BektavבכתבBektav — Privacy Policy
Bektav and tScribe are two names of the same Service, provided by the same company from the same systems: an account made under either name is one account, kept in one database and managed by the same administrators; this document applies to both.
Last updated: 4 November 2026
This policy explains how NEXUS IT SOLUTIONS, of Hillel Yaffe 44, Hadera, Israel ("we") handles personal information in connection with Bektav (the "Service") and its website. Contact: [email protected].
1. Two roles
- Content — the recordings, chats, pictures, transcripts, translations, voice prints, details of people and everything else an organization uploads or creates in the Service — is controlled by the customer organization. For Content we act only as the organization's processor, under our Data Processing Agreement (DPA). If you are a person who appears in a recording or a chat, please contact the organization that uploaded it; we will help it answer you.
- Account, billing and website data — described in section 2 — is handled by us as the controller (in Israeli terms, the owner of the database).
2. What we collect as controller
| What | Examples | Why |
|---|---|---|
| Account data | organization name and code, users' names, e-mail, phone number, role, password (stored only as a scrypt hash) | to create and run accounts, sign-in and two-step sign-in, contact administrators, and to prevent one person or organization from opening several accounts |
| Sign-in and security data | sessions: IP address, device/browser, times; trusted-browser tokens; support-visit records | to secure the Service, detect abuse, show administrators who signed in |
| Usage data | minutes transcribed, pictures read, text translated, storage, project change log | to apply plan limits, bill, operate and support the Service |
| Billing data | billing contact, invoices/receipts, payment records | to charge and to meet tax and accounting law |
| Correspondence | e-mails to support, sales or privacy | to answer you |
| Website | the chosen language (in your browser, and a cookie site_lang so the site's plain address opens in it) | to show the site in your language |
We do not use advertising and we do not sell personal information. On our website (bektav.com - not in the Service itself) we use no advertising or third-party analytics and no cookies of our own, except one that remembers the language you chose. We also count visits to our website and the use of the Service ourselves, without cookies: the page visited, the referring site and campaign, the browser's language and the kind of device. A visitor is told apart only within one day, by a one-way hash of the network address and the browser made with a random value that is discarded the next day; the network address itself is not stored. These counts are kept for up to about 13 months. We may also use Google Search Console, which tells us how our website appears in Google's search results (searches it was shown for, clicks, indexing) from Google's own search data; it adds no code or cookies to our pages.
3. Content and voice prints
To recognize a speaker again in new recordings, the Service computes a voice print (a numeric representation of a voice) for named speakers. Voice prints may be biometric information and highly sensitive under Israeli law. They are created only within the customer's organization, used only to suggest who is speaking in that organization's projects, and deleted with the project or the organization's library of people. Organizations decide whether to share voice prints across their projects, and are responsible for informing the people concerned and obtaining their consent where required.
We process Content only to provide the Service — to transcribe, identify speakers, read pictures, translate, store, show and export it for the organization's users — and do not use it to train models.
4. Where the data is
The Service, its database and files are hosted in Oracle Cloud Infrastructure, Jerusalem region (Israel). Data is encrypted in transit (HTTPS) and at rest (by the cloud provider's storage encryption).
5. Who receives data
| Recipient | What | Where |
|---|---|---|
| Oracle (Oracle Cloud Infrastructure, incl. Email Delivery) | hosting of all data; sending of service e-mails (address and message) | Israel (Jerusalem) |
| BulkSMS (Celerity Systems (Pty) Ltd, South Africa) | phone number and sign-in code, for two-step sign-in | European Union (Ireland) |
| Microsoft (Microsoft 365) | our own e-mail correspondence with customers | Microsoft data centres, as set by Microsoft's data residency terms |
| Cloudflare, Inc. | all traffic to the website and the Service passes through its network (network address, request, for delivery and protection against attacks); its Turnstile check on the registration, sign-in and password forms reads technical signals of the browser to tell people from robots; it does not store Content | its global network |
| Paddle (Paddle.com Market Ltd, our merchant of record) | for paid plans: the billing contact, organization, country, payment details and invoices - Paddle sells the subscription to you and handles payment, tax and invoicing | United Kingdom / European Union |
| Anthropic PBC (Claude) | only after an admin of the organization consents to AI translation in the Service, for its users (the consent is recorded, and can be withdrawn): the text of the lines being translated with nearby lines, their time, source and speaker names, and existing translations. Audio and pictures are never sent. Under Anthropic's commercial terms, data sent through its API is not used to train its models. | United States |
| Authorities | only where required by law or a court order | — |
Speech recognition, speaker identification, reading pictures and the built-in translation run on our servers in Israel; no Content is sent elsewhere for them.
Where data is transferred outside Israel, we do so in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
6. Who at Bektav sees Content
Only our staff who provide support, and only when needed to provide support or required by law. Every support visit to an organization is recorded and shown to its administrators.
7. How long we keep data
- Content — until the organization deletes it or closes its account. A closed organization's data is deleted at once, and from automatic database backups within 3 days — unless the organization asked for it to be archived: then it is kept, out of use, for the retention period the organization chose (7 years unless agreed otherwise), and deleted when that period ends. A project an organization archives is deleted 30 days later unless it is brought back.
- Account data — while the account exists, then deleted with it, except what we must keep by law.
- Sign-in sessions — expire after 30 days or when idle for the period the organization sets; trusted-browser marks after 30 days.
- Billing records — for the period required by tax law (generally 7 years).
- Correspondence — up to 3 years after it ends.
8. Security
HTTPS only; passwords stored as scrypt hashes; optional or mandatory two-step sign-in by SMS; password rules and expiry; sign-out when idle; access by role and project membership; separate storage per organization and per project; a project change log; logged support visits; daily database backups; project backups encrypted with the user's passphrase (age format). No system is perfectly secure; if a security incident affects your data we will notify as the law requires.
9. Your rights
Under the Israeli Protection of Privacy Law you may ask to see the personal information we hold about you and to correct or delete it. If you are an EU/EEA or UK resident, the GDPR may also give you rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. (Israel is recognized by the European Commission as providing an adequate level of protection.)
- A user of an organization should first turn to its administrator.
- A person appearing in Content should turn to the organization that uploaded it.
- For account data held by us: [email protected]. We answer within 30 days.
You may also complain to the Israeli Privacy Protection Authority.
10. Children
The Service is for organizations and is not directed at children. Content may include minors' voices or images only where the organization has a lawful basis for it.
11. Changes
We will publish changes on the site and notify organizations' administrators in advance of material changes.