Privacy Policy

AYYEKA TECHNOLOGIES - Privacy Policy

Version: 2.7 | Last updated: July 2026

This privacy policy explains how "AYYEKA TECHNOLOGIES" (the "Company") handles your personal information and data. It applies to all services offered by the Company and any affiliated entity, including but not limited to the Company's website at https://www.ayyeka.com, the FAI platform (FAI Cloud, FAI Local and FAI Lite), and any other application of ours that links to this privacy policy ("Services").

This privacy policy describes our policies and procedures on the collection, use and disclosure of your information when you use the Services, and tells you about your privacy rights and how the law protects you.

The terms "we," "our" and "us" mean the Company. The terms "you" and "your" refer to all users of the Services. The legal bases we rely on for each type of processing are set out in the Legal Bases for Processing section below. Where we rely on your consent, we ask for it separately, and you can withdraw it at any time.

OUR ROLE - CONTROLLER AND PROCESSOR

Our role under data protection law depends on the data in question.

We act as a processor on behalf of our customers for data originating from devices and sensors deployed at customer sites, and for the account and site records our customers maintain in the FAI platform. Our customer determines the purposes of that processing. We process it in accordance with our agreement with that customer, including the applicable data processing addendum.

We act as a controller for data we process for our own purposes. This includes our website, our support and sales communications, our own account administration, and the product analytics described below.

Some information can fall into both categories depending on why we are using it. For example, your FAI user identifier is part of the account records we hold as a processor for your organisation, and it is also used as an identifier in our own product analytics, where we act as controller. In each case the role that applies is the one attached to the purpose described in this policy.

Where we act as a processor, requests to access, correct or delete data should normally be directed to the customer organisation that operates the account. We will assist that organisation as required by our agreement with them.

Where our written agreement with your organisation allocates these roles differently, that agreement governs.

INFORMATION WE COLLECT

The information we receive and collect depends in part on what you do when you use our Services, and falls generally into two categories: information you or your employer submit, and information collected automatically when you access or use our Services.

Personal Data

Some of the information submitted to use the Services is personal information. Personal information means data that identifies you. Such personal data may include:

Contact information: name, email address, telephone number, business address
Business administrative information: job title, employee or user identifier, organisation, physical work location
Account information: username, authentication credentials, role and permission assignments within the FAI platform
Support and correspondence records: the content of tickets, emails and other communications you send us, and our responses

Where we obtain your information

Where your organisation is our customer, we usually receive your name, work email address, role and similar account details from that organisation rather than from you directly, because the organisation creates and administers FAI accounts for its own users. We also receive information directly from you when you contact us, submit a form on our website, or use the Services.

Whether you have to provide information

The contact and account information described above is necessary for us to give you access to the FAI platform. If it is not provided, an account cannot be created. Providing your telephone number is optional, and is needed only if you want to receive operational SMS notifications. Consenting to product analytics is entirely optional and has no effect on your access to the Services.

IoT Device and Field Sensor Data

As part of our core Services, the Company operates the Wavelet industrial telemetry device family and the FAI (Field Assets Intelligence) platform. In the course of providing these Services we collect and process data originating from IoT devices and field sensors deployed at customer sites. This may include:

Sensor readings and measurements, for example water level, flow rate, pressure, temperature
Device identifiers and configuration data
Site identifiers and location metadata associated with deployed devices
Event and alert data generated by field assets
Timestamps and sampling frequency data
Still images captured by camera-equipped field devices, where the customer has deployed them

This data is collected for the purpose of providing operational monitoring, alerting and operational analytics to our customers. Where such data is associated with an identifiable individual, for example a site contact linked to a device, it is treated as personal data and handled in accordance with this policy. We process this category of data as a processor on behalf of the customer that operates the account.

Site imagery. Where a customer deploys a camera-equipped device, still images of the monitored asset are captured and made available in the FAI platform, and can be downloaded by the customer. The camera is owned, installed, positioned and configured by the customer, and the customer determines what falls within the field of view. We act as a processor for this imagery on behalf of that customer.

