Privacy Policy

6. Where Data is Stored

Our primary databases live on Railway (US default) and Hetzner (European regions — Finland / Germany). Backups are stored on Backblaze B2. For the complete sub-processor list see Sub-processors.

Transfers outside the EEA are carried out under EU Standard Contractual Clauses (SCCs) or under valid adequacy frameworks (such as the EU-US Data Privacy Framework). Israeli Privacy Law cross-border transfer requirements are also satisfied.

7. Data Sharing

We do not sell, rent, or share personal data with third parties, except:

• Sub-processors — infrastructure providers acting on our behalf under a DPA. Full list at Sub-processors.
• Legal obligation — court orders, statutes, or competent authority.
• Rights protection — to identify, prevent, or address fraud, security threats, or breaches of terms.
• Merger / acquisition — if we are acquired or merged, personal data may transfer to the acquirer. We will notify you 30 days in advance.

8. Your Rights

Under GDPR and Israeli Privacy Law, you have the following rights:

• Access — receive a copy of all data held about you.
• Rectification — request correction of inaccurate data.
• Erasure ("right to be forgotten") — delete your account and data.
• Portability — receive your data in a portable format (JSON / CSV).
• Object — object to certain processing, including direct marketing.
• Restriction — request temporary processing restriction.
• Withdraw consent — revoke previously given consent.

To exercise any right, fill out the DSAR form or email Kaufman.ai.agent@gmail.com. We respond within 30 days (extendable by 60 days for complex cases, with notice).

You retain the right to file a complaint with the Israeli Privacy Protection Authority (Rmi) or your local EU Data Protection Authority.

9. Retention

• Active accounts — for as long as the account is active and up to 30 days after cancellation.
• Deleted accounts — permanently erased within 30 days of deletion request (except for legally required retention — see below).
• Payment records and invoices — 7 years per Israeli Income Tax Ordinance and VAT Law.
• Security logs — 12 months for investigation purposes.
• Backups — purged automatically within 90 days.
• Support screen captures — 30 days, deletable earlier from the help window.

Screen captures in support requests

When a user asks for help through the "Get help" button, a capture of the page structure they were on (not a picture — the document and its styles) is stored with the request, so our support can see exactly what they saw without asking them to describe it. Before the capture leaves the browser, every input field (passwords, typed text), every phone number and e-mail address on the page, and every field marked sensitive are masked. Billing and payment pages, account and password pages, keys and integrations, and data export pages are never captured at all. The capture is visible only to our support staff, every view is logged, and it is deleted automatically after 30 days — or earlier, with one click from the help window.

Live view of your screen during a support request

While a support request is open, our support staff may ask to see your screen in real time. The live view starts only after you explicitly approve it (the request appears in the help window), it applies to that request only, and you can end it at any moment with the "Stop" button in the top bar. What is transmitted is the structure of the page you see and its changes — not a video — under the same masking as a capture: input fields, phone numbers and e-mail addresses, and additionally free text in tables (such as customer names), unless you choose to reveal it to support for that request. Billing, account, keys and export pages are never transmitted. Support has no control over your screen — only a pointer. The stream is not stored anywhere, it is processed on our own servers with no third-party provider, and every start and end of a live view is logged. It ends by itself after 30 minutes without activity and when the request is resolved.

10. Security

We implement technical and organizational safeguards:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Password hashing with scrypt (irreversible).
• Strict tenant isolation (multi-tenant + RLS).
• Role-based access control (RBAC), 2FA for admin accounts.
• Daily automated backups with monthly restore testing.
• 24/7 security monitoring, anomaly alerting.
• Periodic security audits, external pen-tests.

In the event of a personal data breach involving significant risk, we will notify you and the competent authority within 72 hours of discovery, per GDPR Art. 33-34 and Israeli Privacy Law.

11. Children

The service is not directed to minors under 16. If we discover we have collected data about a minor without parental consent, we will erase it immediately. Parents who identify that their child provided data should contact Kaufman.ai.agent@gmail.com.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be emailed to registered users and posted here at least 30 days before taking effect. The last update date appears at the top of this page.

13. Governing Law

This policy is governed by the Laws of the State of Israel. In case of conflict between Hebrew and English versions, the Hebrew version prevails.