Privacy Policy
What data we collect, why, and your rights — under Amendment 13 to the Israeli Privacy Protection Law
Updated 10 July 2026
This Privacy Policy explains what personal data the haklaf Platform Operator collects, for what purposes, who it is disclosed to, and what rights you have regarding it — in accordance with the Israeli Privacy Protection Law, 1981, and Amendment 13 to the Law (in effect from August 2025).
1. Who Collects the Data
The Platform Operator owns and operates the haklaf site (the “Platform”, “we”). The Platform operates under a brand name only, with no disclosure of identifying personal details of its operators.
2. What Data We Collect
| Data | Required / Optional | Collected when | Disclosure |
|---|---|---|---|
| Required | Sign-up (Google OAuth or one-time email code) | Never disclosed to other users | |
| Nickname | Required | Sign-up / profile | Public — shown on every listing and the profile page |
| City | Optional | Profile | Always private — never disclosed to any user, intended for future proximity search only |
| Region (e.g. “Center”, “Sharon”) | Required | Derived from the profile city | Public — shown on listings and profile |
| Phone number | Optional (required to publish listings as a seller) | Profile | Disclosed only to the other party after the seller approves a specific buyer’s “interest” in a specific listing — never retrievable in bulk or publicly |
| Full name | Optional | Profile | Not disclosed by default |
| Profile photo, bio | Optional | Profile | Public, if provided |
| Listing photos | Required to publish a listing | Listing creation | Public |
| IP address, device/browser identifiers | Collected automatically | Every access to the service (hosting infrastructure) | Not disclosed — used for security and fraud prevention only |
| Report content, “interest” messages | Generated by use | Reporting a listing/user, contacting a seller | Disclosed only to the relevant party and the moderation team |
Under Amendment 13, IP addresses and device identifiers are defined as personal data in their own right, and are therefore included in this table and handled accordingly.
3. Processing Purposes
- Operating the account, the public profile, and sale listings.
- Facilitating initial contact between buyer and seller (the “interest” flow) and controlled phone disclosure only after approval.
- Preventing fraud, counterfeiting, and abusive behavior, and handling reports and blocks.
- Securing the service and preventing misuse (IP/device analysis for this purpose only).
- Sending operational notices (listing approval, “interest” status updates, a listing-expiry reminder after roughly 30 days).
- Complying with legal obligations, including responding to requests from a competent authority.
4. Legal Basis and Consent
Data processing is based on your consent, given at sign-up and through continued use of the service. You may withdraw consent at any time (as easily as it was given, as required under Amendment 13), by deleting your account or contacting us at the details at the end of this document. Withdrawing consent may require discontinuing use of the service, to the extent the service cannot be provided without the data for which consent was withdrawn.
5. Who Sees What
- Other users — see your nickname, region, profile photo/bio if provided, and your deal count/rating on the public profile and on listings. Your phone number is not disclosed unless a seller approves a specific buyer’s specific “interest”.
- The Platform’s moderation team — has access to reports, listings pending approval, and account details for handling violations.
- Technical subprocessors (see section 6) — solely to operate the service, under data processing agreements.
- A competent legal authority — only if required by law (e.g. a court order).
6. Subprocessors
| Provider | Role |
|---|---|
| Supabase | Database, sign-up/sign-in (Auth), and storage of listing photos |
| Vercel | Site hosting and execution, plus cookieless aggregate usage measurement (Vercel Web Analytics) — no persistent identifier and no personally identifying information |
| Resend | Sending operational emails (verification, “interest” updates, reminders) |
These providers may process data outside Israel. Any such transfer is subject to data processing agreements and standard safeguards (encryption in transit, restricted access permissions). Israel is recognized by the EU as providing an adequate level of privacy protection, which facilitates two-way data flow with EU-based providers; for US-based providers we rely on the contractual safeguards those providers offer.
7. Your Rights
- Access (Section 13 of the Law) — obtain a copy of the personal data we hold about you.
- Correction (Section 14 of the Law) — request correction or completion of data that is incorrect, inaccurate, or outdated.
- Deletion — delete your account and associated data, subject to legal retention obligations (e.g. records of an open report).
- Removal from mailing (Section 17F) — stop receiving non-essential notices.
- Withdraw consent (Section 8C) — at any time, as easily as it was given.
To exercise any of the rights above, contact info@haklaf.co.il. We undertake to respond within 30 days of receiving your request, as required under the Privacy Protection Regulations. If you receive no response within 30 days, you may apply to a Magistrate’s Court, and may also file a complaint with the Privacy Protection Authority (gov.il — Privacy Protection Authority).
8. Data Security
- All traffic between the browser and the server is encrypted (HTTPS/TLS).
- Database access is restricted by Row Level Security — for example, phone numbers are not accessible via any public query path.
- Moderation/admin team access is role-restricted (admin / moderator) and logged.
- We maintain the basic security level set out in the Data Security Regulations, 2017, appropriate to the scope and sensitivity of the data processed (a small database, no sensitive data).
9. Data Retention
Profile and account data is retained for as long as the account is active. Expired listings (after roughly 30 days) are marked as such and no longer shown publicly, but are retained briefly for operational and fraud-prevention purposes before final deletion. Upon account deletion, personal data is deleted subject to legal retention obligations (e.g. records of an open report the user is party to).
10. Minimum Age
The service is intended for users aged 18 and over. We do not knowingly collect data from minors.
11. Cookies
For a full breakdown of the cookies the Platform uses, see the Cookie Policy.
12. Changes to This Policy
This policy may be updated from time to time. A material update will be reflected in the “last updated” date at the bottom of the page.
13. Contact
For any privacy-related question, contact info@haklaf.co.il.
Last updated: July 10, 2026.