1. Controller and contact
The controller (database owner) for personal data processed through ABATODA is Asher Amar (עמר אשר), an Israeli licensed sole proprietor (עוסק מורשה), business/tax no. 040461501, operating the ABATODA service within the Project 360 (פרויקטים 360) business, 8 Kfar Tavor St., Netanya, Israel (כפר תבור 8, נתניה, ישראל). Contact for privacy requests: 5559166biz@gmail.com.
This notice is written with the Israeli Protection of Privacy Law, 5741-1981 and its regulations (including the Privacy Protection (Data Security) Regulations and Amendment 13) in mind. It does not claim compliance with GDPR or other foreign regimes.
2. What we collect and your choice
Account data: your email address and authentication records (password credentials are stored in hashed form by our authentication system; magic-link sign-in stores no password). Providing information is voluntary unless a collection notice says otherwise. A valid email address and authentication data are required to create and use protected account features; if you do not provide them, you cannot create or use those features.
Organization data: organization name, your membership and role, and invite records (invite codes are stored only as hashes).
Beta access data: the invited email address, beta cohort, access status, and when access was granted, suspended, revoked or completed, with an internal audit trail of who changed it.
Legal acceptance records: which document type and version you accepted, its content fingerprint (hash) and the time. We do not record your IP address for this.
Decisions you run: the requirement text you type is processed to produce a result. Signed-in decisions and saved decisions (title, private notes, result snapshot) are stored for your organization.
Shared reports: if you create a share link, we store only a hash of the token, when it was shared or revoked, and whether notes are included.
API keys: key name, a short prefix, a hash of the key, scopes, creator, expiry, and last-used time. The full key is shown once and never stored.
Usage metering: which API/MCP endpoint or feature was used, when, and by which organization, user or API key, for limits and abuse prevention.
Product analytics: first-party event names with small non-identifying properties such as category slugs, counts and timings, linked to a random per-browser-tab session identifier. We do not store your email or requirement text in these events.
Feedback: the type, optional rating, message, page and, if you include it, the requirement you were looking at. Feedback is optional; declining to provide it does not affect account or beta access.
Browser storage: your sign-in session and a random analytics session identifier are kept in your browser's local/session storage. We do not use advertising or third-party tracking cookies.
3. Why we use it and who receives it
We use information voluntarily supplied by you, and consent where applicable law requires it, to provide and secure services you request: accounts, roles, tenant isolation, decisions, saved work, API keys and beta administration. We also process limited information to keep acceptance records, prevent abuse, understand aggregate use, improve ABATODA and comply with legal duties, but only where authorized or permitted by applicable law.
We disclose personal information only as needed to processors and service providers supporting database and authentication, application hosting and preview, sign-in email delivery, security and operational support; to members of your organization where the feature requires it; and to public authorities or other recipients where disclosure is required or permitted by law. Each recipient may use it only for the relevant service or legal purpose.
4. Minimization and what we do not do
We limit collection to information reasonably needed for the stated purposes and review, at least annually, whether information is still necessary, deleting or anonymizing what is not, subject to the retention schedule below.
We do not sell personal data. We do not use your data for advertising. We do not intentionally collect sensitive categories of data. Requirement text is processed by ABATODA's own deterministic parser; it is not sent to third-party AI models for this purpose.
Please do not submit unnecessary confidential or sensitive personal information in requirements, notes or feedback.
5. Service providers and transfers outside Israel
ABATODA uses Supabase for database and authentication infrastructure (acting as a processor/service provider under its published terms), and Lovable for application development, hosting and preview services as applicable. Other providers may support sign-in email delivery.
Personal data may be processed outside Israel by these infrastructure providers and their subprocessors, subject to applicable law and the providers' contractual safeguards and terms. Server-side retrieval of public vendor documentation does not involve your personal data.
6. Retention and deletion
These are ABATODA's operational retention choices; not every period is required by law. Account, organization profile and membership data: while the account is active and up to 90 days after closure. Saved decisions and notes: while the account or organization is active and up to 90 days after a deletion or closure request. Beta feedback and product analytics: 12 months. API/MCP usage and routine security logs: 12 months. API-key metadata: while active and 12 months after revocation or expiry. Share-link metadata: until revoked or expired plus 90 days.
Legal acceptance records and the beta-access audit trail: 7 years after the relationship or beta participation ends, for evidentiary purposes. A minimal record of privacy requests and their outcome: 7 years. Incident records: 24 months after closure.
A legal hold, security investigation, dispute, material incident or mandatory legal requirement may require keeping specific information longer. You may ask us to delete your data, subject to records we are required or permitted to retain.
7. Security
We use access controls at the database level, role-based permissions, tenant isolation between organizations, hashing of keys and tokens, encrypted connections, and least-privilege server access. No system is perfectly secure; we will handle incidents as required by law.
8. Your rights
Under Sections 13–14 of Israel's Protection of Privacy Law, and subject to their conditions and exceptions, you may request access to information about you held in the database and request correction or deletion where it is incorrect, incomplete, unclear or not up to date. Send requests to 5559166biz@gmail.com; we may need to verify your identity.
Other rights may apply under applicable law, including withdrawal of consent for optional processing. You may also complain to the Israel Privacy Protection Authority.
9. Changes
This notice is versioned and dated. We will tell account holders about material changes, and protected features will ask you to acknowledge the updated version. Owner-approved for the controlled beta; not attorney-reviewed.