Privacy policy
This English translation is provided for convenience. If it differs from the Hebrew version, the Hebrew version applies.
This document explains in plain language what personal information is collected on yaakovavital.co.il (the “site”), for what purpose, who receives it, how long it is kept, and what your rights are. The policy was written in accordance with the Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, which came into force on 14 August 2025, and with the Protection of Privacy Regulations (Data Security), 5777-2017. It also includes the disclosures required under the European Union’s General Data Protection Regulation (GDPR) and under the California Consumer Privacy Act (CCPA/CPRA), in case visitors from those regions contact us.
1. Who is responsible for the information
Data controller: Yaakov Avital Ltd., company no. 516990173 (“we”).
Contact person for privacy matters: Yaakov Avital, through the contact form on the site.
We are not required to appoint a privacy protection officer (DPO) under section 17B1 of the Protection of Privacy Law, because we are not a public body, we do not trade in data, and we do not process information of special sensitivity on a large scale.
2. The bottom line, before the details
- By default, the site sets no cookies at all. No tracking cookies and no advertising cookies.
- The site uses Google Analytics 4 to measure usage, and only if you have accepted this in advance. A banner is shown on your first visit. Until you click “Accept”, no Google script is loaded and no cookie is written. If you click “Decline”, or ignore the banner, the site stays at zero cookies. No consent is implied from scrolling or from continued use.
- You can change your decision at any moment by clicking “Cookie settings” at the bottom of every page. Withdrawing consent stops the measurement and tells the browser to delete the measurement cookies; the actual deletion depends on the browser and its settings.
- The site has no social network pixels, no heatmaps and no advertising. Google Signals and ad personalisation are explicitly disabled in the measurement settings.
- All the other site files are served from our own domain only: fonts, scripts and images. If you have not accepted measurement, your IP address is not passed to any measurement or advertising provider. The page itself is served through our hosting provider, which processes IP addresses and keeps technical server logs under its own terms and policy, which are not under our control and about which we give no undertaking.
- The only personal information we collect on our own initiative is what you choose to provide in the contact form. In addition, our infrastructure providers generate technical data that accompanies any browsing, and if you have accepted measurement, also usage data and a random visitor identifier, as set out below.
- We do not sell personal information and we do not transfer it to third parties for marketing purposes.
3. What information is collected, and how
3.1 Contact form
When you fill in the form on the site, the details you enter are collected: name, phone number and the content of the message, and, if you chose to fill it in, also the project location (locality), which is added to the beginning of the message. The list of localities to choose from is loaded from the site itself, from the government’s open database of localities. Before sending, you will be asked to confirm that you want to send the details so that your enquiry can be handled. This confirmation is a confirmation to send only. It is not a declaration that you have read any document, and it is not general consent to processing: the basis for handling the enquiry is your request itself, as set out in section 4.
Notice under section 11 of the Protection of Privacy Law: providing the information depends on your free will, and you are under no legal obligation to provide it. However, without a name and a phone number we will not be able to reply to your enquiry. The information is provided for one purpose: replying to your enquiry and arranging a professional service, if you ask for one. The information will be passed only to the technical providers listed in section 5 below, to check the enquiry and forward it to us. We will not use the details for marketing mailings. If we offer mailings in the future, they will be conditional on a separate consent box that is not ticked in advance.
3.2 How the enquiry reaches us (e-mail)
When you click “Send”, the details you filled in are sent to the site server (section 5) to be checked: the validity of the fields, the security check in section 3.5 and the limit on the number of enquiries. If the check passes, the site server sends the enquiry as an e-mail message to our mailbox, which is managed on Google’s Gmail service. The site server itself does not keep the name, the phone number or the content of the message; the message is kept in our mailbox. No automatic reply is sent to you.
3.3 Technical logs of the hosting server
Like any website, the hosting server automatically records technical data about every request: the IP address, the browser type, the time of the request and the page requested. These logs are used only for security, for troubleshooting and for protection against misuse, and we do not use them to identify you.
