to ElevenLabs, to turn your speech into text, and sends the assistant's reply text to ElevenLabs, to turn it into speech. The recorded audio is used only for transcription and is then discarded; we never save it. See ElevenLabs' privacy policy.
Video avatar: if you choose the lifelike video avatar on the demo, the assistant's spoken reply is also sent to Simli, with a short-lived session token, to animate the face. See Simli's privacy policy.
WhatsApp: messages you send to Ultrabot's WhatsApp number pass through Meta's WhatsApp Business Platform (Cloud API), which Meta processes under its own terms. From there they go to the same demo server and Claude models described above. Meta may keep message content for a period under its own terms.
What we keep from WhatsApp chats: the recent messages of a chat are kept in memory only and deleted 10 minutes after your last message. We never store or log message text, and nothing is written to disk or a database. To limit how many messages each number can send, the server keeps a scrambled (hashed) form of your number in memory, dropped after 24 hours without messages. Logs record counts only.
Talking to a person: if you ask for a person, or the bot can't answer, Yochai gets a WhatsApp alert with your WhatsApp name, your number and a one-line topic written by the bot. He replies to you from 052-484-6282. The alert stays in his WhatsApp like any other message.
Text only: voice notes, images and other media are not processed; the bot replies that it handles text only.
5. Legal Basis for Processing
Under Israeli law (Privacy Protection Law 5741-1981, as amended by Amendment 13), we process personal data on the following legal bases:
Consent (סעיף הסכמה): for optional analytics cookies and any future marketing communications. You may withdraw consent at any time.
Legitimate interest (אינטרס לגיטימי): for retaining contact form messages to facilitate follow-up, and for the technical server logs our hosting provider keeps to operate and secure the site. Website analytics run only with your consent (see above).
Contractual necessity (הכרח חוזי): for processing contact form submissions when you request information about our services, and for delivering consulting services under a client agreement.
Legal obligation (חובה חוקית): to comply with obligations under Israeli law, including tax records and regulatory requirements.
6. Data Sharing with Third Parties
We do not sell, rent or trade your personal data. We share data only with the following service providers, strictly as necessary to operate this website:
GitHub Pages (Microsoft Corporation): hosts the static files of this website. Your browser connects to GitHub's servers when you load the site. GitHub may process your IP address in its server logs. See GitHub's Privacy Statement.
Google LLC (Google Analytics): if you accept analytics cookies, Google Analytics 4 collects usage data such as pages visited, time on page, referral source, approximate location (country and city level), and device and browser type. It uses cookies to recognise returning browsers. Google acts as our service provider for this data; according to Google, Google Analytics 4 does not log or store IP addresses. Google Signals and advertising features are not enabled. See Google's Privacy Policy.
Formspree, Inc.: operates the contact form on this site. When you send an inquiry, Formspree processes the details you enter (name, company, email and message, plus the page you sent it from) and forwards them to our email. Submissions are also stored in our Formspree account. See Formspree's Privacy Policy.
Microsoft Corporation (Microsoft 365): hosts our business email. Inquiries forwarded from the contact form, and emails you send us directly, are stored in our Microsoft 365 mailbox. See Microsoft's Privacy Statement.
Google LLC (Google Fonts): typography fonts used on this site are loaded from Google's servers. Google may collect your IP address and browser information in accordance with its privacy policy. We use this service solely to display fonts; no personal data is intentionally transmitted.
No other third parties receive your personal data from this website. We do not use social media trackers, advertising networks or advertising cookies.
Chat assistant and live demo: Amazon Web Services (hosting, and Amazon Bedrock, which runs the Anthropic Claude and Cohere models), Cloudflare (the Turnstile bot check) and, for the voice demo only, ElevenLabs and, for the video avatar, Simli. See Chat assistant and live demo.
Ultrabot on WhatsApp: Meta (the WhatsApp Business Platform), which carries the messages between you and our demo server. See Chat assistant and live demo.
7. International Data Transfers
Some of the service providers listed above store or process data on servers located outside Israel, including in the United States and other countries. This means your personal data may be transferred internationally:
GitHub Pages: servers primarily in the United States (Microsoft Azure infrastructure).
Google Analytics: servers operated by Google LLC, primarily in the United States.
Formspree: a United States company; submissions may be processed and stored in the United States.
Microsoft 365: Microsoft data centres in the region set for our Microsoft 365 account, which may be outside Israel.
Google Fonts: servers operated by Google LLC, primarily in the United States.
Chat assistant: Amazon Web Services and Amazon Bedrock in the EU (eu-central-1, Frankfurt). Cloudflare and, for the voice demo, ElevenLabs and Simli may process data outside Israel and the EU.
WhatsApp: Meta may process WhatsApp messages outside Israel and the EU, under its own terms.
Where personal data is transferred to countries not recognised as providing an adequate level of protection under Israeli law, we rely on the contractual and technical safeguards implemented by each provider (e.g., Standard Contractual Clauses, SOC 2 compliance, EU-US Data Privacy Framework participation). You may contact us for further details about these safeguards.
8. Data Retention Periods
We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law.
