Privacy Policy

Melnicom Ltd. ("Company", "we", "us", "our"), an Israeli company registered under number 514130657 at 3 Habsamim Road, Ganey Tikva, Israel, operates the melnicom.co.il and melnicom.com websites and the Tlyck platform and all of its sites, including tlyck.com, robots.tlyck.com, focus.tlyck.com, pa.tlyck.com and coach.tlyck.com. This Privacy Policy applies to every one of those sites, to every Tlyck product offered through them, and to all SMS text messaging programs operated by Melnicom Ltd. (see section 3c). It explains what personal data we collect, how we use it, and your rights under Israeli privacy law and applicable international standards.

1. Data We Collect

2. How We Use Your Data

• Service delivery: provisioning your agent, routing AI requests, managing your token budget.
• Billing: processing payments and maintaining transaction records.
• Communication: sending sign-in codes, purchase receipts, and service notices.
• Safety and security: detecting abuse, fraud, and unauthorized access.
• Service improvement: aggregated, anonymized analytics to improve performance and features.

We do not sell your personal data to third parties. We do not use your data for advertising or profiling.

3. Data Sharing and Third Parties

We share limited data with the following service providers solely to operate the platform:

• Telegram — to operate your bot. Telegram's privacy policy applies to messages sent through Telegram.
• Google / Apple — if you choose OAuth sign-in. Their policies govern the OAuth exchange.
• Resend — to send transactional emails (sign-in codes, receipts).
• Paddle — to process payments. Paddle is the Merchant of Record for purchases made on our platform.
• AI model providers — your agent's messages are forwarded to AI providers to generate responses. We route these through our own proxy to minimize direct data exposure.
• Hosting infrastructure — Hetzner VPS (EU data center); data is stored and processed on servers operated by us.
• Meta (Facebook / Instagram) — when you connect an Instagram Business account, we use Meta's Graph API on your behalf. We store your Page Access Token and Instagram Business Account ID solely to execute automations you configure (e.g., reading post comments, sending Private Reply DMs). We do not share this data with any other party. You can revoke access at any time from your Meta Business settings or by deleting your agent.

We do not share your data with anyone else, and we never sell it. Mobile numbers and SMS consent records are excluded from all sharing, in every category above.

3c. SMS / Text Messaging

Melnicom Ltd operates the following SMS programs in the United States. Each program is separate: enrolling in one does not enrol you in another, and each has its own number and its own opt-in.

Consent. We only send you text messages after you have given express consent, in one of the ways described above, for that specific program. Consent is not a condition of purchase. We never enrol a number other than the one the subscriber provided for themselves, and we never use purchased, rented or third-party contact lists. The consent wording shown to you, and the time you accepted it, are stored with your record.

What we send. Messages are one-to-one and conversational: reminders, calendar and task updates, answers to questions you text in, and messages you explicitly ask your assistant to send on your behalf. Message frequency varies and depends on how you use the service. We do not send marketing or promotional text messages.

Costs. Message and data rates may apply. Your mobile carrier's standard rates apply to messages you send to us and receive from us. Carriers are not liable for delayed or undelivered messages.

Opting out and getting help. You can opt out at any time by replying STOP to any message from the program's number. We will send one confirmation message and then stop. Reply HELP for help, or contact us at support@tlyck.com. Opting out of one program does not opt you out of another; reply STOP to each number you wish to stop.

3a. Instagram / Meta Platform Data

When you connect an Instagram Business account to your Tlyck agent, we access and process the following data via the Meta Graph API:

• Post comments: We read comments on your Instagram Business posts to identify users who have expressed interest in content you offer. Comment text and commenter usernames are processed in-memory and are not stored in our database.
• Private Reply DMs: We send private direct messages on your behalf to users who commented on your posts, using Meta's official Private Replies API. Message content is provided by you or your agent configuration.
• Access tokens: Your Page Access Token is stored encrypted and is used exclusively to execute the automations you configure. It is never shared with third parties.
• Deletion: If you disconnect your Instagram account or delete your agent, all associated tokens and configuration are permanently deleted within 24 hours.

We use Instagram data only to provide the features you explicitly configure. We do not use Instagram data for advertising, profiling, or any purpose beyond your stated automation goals. Our use of Meta Platform data complies with the Meta Platform Terms.

3b. Google Workspace Data

When you connect Google Workspace to your Tlyck agent, we access and process data via the Google API Services on your behalf, solely to fulfill your explicit instructions. The following Google APIs and scopes may be used:

• Gmail (gmail.modify) — read, draft, and send email messages as you direct your agent.
• Google Calendar (calendar) — read and create calendar events as directed.
• Google Drive (drive.readonly, drive.file) — list, search, upload, and download Drive files as directed. drive.readonly is used to find and read files you already own; drive.file is used to create or edit files the application generates on your behalf.
• Google Sheets (spreadsheets) — read and write data in spreadsheets as directed.
• Google Docs (documents) — read and edit documents as directed.

Limited Use compliance statement: The use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace user data is processed exclusively to respond to your explicit in-session requests and is never transferred to third-party AI model providers for training, model improvement, or any secondary purpose.

Specifically, Google Workspace user data is:

• Used only to perform the action you explicitly requested through your agent.
• Not used for advertising, profiling, or any purpose unrelated to your stated instruction.
• Not used to train, fine-tune, evaluate, or improve any AI or machine-learning model — neither ours nor any third party's.
• Shared only with the AI inference providers listed below, and only in the context of fulfilling your request. Those providers operate under API terms that prohibit using customer inputs or outputs for model training: Anthropic (Claude API), Google DeepMind (Gemini API), and DeepSeek API.

You can revoke Tlyck's access to your Google Workspace data at any time from your Google Account permissions page or by disconnecting the integration in your agent's Settings tab. Upon disconnection, all stored OAuth tokens are permanently deleted within 24 hours.

4. Data Retention

We retain account information for as long as your account is active and for up to 12 months after closure, unless a longer period is required by law. SMS consent and opt-out records are retained for as long as required to honour your choices and to evidence consent. Aggregated usage statistics may be retained indefinitely in anonymous form. Operational logs are rotated within 30 days.

5. Cookies and Tracking

We use only a single session cookie (an encrypted HTTP-only cookie) to keep you signed in. We do not use advertising cookies, cross-site trackers, or analytics pixels. The session cookie is strictly necessary and does not require consent under applicable law.

6. Your Rights

Under the Israeli Privacy Protection Law 5741-1981 and related regulations, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (subject to legal retention requirements).
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at david@melnicom.com. We will respond within 30 days.

7. Data Security

We use industry-standard measures including TLS encryption in transit, encrypted storage for sensitive credentials, and access controls limited to authorized personnel. No method of transmission over the Internet is completely secure; we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

9. International Transfers

Our servers are operated in the European Union. If you access the Service from outside the EU or Israel, your data may be transferred to and processed in those jurisdictions. By using the Service, you consent to such transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact Us