3.5 Security check against bots (Cloudflare Turnstile)
To prevent a flood of automated enquiries, the form uses Cloudflare’s Turnstile service. The service loads only when you start filling in the form; a visitor who does not touch the form does not contact Cloudflare at all. For the check, Cloudflare receives technical data about the browser and the connection, including the IP address, characteristics of the encrypted connection (TLS) and the browser identification (User-Agent). According to its policy, Cloudflare uses this data to detect and block bots and to improve detection, and not for identification, profiling or advertising. Details: cloudflare.com/turnstile-privacy-policy.
In addition, to limit the daily number of enquiries from each network, the site server keeps a one-way code calculated from the IP address and the date (HMAC), together with a counter. The IP address itself is not kept, and the code does not allow it to be recovered.
3.4 Accessibility preferences
If you use the accessibility menu on the site, the preferences you chose (for example text size or contrast) are saved only in your browser’s local storage (localStorage), on your device, so that you do not have to choose them again on every visit. This information is not sent to us and does not identify you. This is a use you explicitly request, and therefore it does not require separate consent.
3.6 YouTube videos
On the video pages, each video is shown as a picture stored on the site itself. Until you click play, nothing is loaded from YouTube and no information is sent to it. After the click, the video loads from youtube-nocookie.com, in the privacy-enhanced mode of YouTube (a Google company), and YouTube receives the technical information that a browser sends to any site it contacts, such as the IP address and the browser type. From that moment Google’s privacy policy applies, and its servers may be outside Israel. Clicking play is your choice to use this service, and you can also watch the videos directly on YouTube through the link below each video.
3.7 Comments on articles and on the blog
You can leave a comment on the articles and on the blog page. We collect the name you chose to display, the content of the comment, the page and the time it was sent, and an e-mail address if you chose to provide one. The comment is stored on the site server (Netlify Blobs) and sent to us by e-mail for review. The name and the content of the comment are published on the site only after we have approved them, and the e-mail address is not published; it is used only so that we can contact you about the comment. The purpose is to review the comment and publish it, on the basis of the confirmation you gave in the form, and providing the details is voluntary and not a legal obligation. The comment form also goes through the security check in section 3.5, and to limit the number of comments and prevent misuse, a one-way code calculated from the IP address is kept; the IP address itself is not kept. A published comment may remain on the site for as long as the page exists, and a comment that was not approved is not published and may be kept by us in an internal archive. You can ask for a comment to be corrected or deleted through the contact details in section 1, subject to section 9.
4. Why we use the information, and the legal basis
| Information | Purpose | Legal basis in Israel | Legal basis under the GDPR |
|---|---|---|---|
| Name, phone number and message from the form | Replying to the enquiry and arranging a service | Voluntary provision for a purpose disclosed to you in advance, sections 2(9) and 11 of the Law | Steps prior to entering into a contract, at your request, Article 6(1)(b). Not consent under 6(1)(a) |
| Technical server logs | Security, troubleshooting | The legitimate interest of the site owner in protecting its systems | Legitimate interest, Article 6(1)(f) |
5. Who receives the information
We do not sell, rent or transfer personal information to third parties for marketing purposes. The information is accessible only to the following:
- Yaakov Avital, to reply to the enquiry.
- Netlify, Inc., a US company that hosts the site and runs the server component that checks the form (Netlify Functions) and keeps the daily enquiry counter (Netlify Blobs). Netlify processes the information for us as a service provider, according to our instructions, and is contractually bound to keep it confidential and secure. Netlify’s privacy policy is available at netlify.com/privacy.
- Cloudflare, Inc., a US company, only if you started filling in the form, for the security check described in section 3.5. Details: cloudflare.com/turnstile-privacy-policy.
- Google LLC (Gmail), a US company that operates the mailbox to which the enquiries from the form are sent, and keeps them for us as a service provider, under its own terms and policy.
- Google LLC, and only if you accepted measurement in the cookie banner. Google operates Google Analytics 4 for us and receives technical usage data: pages viewed, the source of the visit, the device and browser type, and an approximate geographical location at country or city level. In GA4 the IP address is not stored; it is used to determine the location and is then deleted. We set up the measurement so that Google Signals and ad personalisation are disabled, which means the data is not used for advertising. If you did not accept, nothing is sent to Google. Details: policies.google.com/privacy.
- A competent authority, only if we are required to do so by law or by a court order.