Because these devices are aimed at infrastructure assets that are sometimes located in publicly accessible places, an image may incidentally include a person who happens to be present. We do not use imagery to identify, recognise or track individuals, and we do not apply facial recognition or any other biometric processing to it. If you believe an image of you has been captured, contact the organisation that operates the site, or contact us and we will direct your request to them.

Where the platform displays your sites on a map, or shows weather information over that map, the coordinates of the area being viewed are sent to our mapping and weather providers so that the imagery can be retrieved. This is necessary to display the map you have opened. We act as a processor for this, on behalf of the customer that operates the account.

This is distinct from the product analytics described further below, which concerns how the FAI user interface is used and does not include sensor readings or measurement data.

Usage Data

We automatically collect certain information when you visit or use the Services. This information may include your Internet Protocol (IP) address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, and information about how and when you use our Services.

This information is primarily needed to maintain the security and operation of our Services, and for internal reporting purposes.

Information Collected During Email Communications

When you send an email or other electronic communication to us, you are communicating with us electronically and consent to receive reply communications from us electronically. We may retain the content of the communication, your email address or other identifier, and our response, in order to service your request or for legal and regulatory reasons.

TRACKING TECHNOLOGIES, COOKIES AND BROWSER STORAGE

We use cookies and similar browser storage technologies, including local storage, in both our website and the FAI platform. Not all of these serve the same purpose, and not all of them require your consent.

Strictly necessary

These are required for the Services to function - for example to sign you in, keep your session secure, protect against cross-site request forgery, and identify which account you are viewing. They cannot be switched off, and they do not require consent because the Services cannot be provided without them. Blocking them in your browser will prevent you from signing in.

Optional - product analytics and in-product announcements

Product analytics is optional, is switched off by default, and is used only if you give consent. Nothing is loaded from our analytics provider and no analytics data is collected unless you accept it. See the Product Analytics section below for what it collects.

We also show release notes and product announcements inside the FAI platform using a third-party service. That service sets its own storage in your browser and is treated as optional in the same way. See In-product Announcements below.

Cookies and storage used in the FAI platform

Name	Type	Purpose	Expiry	Consent required
`__RequestVerificationToken`	Cookie	Protects against cross-site request forgery	Session	No
`AK-Access-Token`	Cookie	Authenticates your session	Up to 24 hours	No
`AK-Refresh-Token`	Cookie	Renews your session without requiring you to sign in again	Up to 24 hours	No
`AK-Context-Token`	Cookie	Identifies which account you are currently viewing	Up to 24 hours	No
`AK-Login-With-Password`	Cookie	Stores your email address so the correct sign-in screen is shown when you return	Up to 24 hours	No
`ak_consent`	Cookie	Records your analytics choice and the version of this policy it was given against	12 months	No - required to honour your choice
`lastAccount`	Local storage	Remembers the account you last viewed	Until cleared	No
`ph_*`	Cookie and local storage	Product analytics. Created only if you consent	12 months for the cookie. Local storage entries remain until you withdraw consent or clear them	Yes
`_BEAMER_*`	Cookie and local storage	In-product announcements. Records which announcements you have already seen and how you interact with the announcements panel. Created only if you consent	Until you withdraw consent or clear them	Yes

Cookies and technologies used on our website

Our website at www.ayyeka.com uses:

Cloudflare, used by HubSpot to serve our website, for security, bot protection and content delivery. Cloudflare sets short-lived cookies, for example __cf_bm and _cfuvid, used to distinguish automated traffic from human visitors. These are treated as strictly necessary.
HubSpot (portal 20038431), for marketing, forms and customer relationship management. HubSpot may set cookies used to recognise returning visitors and to measure website engagement.
Google (Google LLC), for website analytics and advertising measurement. Google Analytics sets cookies such as _ga, _gid and _gat to measure how the website is used. Google advertising services set cookies such as _gcl_au, and a test_cookie on doubleclick.net, used for advertising measurement and retargeting. These are set only where you consent.
LinkedIn, for advertising measurement and retargeting. The LinkedIn Insight Tag sets cookies such as bcookie, lidc and li_sugr. These are set only where you consent.

