Privacy Notice

The data controller is Roliel Technologies & Entrepreneurship Ltd., Company No. 516102555, 12 Eli Hurvitz St., Kfar Saba, Israel. Email: support@postify.co.il; phone: 054-8155009. This notice covers the Postify system and application (the "service").

Account and business information: name, email address, business name, phone, occupation, language and preferences, and team users with their roles. Authentication and security data: your password in encrypted form only (it cannot be read), session information, sign-in attempts and account lockout, and your IP address and the type of your device and browser in the security log, plus the record of your acceptance of the Terms of Service and this notice and the consents you gave. Facebook data: the account and group details needed to connect and publish. Customer content: posts, images and videos, collections, schedules and publishing results; and a screenshot of the publishing result, which is kept as proof for 30 days and may show content or names of other people that appear in the Facebook group. Billing data: subscription details, the name and business number for the invoice, invoices and payment attempts - card details are entered on the payment processor's payment page and are not stored by us. Support: conversations with the smart assistant, bug reports (the text and any screenshot you attached), and messages to the WhatsApp bot (the phone number and the text). Notifications: the address of your browser's push notifications, if you allowed notifications. Source of arrival: the campaign name, referral code and ad click ID, from the moment you reach the website until you sign up. Operational communications: service emails and operational audit records.

Anyone who leaves details on the Postify website (in the contact form or in the "Talk to us" chat) gives us a name, phone number, email address and a free-text message, and we also keep the source of the visit to the website (for example the campaign name and the landing page). We use the details only to get back to you about your enquiry. The details are kept in two places: in a Google spreadsheet (and in an email from Gmail that is sent to us), and in our lead system, and they are accessible to the Postify team only. We will not sell them and will not pass them on to others for marketing purposes. In our lead system they are kept for up to 12 months, and everywhere they are deleted at your request. Providing the details is optional, but without them we cannot get back to you.

In the website chat, the answers are generated with the help of an external AI provider in the United States (Anthropic). Before a message is sent to it, we remove email addresses, phone numbers, ID and credit card numbers, passwords and links from it. Do not write sensitive details in the chat. Messages are kept for up to 90 days (up to 12 months if you left contact details). The chat keeps your conversation in the open tab only (see section 10).

If you were a customer of our previous system, we may keep your name, phone number, email address and occupation in order to identify your account and make the move easier. The information is accessible to system administrators only and is deleted 30 days after you move over, or 90 days after the last update if you have not moved yet. You can ask for deletion at any time.

You are not legally required to provide information unless a specific law says otherwise. However, providing certain information is necessary to operate the capability you asked for (an email to open an account, a Facebook connection to publish, and payment details to the payment provider). If you do not provide it, we will not be able to open the account or operate the relevant capability.

Purposes: providing the service and publishing content, account management and billing, security and abuse prevention, support and service improvement, advertising measurement (section 5), and meeting legal obligations. For customers in the European Economic Area, where GDPR applies, the processing bases include contract performance, legitimate interests (security, lockout, audit) and consent where the processing relies on it.

We do not sell data. If you came to us from a Google or Meta (Facebook and Instagram) ad, we may report to them that you signed up or paid, in order to measure which ads work. For this, only the ad click ID and your e-mail address in hashed form, which cannot be read, are sent - without a name, phone number or content. You can ask us not to do this by contacting us, and we will stop immediately.

If you came to us from an ad on ChatGPT (OpenAI), we may report to OpenAI that you signed up or paid, in order to measure which ads work. For this, only the ad click reference, your e-mail address in hashed form and, for a first payment, the payment amount are sent - without a name, phone number or content. You can ask us not to do this by contacting us, and we will stop immediately.

We use the following providers and give them only what is needed for the service they provide to us:

• Google (cloud services, Gmail and the website lead spreadsheet): the application, the database and the dedicated systems run in Google Cloud's Tel Aviv region in Israel. The email and the website lead logs are handled by Google outside Israel.
• Cloudflare: managing the website addresses, and storing your files (images, videos, result screenshots and screenshots from bug reports). Outside Israel.
• Anthropic and OpenAI: the AI assistant, the website chat and the writing tools (section 6); and Anthropic also for diagnosing operational faults in the service, using technical data only, after contact details, passwords, identifiers and free text are removed. In the United States.
• Meta: publishing to Facebook on your behalf, the WhatsApp bot, and, if you choose, reporting a sign-up or payment when you came from an ad (see above). Outside Israel.
• iCount: invoices and the payment page.
• WATI: the support business WhatsApp line, for people who write to it.
• Push notification services of the browser makers (Google, Mozilla, Apple, Microsoft): the notification address and the text of the notification.

Each provider operates under its own terms with us. In addition, when you connect a Facebook account and instruct Postify to publish, selected information and Customer Content may be transferred to Facebook/Meta as necessary to perform the action you requested. The application does not use advertising cookies. Information sent to artificial intelligence providers is described in section 6.