Data Type
Retention Period
Reason
Contact form submissions (name, email, phone, message)
Up to 3 years from the date of submission, or until the end of any resulting business relationship, whichever is later
Legitimate interest in maintaining communication records; potential contract performance
Analytics data (browser, device, approximate location, usage)
Google Analytics keeps event-level data for 14 months, the period set in our account; after that only aggregated reports remain. Analytics cookies expire after up to 2 years, or sooner if you clear them.
Your consent to analytics cookies
Cookie consent and language preferences
Stored in your browser until you clear your cookies or browser data
Essential site functionality and legal consent record
Client service data (consulting projects)
As specified in the client agreement, or 7 years after project completion where required for tax / accounting records under Israeli law
Not stored. A conversation is held in server memory only for the open session, at most 10 minutes. Recorded voice audio is discarded after transcription. Server logs hold counts only, for 14 days.
Operating the chat and monitoring that the service works
WhatsApp chats with Ultrabot
Message text is not stored by us. Recent messages are held in server memory and deleted 10 minutes after your last message; a hashed form of your number is kept in memory for rate limits and dropped after 24 hours without messages. Handover alerts stay in Yochai's WhatsApp. Meta keeps messages under its own terms.
Operating the WhatsApp bot, limiting abuse, and replying when you ask for a person
9. Your Rights Under Amendment 13
The Israeli Privacy Protection Law (Amendment 13, effective August 2025) grants you the following rights regarding your personal data. These rights apply to data we hold about you as a data subject:
👁
Right of Access
Request a copy of the personal data we hold about you, including the purposes of processing and the categories of data involved.
✏️
Right of Correction
Request correction of inaccurate, incomplete or outdated personal data we hold about you.
🗑
Right of Deletion
Request deletion of your personal data where there is no overriding legal obligation or legitimate purpose to retain it.
📦
Right of Portability
Receive your personal data in a structured, commonly used, machine-readable format, where technically feasible.
🚫
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
⏹️
Right to Restrict Processing
Request that we limit how we use your personal data in certain circumstances (e.g., while accuracy is contested or during an objection).
🔰
Right to Object
Object to processing of your personal data where we rely on legitimate interest as the legal basis, including for direct marketing purposes.
⚖️
Right to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with the Israeli Privacy Protection Authority (PPA — רשות הגנת הפרטיות).
10. How to Exercise Your Rights
To exercise any of the rights listed above, please contact us in writing using the details below. We respond to all verified requests within 30 days as required by the Israeli Privacy Protection Law.
Privacy requests: yochai@mlaia.com — Please include 'Privacy Request' in the subject line and describe the right you wish to exercise. We may ask for reasonable proof of identity to protect your data and prevent unauthorised access. We will acknowledge receipt within 5 business days and provide a substantive response within 30 days. If we need more time (up to 60 days for complex requests), we will inform you within the initial 30-day period.
There is no charge for making a request. However, if a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or refuse to act, and will explain our reasons in writing.
11. Cookie Policy
Cookies are small text files placed on your device when you visit a website. This site uses the following categories of cookies:
Category
Purpose
Can be declined?
Essential / Functional
Remembering your language preference (Hebrew/English) and your cookie consent choice. Required for the site to function correctly.
No — these are strictly necessary
Analytics
Google Analytics 4 sets the cookies _ga and _ga_1T3R1HL53V to distinguish visitors and visits, and collects page views, referrers, approximate location and device type. They are set only after you accept analytics, and expire after up to 2 years.
Yes — via the cookie banner, or the 'Change cookie preferences' button below
Marketing / Advertising
Not used. We do not place any advertising or behavioural tracking cookies.
N/A
You can manage, block or delete cookies at any time through your browser settings. Please note that disabling essential cookies may affect the functionality of the site. For instructions on managing cookies in your browser, visit your browser's help documentation.
12. Security Measures
We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These measures include:
HTTPS encryption: all data transmitted between your browser and this site is encrypted using TLS (Transport Layer Security).
Static site hosting: this website is a static site with no server-side database, minimising the attack surface for data breaches.
Access controls: access to any personal data received via the contact form is limited to authorised personnel only.
Third-party security: we rely on established, industry-standard providers (GitHub, Google, Formspree, Microsoft) that maintain their own comprehensive security programmes.
No method of internet transmission or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach that poses a significant risk to your rights, we will notify you and the Israeli Privacy Protection Authority as required by law.
13. Children's Privacy
This website is not directed at, and is not intended for use by, children under the age of 18. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at yochai@mlaia.com and we will take prompt steps to delete that information.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make changes:
Minor updates (e.g., clarifications, formatting): we will update the 'Last Updated' date at the top of this page. Continued use of the site after the update constitutes acceptance of the revised policy.
Material changes (e.g., new purposes of processing, new third-party sharing): we will display a prominent notice on the website homepage for at least 30 days before the change takes effect, and where we hold your email address, we will notify you directly.
We encourage you to review this policy periodically. The effective date at the top of this page indicates when the current version was last revised.
15. Contact Information
For any privacy-related questions, requests, or concerns, please contact us:
Company: MLAIA
Privacy Officer / CEO: Yochai Edlitz
Email: yochai@mlaia.com (preferred channel for privacy requests)
Company registration (ח.פ.): 516808078
Physical address: Shenef 4, Yavne, Israel 8151139
If you are not satisfied with our response, you have the right to lodge a complaint with the Israeli Privacy Protection Authority (PPA):