Our website loads content and services from these third parties. When a page loads, those providers receive your IP address and browser information, which is technically necessary for them to deliver the content and protect the site. Cookies and similar storage that are not strictly necessary are set only where you consent through the notice shown on the website.

You can accept or decline non-essential cookies using the notice shown on the website, and you can change your choice at any time.

How to manage your choices

In the FAI platform: open Cookie settings from the help menu. You can change or withdraw your analytics consent at any time. Withdrawing consent is as easy as giving it.
On our website: use the consent notice, or reopen it from the link in the site footer.
In your browser: most browsers let you block or delete cookies. Blocking strictly necessary cookies will prevent you from signing in to the FAI platform.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

PRODUCT ANALYTICS

We use product analytics in the FAI platform to understand which features are used and how, so that we can improve them. This processing is carried out by us as controller, for our own product development purposes.

Legal basis: your consent, under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive, and the corresponding provisions of the Israeli Privacy Protection Law. Product analytics is switched off unless you accept it. Declining has no effect on your access to the platform or on any feature available to you, and you can change your mind at any time.

Where your organisation operates FAI Local on its own infrastructure, product analytics is active only if that deployment has been configured to enable it.

Service provider: PostHog, Inc., which processes this data on our behalf as a sub-processor under a data processing agreement. PostHog's infrastructure is located in the United States. See International Data Transfers below.

What we collect if you consent:

Which pages and features of the FAI interface you open, and in what order
Interactions with interface elements, such as which controls you use
Your FAI user identifier, so that activity can be grouped into sessions and distinguished between users
The organisation whose FAI account you are using, so that usage can be understood at an account level
Technical information about your browser, operating system and screen size
Your IP address, from which an approximate geographic region is derived

What we do not collect through product analytics:

Sensor readings, measurements, or any data reported by devices at your sites
Site names, asset names or site location data. Product analytics is configured not to record the text of the interface elements you interact with, and page addresses are reduced to a generic form before they are sent, so that names configured in your account are not included
Your name, email address or telephone number
The contents of fields or forms you fill in
Session recordings or video replays of your screen. Session recording is disabled

Retention: product analytics data is retained for no longer than 12 months, after which it is deleted or aggregated.

Withdrawing consent: open Cookie settings from the help menu in FAI at any time. If you withdraw consent, collection stops and the analytics identifier stored in your browser is cleared. Data already collected is held for the retention period above unless you ask us to erase it.

Automated decision-making: product analytics is not used to make automated decisions about you, and is not used for advertising or profiling.

IN-PRODUCT ANNOUNCEMENTS

We use a third-party service, Beamer, to show release notes and product announcements inside the FAI platform, so that you can see what has changed. We act as controller for this processing.

Legal basis: your consent, under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive, and the corresponding provisions of the Israeli Privacy Protection Law. This service is not loaded unless you accept it, and declining has no effect on your access to the platform.

What it collects if you consent:

Which announcements you have viewed and which you have already dismissed
Your interactions with the announcements panel
A randomly generated identifier used to remember what you have seen
Your IP address, device and browser information, screen resolution, language, and an approximate geographic location

This service does not receive sensor readings, measurements, or any data reported by devices at your sites.

Withdrawing consent: open Cookie settings from the help menu in FAI at any time. If you withdraw consent, the service is no longer loaded and the identifier stored in your browser is cleared.