The service includes AI-based features: writing and improvement tools for posts, and "Postify's assistant" - a chat that answers questions about your account and the service (when it is available in your account). To provide them, information is sent to external AI providers: Anthropic (Claude models) for the assistant, and OpenAI for the writing tools. The chat on the Postify website also runs with Anthropic, after contact details, passwords and links are removed from the message. The providers operate outside Israel, mainly in the United States. Messages sent to the WhatsApp bot are processed by an external AI provider to understand the request. To find faults in the service, one of our internal systems may also send Anthropic technical data (counts, times, log lines and code excerpts) after we remove contact details, passwords, identifiers and free text. The data is used only to diagnose the fault, and we do not send it to anyone else.

What is sent: the text you ask a writing tool to process; and for the assistant - your question, the conversation, and the account data needed to answer (for example post names and status, group names, publishing figures and subscription status), from your own account only. Never sent: passwords, login codes, Facebook sign-in details, payment card details or access keys. Under the providers' commercial terms, information sent through their API is not used to train their models; they may keep it for a limited time for security and abuse prevention, under their terms.

Assistant conversations are kept in your account so you can return to them, until the account is deleted or at your request. The Postify team may view conversations to provide support, handle a request to talk to a person, and improve answer quality. We also keep aggregate usage data (volume and cost, no content). The assistant performs an action in your account only after you explicitly confirm it, and does not handle payments, deletions or sensitive settings. Using these features is optional: you can simply not use them, or ask support to turn the assistant off for your account.

Our main storage (the database, the application and the dedicated systems) is in Israel. Certain providers, listed in section 5, process information outside Israel, mainly in the United States and Europe. We transfer to them only the information needed for their service.

Retention periods depend on the type of information, operational requirements, contractual and legal obligations, and legitimate business needs, and information is not retained longer than reasonably necessary for those purposes, subject to applicable law. Deleted information remains in backups until they expire, at most 30 days, and then it is gone from there too. Deletion and privacy requests can be submitted to support@postify.co.il.

To prevent repeated use of the free trial we keep, for 12 months, a one-way fingerprint (hash) of the e-mail address, without the address itself. Information that does not appear in the table is kept as long as the account is active, and is deleted when the account is deleted or at your request (subject to what the law requires us to keep).

You can ask to see, correct or delete your information, or ask us to stop reporting your sign-up or payment to the advertising platforms. We will verify your identity and respond within 30 days when you contact support@postify.co.il. The account owner can also download a file with the account's data and request deletion of the account themselves, in the settings page. The reports CSV is not a full export of the information. Where GDPR applies, additional rights include restriction, objection, portability, and withdrawal of consent where the processing relies on it.

Account deletion: until the deletion is carried out you can cancel the request. On deletion, the account and its data are deleted from the database, the dedicated system and its sign-in state. Invoices and payment records are kept for 7 years by law. What is deleted remains in backups for up to 30 days and then it is gone. After an account is deleted by our team, the data is kept frozen for up to 30 days and then permanently deleted. Files you uploaded (images and videos) and disk backups are deleted on your explicit request when you contact us.

The current Postify application uses necessary / functional cookies and local storage for purposes such as authentication, language, preferences and application state. The current application does not use advertising cookies or advertising analytics identifiers. The Postify website does not load analytics or advertising tools of third parties. To know which campaign brought you here, the website keeps a cookie named pfy_attr in your browser for 30 days. It contains only campaign details (for example the campaign name and the Google or Facebook click id), the landing page and the time of your first and latest visit through a campaign link - no name, e-mail, phone number or IP address. It is saved only when you arrive through a link that carries campaign details. The cookie is shared between the website and the application at app.postify.co.il: the website reads it when you come back through a campaign link, and the application reads it when you sign up, to attribute the sign-up to the campaign that brought it. For conversion reporting see section 5. It is not used for advertising profiles or analytics on the website. You can delete it at any time in your browser settings, and it expires by itself after 30 days. If you sign up, the campaign details are stored with your account.

To understand whether the page is clear and which buttons people press, the website sends Postify's own system (not a third party) one event per visit, without a name, e-mail or phone number: how long the page was open, which button you pressed, the device type, whether you arrived through the Facebook app, and the campaign name in the link. No cookies, no browser storage and no name, e-mail or phone number, and nothing is sent when your browser asks not to be tracked. As on any website, the regular browsing log also keeps the IP address and the browser type for the log retention period.

In the website chat, your conversation is kept in the open tab only, under the name pfy_chat_v1, and is deleted when you close it. If you came through a referral link, the Postify application keeps an operational cookie named pf_attr for 30 days in order to attribute the sign-up to the referrer. There are no advertising cookies and no third-party analytics tools. Apart from the operational cookies described above (campaign and referral), we will not activate advertising cookies or third-party analytics tools without asking for consent first.

We use reasonable technical and organizational measures designed to protect information. Credentials are protected rather than stored in plain text, and card details are processed by an external payment processor rather than stored by Postify.

The service is for businesses and users aged 18+, and is not intended for minors.

You may contact us at support@postify.co.il. In Israel you may also contact the Privacy Protection Authority. Where GDPR applies, you have the right to complain to the relevant EU supervisory authority.

This notice may be updated from time to time. When there is a material change to the notice, we will let you know with a notification in the notifications screen in the application, and the new version will get a new version identifier.

Roliel Technologies & Entrepreneurship Ltd. · Company No. 516102555 · 12 Eli Hurvitz St., Kfar Saba, Israel · Phone 054-8155009 · Email support@postify.co.il