6. Transfer of information outside Israel and the European Union
Netlify runs its infrastructure on the cloud services of Amazon Web Services, and according to its publications, its systems may be located in the United States and in other regions. The form details pass through these systems for the check and are not stored in them by us, and they are kept in our Gmail mailbox, whose systems may be located outside Israel; the enquiry counter (section 3.5) and the server logs are stored in Netlify’s systems. Cloudflare operates a global network, and the security check data may be processed outside Israel. This means that information related to your enquiry may be transferred or stored outside Israel and outside the European Economic Area.
According to Netlify’s Trust Center, the company declares compliance with the GDPR and the CCPA, participation in the EU-US Data Privacy Framework and in the Swiss-US DPF, and ISO/IEC 27001, ISO/IEC 27018 and SOC 2 certifications, and it publishes a data processing agreement (DPA) and a list of sub-processors, including Amazon Web Services and Datadog. The transfer from Israel is made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001. We do not present here any specific contractual commitment signed between us and Netlify beyond its standard terms of service.
Google Analytics, only if you accepted measurement. The measurement data is processed by Google LLC and may be stored on servers outside Israel, including in the United States. Google participates in the EU-US Data Privacy Framework and publishes data processing terms (Google Ads Data Processing Terms) that include the standard contractual clauses of the European Union. In GA4 the IP address is not stored, and we set up the property so that the data is not used for advertising. If you did not accept, no information at all is transferred to Google.
7. How long the information is kept
- Enquiries from the form: the information may be kept for as long as needed to handle the enquiry and to meet obligations under the law, and it may also be deleted earlier. If a business engagement was formed, retention rules under Israeli tax and contract law apply to the documents. The site has no automatic deletion mechanism at a fixed time, and we do not undertake to keep the information for any period, to hold it, to back it up or to delete it at a particular time. You can request deletion, to the extent of and subject to what is stated in section 9.
- Technical server logs: kept by Netlify for operational and security purposes, under its own terms and policy. The retention period is set by Netlify, is not under our control, and we give no undertaking about it.
- The enquiry-limit code (section 3.5): intended to be deleted automatically at the next use of the form that takes place two days or more after the day of the enquiry. We do not undertake an exact deletion time.
- Accessibility preferences: kept in your browser until you delete them, and not held by us at all.
8. Information security
We take reasonable measures to protect the information, in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017, including: encrypted traffic only (HTTPS/TLS) with automatic redirection from HTTP, security headers on the server (content security policy, prevention of embedding in frames, and more), hosting with a provider that holds recognised security certifications, access to the information for the business owner only, and not collecting information we do not need. However, no system is completely immune, and we cannot guarantee absolute security. Nothing in this section is an undertaking as to a particular level of security, a particular measure, a result, availability or the absence of a security incident, beyond what the law requires of us. The measures listed above may change from time to time.
In the event of a serious security incident involving your information, we will act in accordance with the law, including reporting to the Privacy Protection Authority where required.
9. Your rights
9.1 Under Israeli law
- Right of access (section 13 of the Law): to inspect the information kept about you.
- Right to correction and deletion (section 14 of the Law): to ask for information that is not correct, complete or up to date to be corrected, or to be deleted.
- Right to ask that use stop and that the information be deleted: to the extent set in section 14 of the Law and subject to its exceptions, to retention obligations under the law, and to the need to protect our legal rights. We do not undertake immediate or blanket deletion.
- If you believe that we have infringed your privacy, you have the right to apply to the Privacy Protection Authority at the Ministry of Justice.
9.2 For visitors from the European Union and the United Kingdom (GDPR / UK GDPR), where applicable
The site is intended for the Israeli market. It is presented in Hebrew, with an English version for readers outside Israel, and we do not specifically direct services to the European Economic Area. If you nevertheless contacted us from the European Union or the United Kingdom, and to the extent that this law actually applies to us, we will act on the following rights only to the extent and within the time limits it requires: access (Article 15), rectification (16), erasure (17), restriction of processing (18), data portability (20), objection to processing based on legitimate interest (21), and the right to lodge a complaint with the supervisory authority in your country of residence. We do not make automated decisions with legal effect and we do not carry out profiling.