USE AND SHARING OF YOUR PERSONAL DATA

In addition to the uses described elsewhere in this policy, we may use and share your information, including personal information, as follows:

To provide and maintain the Services, including monitoring their operation
To manage and respond to your requests
In response to judicial or governmental subpoenas, warrants and court orders served on us in accordance with their terms, or as otherwise required by applicable law
To operate cloud-based infrastructure supporting the Services
To comply with legal, regulatory or administrative requirements of governmental authorities
To protect our rights or property, protect our legitimate business interests, enforce our terms or policies, in cases of fraud or disputes, or to prevent harm to you or others
With third parties that perform services on our behalf, such as cloud hosting, customer support, product analytics and platform operations. These third parties may be located in jurisdictions other than your own. See Sub-processors below
In the event of a corporate transaction, such as a merger, consolidation, asset sale, or sale of a substantial part of our business. In that event the acquiring entity will assume the rights and obligations described in this policy
To make aggregate data available for research or other purposes. Such data is aggregated so that individuals are no longer identifiable
To evaluate and improve our Services, products and your experience, where such use is consistent with the purposes described in this policy and applicable law
As permitted or required by law, or as authorised by you

We do not sell your personal data.

COMMUNICATIONS AND NOTIFICATIONS

We may use your telephone number to send operational SMS notifications related to your use of the Services, such as field asset alerts and system events. These messages are transactional and are not used for marketing. You may opt out at any time by removing your telephone number in the platform settings, or by contacting us at support@ayyeka.com.

LEGAL BASES FOR PROCESSING

We process personal data on the following grounds:

Processing activity	Legal basis
Providing the FAI platform and Wavelet Services to your organisation	Contractual necessity, Article 6(1)(b) - or the customer's own basis where we act as processor
Account administration, authentication and session security	Contractual necessity, Article 6(1)(b)
Security monitoring, logging and fraud prevention	Legitimate interests, Article 6(1)(f)
Responding to your support requests	Contractual necessity or legitimate interests
Operational SMS notifications	Contractual necessity, Article 6(1)(b)
Product analytics	Consent, Article 6(1)(a) and ePrivacy Article 5(3)
In-product announcements and release notes	Consent, Article 6(1)(a) and ePrivacy Article 5(3)
Non-essential website cookies and marketing communications	Consent, Article 6(1)(a)
Retaining records to meet legal, tax and regulatory obligations	Legal obligation, Article 6(1)(c)

Where we rely on legitimate interests, we have assessed that our interest does not override your interests, rights and freedoms. You may object to such processing - see Data Subject Rights.

SECURITY AND STORAGE

We are concerned about safeguarding the confidentiality of your information. We maintain an information security management system certified to ISO/IEC 27001, and we adhere to accepted industry security standards designed to protect non-public personal information collected by the Services against accidental or unauthorised use, access or disclosure.

We provide physical, electronic and procedural safeguards to protect the information we collect, process and maintain. Personal information resides in access-controlled systems that cannot be reached without authentication. Data in transit is protected using Transport Layer Security (TLS).

Please remember that no method of transmission or electronic storage is completely secure. While we use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

DATA BREACH NOTIFICATION

Where we act as controller, in the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR and the applicable requirements of the Israeli Privacy Protection Law.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, unless we have implemented technical and organisational measures that render the personal data unintelligible, or other conditions apply that permit us to delay or omit notification as allowed by law.

Where we act as a processor on behalf of a customer, we will notify that customer without undue delay in accordance with our agreement with them, and it is that customer who notifies the supervisory authority and affected individuals.

All data breaches are recorded in our internal breach register and assessed in accordance with our Incident Response Policy.

RETENTION PERIOD

Information collected from visitors to the website is kept only for the duration necessary to provide the requested service.

If your organisation becomes a customer, data will be retained for the duration of the customer relationship and for a period of 3 years thereafter, in order to identify issues and resolve any legal proceedings, unless a longer period is required to comply with a legal obligation or to establish, exercise or defend a legal claim.

Product analytics data is retained for no longer than 12 months.

