Privacy Policy

Chapter 1 — Definitions, Scope of Application and Legal Framework

1.1 Definitions

The Company — MAYBEL System Ltd., company no. 517052841, the owner and operator of the Platform, including its successors and its authorised service providers.

The Platform — the website, the application and any other digital interface owned or operated by the Company, including systems, software, cloud infrastructure, APIs and associated updates.

User — any individual or legal entity accessing the Platform, creating an account or using the Services.

Personal Information — as defined in the Protection of Privacy Law, 5741-1981, as amended from time to time, including any datum relating to an identified person or to a person identifiable with reasonable effort, directly or indirectly.

User Data — any data, content or inputs that the User enters, uploads or transmits through the Platform, which may include Personal Information relating to the User or to the User's customers.

Processing — any operation performed on Personal Information — including collection, recording, organisation, storage, alteration, retrieval, use, disclosure, transfer, deletion or destruction.

Database — as defined in the Protection of Privacy Law — a collection of data held by magnetic or optical means and intended for computerised processing.

Database Controller — the party that determines the purposes of the processing of the information and the means of processing it.

Holder — a person who has a database in their permanent possession and is permitted to use it, who is not the Database Controller.

Third-Party Service Providers — parties the Company relies on for the provision of or support for the Services — including cloud storage, payment processing, analytics, security, email and artificial intelligence models — which are subject to their own policies.

1.2 Scope of Application

This policy applies to all Personal Information processed through:

• use of the Platform and the Services;
• creation of accounts and management of subscriptions;
• communication with the Company or with technical support;
• visiting the website, including without creating an account.

The policy applies to private and business Users alike, to all existing and future Services, and to all processing carried out in Israel or outside it.

1.3 Legal Framework and Compliance

This policy has been prepared in accordance with:

• the Protection of Privacy Law, 5741-1981, including Amendment No. 13 which came into force on 14 August 2025;
• the Protection of Privacy Regulations (Data Security), 5777-2017;
• the Protection of Privacy Regulations (Transfer of Information to Databases Abroad), 5761-2001;
• guidance and opinions of the Privacy Protection Authority;
• section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982, with respect to marketing communications.

Where the User is located in the territory of the European Union, the Company shall also act in accordance with the principles of the GDPR to the extent it applies to the Company's activity.

1.4 The Company's Status — Controller and Holder

In accordance with the nature of the Service, the Company acts in two separate capacities:

With respect to information collected from the User themselves — identification, account, subscription, billing and communication data — the Company acts as the Database Controller, and determines the purposes of the processing and the means of carrying it out.

With respect to User Data entered into the Platform by a Business User, including Personal Information relating to its customers, employees or third parties — the Company acts as a Holder only.

With respect to information in the second capacity, the Company acts solely on the instructions of the Business User. Responsibility for the existence of a lawful basis for collecting the information, for informing the data subjects and for obtaining their consent rests with the Business User.

The Company shall assist the Business User in responding to requests from data subjects, to the extent required and subject to its technical capabilities.

Chapter 2 — Types of Information Collected and Their Sources

2.1 Information Collected Directly from the User

The Company collects and processes the following data when a User creates an account, uses the Platform or contacts the Company:

• Basic identification data — full name, email address, phone number, company name and role;
• Account and subscription data — username, account settings, plan type, subscription dates and account status;
• Payment and billing data — payment status, currency, country, invoices and transaction confirmations. Full credit card details are not stored on the Company's servers and are processed by the payment provider;
• Communication and support data — correspondence, support requests, complaints and feedback.

2.2 Information Collected Automatically

When the Platform is used, technical and operational data are collected automatically:

• Usage data — pages viewed, capabilities used, session durations and activity logs;
• Technical data — IP address, browser type, operating system, device identifiers and language settings;
• Log and security data — login records, unauthorised access attempts and error logs;
• Consent records — when the Terms are accepted, payment-method storage is approved or cookie preferences are chosen, the time of consent, its scope, the IP address and browser details are retained, for evidentiary and compliance purposes.

2.3 Information Provided by Business Users

Where the Platform is used by companies or organisations, User Data may include Personal Information relating to employees, customers or third parties.

Business Users represent that:

• they have a lawful basis for collecting such information;
• they are authorised to process it through the Platform;
• they are responsible for informing the data subjects and for maintaining their own privacy policy;
• they are responsible for obtaining consent to marketing communications in accordance with section 30A of the Communications Law.

2.4 Information Relating to Artificial Intelligence and Analytics

Data entered or produced through artificial intelligence tools may include textual inputs and analytical outputs. These data are used to provide the requested service and to ensure security and compliance.

The Company does not use User Data for the purpose of training general-purpose models, and does not use it to identify individuals beyond what is required to provide the Service.