9.3 For California residents (CCPA / CPRA), where the law applies
The California privacy law applies only to businesses that meet applicability thresholds of turnover, volume of data or revenue from selling information. We most likely do not meet these thresholds, and therefore the law does not apply to us. Nevertheless, as a matter of policy: we do not sell and we do not share personal information for targeted advertising, and we have not done so in the last 12 months. California residents who contact us may ask to know what information was collected and ask for it to be deleted or corrected, and they will not be discriminated against for such a request. The categories collected are identifiers (name, phone number) and content that you provide, for the purpose set out in section 4.
9.4 How to exercise a right
Contact us through the contact details in section 1. We will reply within the time set by law, and in complex cases we will give notice of an extension to the extent the law permits. To protect you, we may ask to verify your identity before we provide or delete information. Exercising the rights is free of charge.
10. Minors
The site is intended for a professional audience and is not directed at children under the age of 18. We do not knowingly collect information from minors. If you learn that a minor has provided us with information, please contact us and we will act to delete it.
11. Links to external sites
The site includes links to external services. AiN (ain-engine.com) is a service of AIN ENGINE LTD, company no. 517393534, a separate legal entity, operated under its own privacy policy and terms of use, at app.ain-engine.com/terms-he. This policy does not apply to it. The same applies to social networks and other external services, which are not under our control and for whose privacy practices we are not responsible.
12. Cookies and measurement tools
A cookie is a small text file that a website stores in your browser. This site sets no cookie at all by default. The only cookies that may be created are the Google Analytics measurement cookies, and only after you click “Accept” in the banner.
12.1 What is stored in the browser
| Name | Type | Purpose | Duration | Consent required |
|---|---|---|---|---|
a11y-prefs-v1 | localStorage | Saving the accessibility menu preferences you chose, for example larger text or contrast | Until you clear the browser | No. This is a service you explicitly requested, and it is exempt from consent |
cookie-consent-v1 | localStorage | Remembering your decision in the banner, so that we do not ask again on every page | Up to 12 months | No. Stored only to respect your choice |
_ga | Cookie | A random visitor identifier for counting unique users | Up to 24 months | Yes |
_ga_LLT7E49TDY | Cookie | Keeping the session state for GA4 | Up to 24 months | Yes |
The first two rows are stored in your browser only and are not sent to any server, not even to ours.
12.2 The legal basis, and how it works in practice
We chose the strictest consent model: Google’s script does not load at all until you click “Accept”. There is no early loading with late blocking here, and no consent is implied from scrolling, from continued use or from closing the banner. Declining or ignoring the banner leaves the site at zero cookies. This is a policy we chose at our sole discretion, and nothing in it is an admission that any law applies to us.
12.3 How to change your decision
At the bottom of every page there is a “Cookie settings” button that shows your current status and lets you choose again. Withdrawing consent stops the measurement on the page and tells the browser to delete the _ga cookies. The actual deletion depends on the browser and its settings, and we give no undertaking about it; you can always delete them manually as described below. You can also delete cookies directly in the browser settings, or install Google’s official opt-out add-on, which blocks measurement on all websites.
13. Changes to the policy
A change to the policy will be accompanied by an update of the version number and the date at the top of the page. A material change, such as adding a measurement tool or a new type of cookie, will not be activated without asking for consent again; this is a restriction we take upon ourselves towards the user. Nothing in this is an undertaking to give personal notice or a prior notice period, or to keep previous versions of the policy or make them available, and we do not undertake to keep any version history. The responsibility for keeping up to date with the published text lies with the user.
14. Governing law
This policy is governed by Israeli law. Nothing in this derogates from mandatory rights granted to you under the laws of your place of residence.
15. Permissive wording
Wherever this policy says that we may do something (keep, hold, back up, provide, check, run, insure, update or continue), this is a permission and not an obligation: it may or may not happen, to any extent and at any time, at our sole discretion and without prior notice. The user confirms this in advance and declares that they do not rely on it happening. This provision applies equally to both parties.
What is expressly not subject to this section: our obligations under the Protection of Privacy Law and the Data Security Regulations, including taking reasonable security measures (section 8); the exercise of a right of access, correction or deletion under the law and within the time limits it sets (section 9); and the cookie consent mechanism (sections 2 and 12), which is a factual description of how the site works and not a promise: as long as no consent has been given, no measurement script is loaded and no measurement cookie is written. These cannot be qualified by this section.