Bell Privacy Policy
Last updated 8 October 2026
Who we are
Bell is operated by Tom Yehuda Bar Haim, an Israeli registered sole proprietor (עוסק מורשה), trading as TBH Advisory. Contact: tom@tbh-advisory.com.
What Bell is
Bell is an operations assistant for insurance agencies. An agent sends Bell an instruction, by WhatsApp or through Bell's web console, and Bell tracks the unfinished work that follows until it is completed. Bell acts for the agency. It is not a service that consumers sign up to.
What Bell processes
Until a data processing agreement between the agency and us is in force, Bell does not read the agency's client system, does not store documents forwarded to it, and does not connect the agency's WhatsApp account.
- Messages between the agent and Bell. The text the agent sends, Bell's replies, and the delivery status of each.
- The agent's identity. Their name, their WhatsApp number, and which agency they belong to.
- Messages Bell sends to the agency's clients. When a person at the agency approves a request, Bell sends the client a WhatsApp message from the agency's account and, where the agency has switched reminders on, up to two follow-up reminders three days apart, stopping once the requested file arrives. Bell keeps each message, the number it was sent to, and its delivery status.
- The agency's WhatsApp connection. The agency's WhatsApp Business account identifiers and the access token Meta issues to Bell, which Bell stores encrypted. The agency can disconnect its account from Bell at any time.
- Client records belonging to the agency. Read from the agency's own existing system at the moment a question is asked. See below.
- Process updates. When an agency switches them on, Bell checks the agency's system every 15 minutes for processes, such as a pension transfer or a claim, that finished successfully. To notice the change, Bell keeps a record of each process it has seen: its type, status, dates, company and product, and the id and name of the client it belongs to. It keeps no phone number, identity number, email or amount from it, and uses the record only so the agency can approve a message telling the client.
- Files the agent forwards to Bell. A document or image the agent sends Bell on WhatsApp, typically a client's identity document or payslip, is downloaded from Meta and stored in Bell's database, in the European Union, so that Bell can record which request it answers. Files are capped at 25 MB. See below.
- An audit trail. A record of what Bell was asked, what it did, and what it refused, which Bell's application can add to but cannot change or delete.
Client records are read from the agency's own system
When an agent asks Bell about a client, Bell reads that record from the agency's existing system of record at that moment. Bell's software issues only search and retrieval requests to that system and never a request that creates, changes or deletes a record. This is a control in Bell's software, not a limit of the credential the agency issues. Bell does not hold a copy of the agency's client book and never synchronises one.
What Bell does keep. The part of a record a lookup actually returned is written into that conversation's log, so that the conversation can be read back and audited later. If Bell was asked about a client and answered with their name, their telephone number or the state of their file, those values are in Bell's database. The agency's system remains the system of record, and it is the place a correction or a deletion is made.
Forwarded files are the exception. When the agent forwards a file to Bell, the file itself is stored in Bell, because the record of a request being satisfied has to point at the thing that satisfied it. Bell keeps the file, its size, its type and a fingerprint computed from its contents, and records which request it was attached to. Google separately receives forwarded files for document recognition. Conversation providers receive messages and lookup results, not uploaded file bytes.
Message content reaches a language model
To interpret an instruction, Bell sends the agent's message, and the results of any lookup it performs in order to answer, to a language model operated by Anthropic, with Google as backup. Where a lookup returned a client's name, that name is part of what is sent. This is how Bell understands what was asked and it cannot be switched off while Bell is in use.
Who else sees this data
| Meta Platforms Ireland | WhatsApp Business Cloud API. Carries messages between the agency's staff and Bell, and between Bell and the agency's clients. |
| Anthropic | Claude API. Primary conversation provider; receives masked messages and lookup results; names remain. |
| Gemini API. Conversation backup and separate document recognition for forwarded files. | |
| Render | Hosting and the PostgreSQL database. Frankfurt, European Union. |
Bell uses Google's paid service, under whose terms Google does not use this information to improve its products, may process it in any country where it has facilities, and keeps it for up to 55 days to detect abuse. Meta keeps WhatsApp messages for up to 30 days and may process them outside Israel and the European Union. For assistant conversations, we use Anthropic Claude API as the primary provider and Google Gemini as backup. Before transmission, the app masks phone numbers, identification or other long numbers, and email addresses; names and remaining message text may still be sent. Conversation providers receive messages and lookup results, not uploaded file bytes. Google separately receives forwarded files for document recognition. Anthropic states that commercial API data is not used for training by default; this app does not submit feedback. Standard API inputs and outputs are normally deleted within 30 days, subject to contractual, safety, legal and enforcement exceptions. No Israel or EU data-residency commitment has been verified for this account.
Bell does not sell data, does not share it for advertising, and does not use it to train any model.
Where it is held, and for how long
In a PostgreSQL database hosted in Frankfurt, in the European Union, encrypted in transit and at rest. Bell applies technical access controls, including database row-level security, designed to separate each agency's information from information belonging to other agencies. Conversations, tracked work and the audit trail are kept for as long as the agency uses Bell.
Data is removed when the agency asks for it to be removed, and in any case from Bell's active systems within 30 days after the agency's use of Bell ends. Copies in our hosting provider's backups are not deleted individually: they expire on the provider's schedule, currently within seven days, and we restore them only to recover from a disaster. Removal is carried out by a person rather than by a timer.
Your rights
An agency, or a person whose data an agency holds, may ask what Bell holds about them, ask for it to be corrected, or ask for it to be deleted. Write to tom@tbh-advisory.com and we will answer within 30 days. Where a request concerns a client record, the agency's own system is the system of record and the request is answered there.
Children
Bell is a tool for professionals and is not directed at anyone under 18.
Changes
If this policy changes materially, the date above changes and agencies using Bell are told by email at least 14 days before the change takes effect.