Privacy policy

Last updated 23 August 2026. This policy covers Lisa, the WhatsApp assistant operated by 3Peaks ("we"). Contact: almog@3peaks.dev.

What we collect

• Your WhatsApp phone number, which is your identity in Lisa. We only talk to numbers we have explicitly onboarded.
• The messages you send Lisa (text, voice notes, images and documents) and her replies. Voice notes are transcribed by a speech-to-text provider (Soniox) and the transcript is what Lisa reads. Files you send are stored privately so Lisa can refer back to them; only you can open them, from a browser signed in as you. Signing in is a one-time link Lisa sends to your own WhatsApp, and you can end every session from any device by asking her to sign you out everywhere.
• What you ask Lisa to remember: lists, notes, preferences, reminders, and the things she learns about you in conversation.
• Location, only if you set up location sharing from your phone yourself; it is used to answer questions like "where was I" and to notice arrivals at places you named.

Google user data

If you connect your Google account, Lisa requests the Google Calendar scope (https://www.googleapis.com/auth/calendar). We use it solely to read your calendars and events and to create, update or delete events in your own calendars, when you ask Lisa to in conversation. Event data is fetched at the time of your request to answer it; Lisa may keep a short note of what she did (for example "added dentist, Tuesday 9:00") in her memory for you. We do not store copies of your calendar, and we never read Gmail, Contacts, Drive or any other Google service under this grant.

Access tokens are held by Vercel Connect, our OAuth broker, and are never shown to you, to Lisa's language model, or to us in plain text. You can revoke access at any time at myaccount.google.com/permissions; revoking stops all calendar access immediately.

Limited Use disclosure. Lisa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, do not use it to train generalized AI or machine-learning models, and do not let humans read it except with your explicit consent for support, for security, or as required by law.

How your data is used

Only to provide Lisa to you: to understand and answer your messages, to keep the memory you asked her to keep, and to run the reminders you set. Messages and memory are processed by a language model through Vercel's AI Gateway. Our providers (Vercel, Neon for the database, Periskope for the WhatsApp connection, Soniox for transcription, the model provider) process data on our behalf under their own terms and do not use it for their own purposes.

Sharing

We do not sell or share your data with third parties for their own use. Your data is visible to you, to Lisa when she answers you, and to our operators only when needed to keep the service running or when you ask for help.

Retention and deletion

We keep your data for as long as you use Lisa. Write to almog@3peaks.dev from your registered number or email to have everything about you deleted; we delete within 30 days, including stored files and transcripts, and revoke any connected Google grant.

Security

Data is stored in the EU (Frankfurt) with encryption in transit and at rest. Files are private by default and require phone verification to open. Secrets are never written into the conversation.

Changes

We will update this page when the policy changes and note the date at the top.