This Privacy Policy describes how JumpStart, a product by Otomator (hereinafter: "the Company", "we", "us", "our"), collects, uses, stores, shares, and protects your personal information when you use the Platform, website, and related services.

We are committed to protecting your privacy in compliance with the Israeli Privacy Protection Act, 5741-1981, the Privacy Protection Regulations (Data Security), 5777-2017, and all other applicable laws, including GDPR for European users. This policy constitutes an integral part of our Terms of Service.

1. Information We Collect

1.1 Information You Provide Directly

1.2 Information Collected Automatically

1.3 Information from Third Parties

We may receive information from external service providers, including:

• Payment providers (SUMIT) — transaction approvals/declines, billing details, recurring charge status
• WhatsApp / Meta — message delivery status, blocks, spam reports
• Email providers (Resend, SendGrid) — open rates, bounce rates, unsubscribes
• Google Calendar — event and calendar data (with user authorization)
• Data import services (external CRM, Monday.com, CSV files) — at user's explicit instruction only

2. How We Use Information

We use collected information for the following purposes only:

• Service Delivery — Operating the Platform, managing accounts, processing payments, sending messages, calendar sync, running automations
• Service Improvement — Analyzing usage patterns, identifying issues, developing new features, performance optimization
• Security — Detecting and preventing fraud, intrusion attempts, abuse, and suspicious activity
• Communication with You — Product updates, service notices, invoices, technical support, status reports
• Legal Compliance — Responding to court orders, regulations, and requests from competent authorities
• AI & Automation — Processing business data for built-in AI features (analysis, summaries, recommendations, predictions)
• Aggregate Analytics — Creating statistical reports and insights based on anonymized data

We will never sell, rent, or trade your personal information to third parties for advertising, marketing, or any other commercial purpose.

3. Legal Basis for Processing

4. Sharing Information with Third Parties

We share information only in the following circumstances and to the minimum extent necessary:

4.1 Service Providers (Data Processors)

All service providers are bound by Data Processing Agreements (DPAs) and adequate security standards. We select providers that comply with SOC 2 and/or ISO 27001 where possible.

4.2 Legal Requirement

We may share information if required by court order, competent authority request, or when we believe in good faith that disclosure is necessary to protect our rights, user safety, prevent fraud, or enforce our Terms of Service.

4.3 Business Transfer

In case of merger, acquisition, reorganization, or asset sale, user information may be transferred to the acquiring party, subject to advance notice and continued compliance with this policy or an alternative policy providing no less protection.

4.4 Aggregated Data

We may share anonymized, aggregated data (non-identifiable) with business partners for research, market analysis, or service improvement. Such data contains no identifying information.

5. Data Security

We employ advanced, multi-layered security measures to protect your information:

5.1 Technical Measures

• Encryption in Transit: All traffic encrypted via TLS 1.2/1.3 (HTTPS). SSL certificates managed and auto-renewed
• Encryption at Rest: Database encrypted with AES-256. Backups encrypted
• Data Isolation: Row Level Security (RLS) architecture ensures each Organization can only access its own data. Enforced at the database policy level
• Authentication: JWT-based auth with Supabase Auth. Passwords hashed with bcrypt. MFA (multi-factor authentication) supported
• Role-Based Access Control (RBAC): Feature and data access restricted by user role within the Organization
• DDoS Protection: Cloudflare WAF and DDoS protection active on all traffic
• Content Security Policy: Restrictive headers preventing XSS and injection attacks

5.2 Organizational Measures

• Restricted Access: Database access limited to authorized personnel only, with audit logging
• Least Privilege: Employees access only information required for their role
• Monitoring: Anomaly detection and monitoring systems operate 24/7
• Backups: Daily automatic backups retained for 30 days. Backups encrypted and stored in a separate geographic region
• Security Reviews: Periodic security reviews and dependency updates

No security method is perfect. We follow industry-standard practices and continuously update our protections. If you discover a security vulnerability, please report it immediately to [email protected].