Site imagery captured by camera-equipped field devices is retained for the period configured for the customer account, up to a maximum of 12 months, after which it is deleted. Where a customer has downloaded imagery to its own systems, retention of that copy is determined by the customer.

We retain aggregate information beyond these periods for research purposes and to improve our Services, in a form in which individuals are no longer identifiable. All information is held and ultimately destroyed in accordance with the Company's data retention policy.

The Company conducts regular reviews of the personal data we hold and will securely erase or anonymise data that is no longer necessary for the purposes for which it was collected.

INTERNATIONAL DATA TRANSFERS

In the course of providing our Services, personal data is stored and processed on servers located in the United States. Where your organisation operates FAI Local on its own infrastructure, the location of the data held in that deployment is determined by your organisation. Some personal data, including support and sales correspondence, is also processed in Israel, where the Company is established. This means personal data is transferred to and processed in countries outside your home country, including outside the European Economic Area (EEA).

We ensure such transfers comply with applicable data protection laws, including the GDPR and the Israeli Privacy Protection Law. Specifically:

Transfers from the EEA to the United States: we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Implementing Decision 2021/914) as the legal mechanism for the transfer.
Transfers from the EEA to Israel: Israel is recognised by the European Commission as providing an adequate level of data protection, so no additional transfer mechanism is required.
Transfers from Israel: we rely on Regulation 2(4) of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001. Each recipient is bound by a data processing agreement under which it undertakes to comply with the conditions applicable to a database in Israel, with the modifications required, and has given the written undertaking required by Regulation 3 that it applies sufficient measures to protect the privacy of data subjects and will not pass the data on to any other party.
Cloud infrastructure: Amazon Web Services, Inc. (AWS) acts as a processor on our behalf and is bound by the AWS Data Processing Addendum, which incorporates the applicable SCCs and other required safeguards.
Product analytics: PostHog, Inc. acts as a processor on our behalf, and its infrastructure is located in the United States. This transfer is governed by PostHog's data processing agreement, which incorporates the applicable SCCs. This transfer occurs only where you have consented to product analytics.
Marketing, CRM and support ticketing: HubSpot, Inc. processes website and marketing contact data, and the content of your support requests, on our behalf in the United States, under its data processing agreement, which incorporates the applicable SCCs.
Website analytics and advertising: Google LLC and LinkedIn process website analytics and advertising data in the United States, under the data processing terms that apply to our use of those services. These transfers occur only where you have consented to non-essential cookies.
Website security and delivery: our website is hosted on HubSpot's platform, which uses Cloudflare, Inc. for content delivery, bot protection and security. Cloudflare is engaged by HubSpot rather than by us, and the transfer is covered by HubSpot's data processing agreement and its obligations to us in respect of the sub-processors it engages.
In-product announcements: Beamer processes the data described in the In-product Announcements section on our behalf in the United States, under its data processing agreement, which incorporates the applicable SCCs. This transfer occurs only where you have consented.
Operational SMS notifications: we use a third-party SMS gateway to deliver these messages. Where that provider is located outside the EEA, the transfer is subject to appropriate safeguards under our agreement with it.
Maps, weather overlays and error monitoring: we use third-party providers to display maps and weather information in the FAI platform and to detect faults in it. Where such a provider is located outside the EEA, the transfer is subject to appropriate safeguards under our agreement with it.

We engage only sub-processors that provide sufficient guarantees to implement appropriate technical and organisational measures to protect your personal data. A copy of the applicable transfer mechanisms is available on request at support@ayyeka.com.

SUB-PROCESSORS

We engage trusted third-party service providers (sub-processors) to assist in delivering the Services. These sub-processors process personal data on our behalf and are contractually bound to handle it in accordance with this policy and applicable data protection law.