Chapter 3 — Purposes of Processing and Legal Basis

3.1 Purposes of Processing

• Provision and operation of the Service — granting access to the Platform, creating accounts, managing subscriptions and operating technical capabilities;
• Account management and the contractual relationship — identity verification, permissions management and enforcement of the Terms of Use;
• Technical support and customer service;
• Billing and collection — issuing invoices, collecting payments and handling financial disputes;
• Performance improvement and service development — usage analysis and interface improvement;
• Security and fraud prevention — monitoring suspicious activity and protecting the Platform;
• Marketing communications — subject to express consent;
• Legal and regulatory compliance — meeting statutory obligations and responding to competent authorities.

3.2 Legal Basis for Processing

Unless otherwise stated at the time of collection, providing the information is not a statutory obligation. However, providing certain details is required for the engagement, opening an account, payment, security or provision of the Service; failure to provide them may prevent the Service being given in whole or in part. When information is collected, notice shall be given as required under section 11 of the Protection of Privacy Law, to the extent it applies.

3.3 Data Minimisation and Purpose Limitation

The Company operates according to the principle of data minimisation — information is collected and processed only to the extent necessary, for defined and legitimate purposes.

No further processing shall be carried out for a new purpose unless it is compatible with the original purpose, is based on a separate lawful ground, or fresh consent has been obtained for it.

Chapter 4 — Disclosure and Sharing of Information

The Company does not sell Personal Information, does not rent it and does not disclose it to any third party, except to the extent necessary for the provision of the Services or for compliance with a statutory obligation.

4.1 Disclosure to Service Providers

The Company ensures that service providers are subject to contractual undertakings to protect the information, to use it solely in accordance with the Company's instructions, and to implement adequate security measures.

4.2 Disclosure on Legal Grounds

The Company may disclose Personal Information without consent to the extent required for compliance with a statutory obligation, pursuant to an order of a judicial tribunal, or for the protection of the rights of the Company, its Users or others. Any such disclosure shall be made to the narrowest extent possible.

4.3 Business Users

Where the Platform is used by companies, processing may be carried out of data relating to their customers or employees. The Company acts as a Holder on the instructions of the Business User. Responsibility for informing the data subjects and obtaining the required consents rests with the Business User.

4.4 Merger or Acquisition

In the event of a merger, acquisition or sale of assets, Personal Information may be transferred to the successor entity, provided that the level of protection of the information is maintained and that notice is given to Users where required by law.

4.5 Transfer of Information Outside Israel

Some providers process information outside Israel. The transfer is carried out in accordance with the Protection of Privacy Regulations (Transfer of Information to Databases Abroad), 5761-2001, and subject to the providers' contractual undertakings to maintain an adequate level of protection.

Chapter 5 — Data Retention and Security

5.1 Retention Periods

Information is retained for the period necessary to fulfil the purpose for which it was collected, and subject to retention obligations under law:

• User Data entered into the Platform — 30 days from termination of the engagement, as set out in section 4.2 of the Terms of Use;
• Account and subscription data — for the duration of the engagement and 12 months thereafter;
• Billing data and invoices — seven years, in accordance with retention obligations under tax law;
• Consent records — for the duration of the engagement and seven years thereafter, for evidentiary and compliance purposes;
• Security, access and error logs — up to 24 months;
• Support requests and correspondence — up to 36 months from the date the request was closed.

At the end of these periods the information shall be deleted or anonymised, except for information that there is a legal obligation or right to continue retaining — including for the purpose of defending against claims or complying with a demand of a competent authority.

5.2 Security Measures

The Company employs technical and organisational security measures in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017, including:

• encryption of sensitive information at rest and in transit;
• role-based access controls and environment separation;
• encryption key management and periodic key rotation;
• access logging and change control;
• periodic backups and restore testing;
• ongoing security reviews and infrastructure updates.

Nothing in the above constitutes an undertaking of absolute immunity. In the event of a serious security incident, the Company shall act in accordance with the reporting obligations under law, including reporting to the Privacy Protection Authority and informing those affected as required.

Chapter 6 — User Rights

Under the Protection of Privacy Law, the User has the following rights:

• Right of access — to request access to the information held about them (section 13 of the Law);
• Right of correction — to request correction or deletion of information that is not correct, complete, clear or up to date (section 14 of the Law);
• Right to request deletion or reduced retention — to the extent such a right exists under law and subject to retention, record-keeping and legal-rights protection obligations;
• Right to withdraw consent — including withdrawal of consent to marketing communications, at any time and free of charge;
• Right to receive the information in an accessible format.

Requests concerning these rights should be sent to support@maybel.io. The Company shall respond within 30 days of receipt of the request.

A User who believes their rights have been infringed may apply to the Privacy Protection Authority.

Chapter 7 — Cookies and Tracking Technologies

The use of cookies and tracking technologies is governed by the separate Cookie Policy, which forms an integral part of this policy.

Chapter 8 — Policy Updates

The Company may update this policy in accordance with changes in law or changes in its activity. Advance notice shall be given of any material change. Continued use of the Platform after the commencement date constitutes acceptance of the updated version.

Chapter 9 — Contact

MAYBEL System Ltd. · Company no. 517052841

Industrial Zone, Taybeh, Israel

Phone: 052-5044885

Email: support@maybel.io