6. Data Retention and Deletion

6.1 Retention Periods

6.2 Account Deletion

You may request full account deletion by contacting [email protected] or through account settings. After requesting deletion: (1) You receive email confirmation within 48 hours; (2) You may export your data (CSV/JSON) for 30 days; (3) After 30 days, all data is permanently deleted from active systems; (4) Backups containing your data are purged within an additional 60 days; (5) Legally-required records (tax records, security logs) are retained as required by law.

6.3 Selective Deletion

You may delete specific records (contacts, messages, files) from within the Platform. Deleted items are removed from active systems immediately and from backups within 30 days.

7. Cookies and Tracking Technologies

7.1 Cookie Types

7.2 Cookie Management

You can manage cookie preferences via your browser settings or account settings. Note that blocking essential cookies will prevent login.

7.3 Do Not Track

We respect the Do Not Track (DNT) signal sent by browsers. When DNT is enabled, we will not use analytics cookies.

8. User Rights

To exercise your rights, contact us at [email protected]. We will verify your identity and respond within 30 days. Complex requests may take up to 60 days with an interim update.

9. European Users (GDPR)

JumpStart serves customers in Europe (including the Netherlands). For users subject to GDPR:

• Legal Basis: Contract performance, consent, legitimate interest, and legal obligation (see Section 3)
• Storage: Data stored on EU servers (Frankfurt) via Supabase
• Transfers Outside EU: Conducted under Standard Contractual Clauses (SCCs) and/or adequacy decisions
• DPO: For GDPR inquiries, contact [email protected]
• Complaints: You have the right to file a complaint with your local Supervisory Authority
• DPA: Data Processing Agreement available upon request for Business customers

10. Children's Privacy

The Service is not intended for children under 16 (or the lower age of consent in your jurisdiction, if applicable). We do not knowingly collect personal information from children. If we learn that a minor's data was collected without parental consent, we will delete it without delay.

11. AI Usage and Data Processing

The Platform includes AI-powered features ("JumpStart AI"). Regarding privacy:

• AI features process your business data to provide insights, summaries, recommendations, and predictions
• Your data is not used to train third-party AI models
• AI processing occurs on secure servers via leading AI providers, under DPA agreements
• Data sent to AI is transmitted encrypted and not retained after processing (stateless)
• We may use anonymized, aggregated data to improve internal models and algorithms
• AI features can be fully disabled in account settings
• No automated decisions with significant impact are made without human involvement

12. International Data Transfers

Our primary database is stored in Europe (EU Central — Frankfurt). Some service providers operate in other countries:

13. Data Breach Response

In case of a security incident that may affect your privacy: (1) We will notify you and relevant authorities (Privacy Protection Authority, and for GDPR — the Supervisory Authority) within 72 hours of discovery; (2) Notification will include the nature of the incident, type and estimate of exposed data, containment and remediation steps, recommended actions you can take, and contact details for questions; (3) We will document every incident including findings, impact, and remediation steps; (4) We will implement changes to prevent similar incidents in the future.

14. Your Responsibility as Data Uploader

When you upload personal data of your end customers to the Platform (contacts, CRM records, etc.):

• You are the Data Controller and we are the Data Processor for this data
• You must ensure you have a lawful basis for collecting and processing the data
• You must inform your end customers that their data is stored on the JumpStart platform
• If an end customer requests access, correction, or deletion — the responsibility to handle the request is yours, and we will provide technical assistance
• When sending WhatsApp/email messages — you must ensure recipient consent

15. Policy Changes

We may update this policy periodically. Material changes (such as changes in data types collected, provider changes, or processing purpose changes) will be posted on the website and sent to your email at least 30 days in advance. Non-material changes (clarifications) take effect immediately upon publication. Continued use constitutes acceptance.

16. Data Protection Registration

The JumpStart database is registered with the Database Registrar at the Privacy Protection Authority, as required under the Israeli Privacy Protection Act, 5741-1981.

17. Contact Us

For questions, inquiries, or requests regarding your privacy:

• General Inquiries: [email protected]
• Privacy & GDPR: [email protected]
• Security Reports: [email protected]
• Website: jumpstart.co.il
• Company: Otomator

We commit to responding to privacy inquiries within 30 days at most.