Sub-processor	Purpose	Location
Amazon Web Services, Inc.	Cloud infrastructure, hosting and data storage	United States
PostHog, Inc.	Product analytics for the FAI platform, where consented	United States
HubSpot, Inc.	Marketing, forms and customer relationship management for the website, and the support ticketing system used to receive and respond to your support requests	United States
Beamer	In-product announcements and release notes in the FAI platform, where consented	United States
SMS gateway provider	Delivery of operational SMS notifications	See note below
Mapping and weather overlay providers	Display of maps and weather information within the FAI platform	See note below
Error monitoring provider	Detecting and diagnosing faults in the FAI platform	See note below
Google LLC	Website analytics and advertising measurement, where consented	United States

The names and locations of the SMS gateway, mapping, weather overlay and error monitoring providers we use, and of any other sub-processor, are available on request at support@ayyeka.com. An up-to-date list of our sub-processors is available on the same request. We will provide notice of any intended changes to our sub-processors. Where required by applicable law or contract, we will provide direct notice to affected customers.

Our sub-processors engage their own sub-processors. In particular, HubSpot uses Cloudflare, Inc. for content delivery and security on the website. These onward engagements are governed by our agreements with the relevant sub-processor.

Advertising and social media partners. Where you consent to non-essential cookies, Google and LinkedIn receive information about your visit for advertising measurement and retargeting. For those advertising purposes these providers may act as controllers in their own right rather than solely on our behalf, and their own privacy notices apply to that processing.

DATA SUBJECT RIGHTS

Under the General Data Protection Regulation (GDPR), the Israeli Privacy Protection Law (5741-1981), and other applicable data protection legislation, you have a number of rights regarding your personal data. Subject to certain conditions, you have the right to:

Be provided with a copy of the personal data we hold about you (right of access)
Request the rectification or erasure of your personal data (right to rectification and right to erasure)
Request that we restrict the processing of your personal data (right to restriction)
Object to further processing of your personal data, including direct marketing (right to object)
Request that your personal data be transmitted to a third party (right to data portability)
Withdraw consent at any time where we rely on consent. For product analytics you can do this directly in the FAI platform under Cookie settings
Lodge a complaint with a supervisory authority (see Supervisory Authorities below)

You can exercise these rights by contacting us using the details in the Contact Us section. Where we process data as a processor on behalf of your organisation, we will direct your request to that organisation and assist them in responding.

PRIVACY OFFICER

The Company has appointed a Privacy Officer responsible for overseeing data protection matters in accordance with applicable privacy legislation, including the GDPR and the Israeli Privacy Protection Law.

If you have questions about how we handle your personal data, wish to exercise your rights, or have a privacy concern, you may contact our Privacy Officer at: Email: support@ayyeka.com

We respond to requests to exercise your rights within one month of receipt. Where a request is complex or where we have received a number of requests, we may extend this by up to two further months, and we will tell you within the first month if that is the case. Requests under the Israeli Privacy Protection Law are answered within the period that law prescribes.

SUPERVISORY AUTHORITIES

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the relevant supervisory authority:

Israel: the Israeli Privacy Protection Authority (PPA) - https://www.gov.il/en/departments/the_privacy_protection_authority
European Union: the supervisory authority in your EU member state of residence. A list is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

SAFETY OF MINORS

Our Services are not intended for and may not be used by minors. "Minors" are individuals under the age of majority in their place of residence. The Company does not knowingly collect personal data from minors or allow them to register. If it comes to our attention that we have collected personal data from a minor, we may delete this information without notice. If you believe this has occurred, please contact us using the details in the Contact Us section.

CHANGES TO OUR PRIVACY POLICY

We may make changes to this privacy policy from time to time. When we change the policy in a material way, a notice will be placed in our Services alongside the changed policy. The most recent version of this privacy policy is the one that applies. Where a change affects processing that relies on your consent, we will ask for your consent again before it takes effect.

CONTACT US

If you have questions or comments concerning this Privacy Policy, please contact us:

Email: support@ayyeka.com
Privacy Officer: support@ayyeka.com
Website: https://www.ayyeka.com
Address: HaShalom 10, Tel-Aviv, Israel