Privacy Policy
English translation of the current Hebrew document, version 1.0. View the Hebrew original.
Privacy Policy for Mikud.AI · Effective October 10, 2026 · Version 1.0
This policy explains what information we collect, why, with whom we share it, how long we retain it, and your rights. References to users apply to people of all genders.
1. Who is responsible for the information
Mitchabrim LaAsiya Ltd. (מתחברים לעשייה בע״מ), company no. 516783065, 2 HaMatmid Street, Herzliya, Israel, owns the database and is responsible for processing the information (“the Company” or “we”). For privacy inquiries: office@c2c.org.il.
2. What we collect and why
| Information type | Examples | Source | Purpose |
|---|---|---|---|
| Account and contact details | Name and email address | You, through registration | Account creation, service delivery, and service messages |
| Project content | Idea description, answers, competitors, ratings, sources, and uploaded screenshots | You, in the workspace | Service delivery, saving your work, and pilot quality review with your consent |
| Usage data | Sessions started and completed, actions, and timing | The system | Operating, supporting, and improving the service |
| Technical data | An IP address, browser type, and server logs | The system | Security, abuse prevention, and troubleshooting |
| Payment | Name, amount, date, and receipt number | Payment provider | Collection, receipts, and legal obligations |
| Communications and feedback | Emails and feedback questionnaire responses | You | Customer service and service improvement |
| Consents | Agreement to terms, quality review, and marketing messages, with the date given | You | Recordkeeping and legal compliance |
| AI usage and abuse prevention | Account identifier, action time and type, model, tokens, web searches, estimated cost, reserved amounts, and blocks | The product and AI provider | Budget control, monitoring, and abuse prevention; this log excludes question, answer, and screenshot content |
We do not intentionally collect sensitive information and do not sell personal information.
You are not legally required to provide information. Without account details and project content, we cannot provide the service.
3. Use of AI
3.1. To operate the mentor and competitor research, we send our AI provider, OpenAI, the minimum information necessary for each action. Competitor research uses the product, problem, audience, current alternative, market, search terms, and competitor names. The mentor receives your message and up to three relevant project context items. Your name and contact details are not sent. A screenshot is sent only when you select “Extract text from screenshot,” only for that extraction, after location data and metadata have been removed.
3.2. Under the provider’sAPI terms, it does not use this information for model training and may retain it for up to 30 days for security and abuse monitoring.
3.3. During competitor research, the provider may send search engines queries derived from your business description to locate sources.
3.4. Research content and results are saved in your project and are not transferred to other users’ projects. To improve the product’s rating algorithm, the system uses numerical measures, ratings, and predefined feedback categories to calibrate aggregate weights. Calibration items exclude competitor names, website addresses, sources, free-text explanations, conversations, and images. Internal pseudonymous identifiers link calibration records, so these records should not be described as completely anonymous. Project content is not used to train AI.
4. Who receives information
We share information only with providers helping operate the service, and only as necessary. Each provider is contractually required to protect it.
| Provider | Role | Processing location |
|---|---|---|
| Hostinger | Website and database hosting | France; hosting backups in Lithuania, according to the hosting account reviewed on October 6, 2026 |
| OpenAI | Processing AI for mentoring and research | United States |
| Google Workspace / Gmail | Receiving and handling service inquiries through the c2c.org.il domain | Google data centers worldwide; this policy does not promise a particular storage region |
| Google Drive | Website and database backups in the Company’s account using UpdraftPlus | Google data centers worldwide; this policy does not promise a particular storage region |
We may also disclose information where legally required, under a court order, or to protect our rights. If the business is merged or sold, information will transfer to a party committed to this policy.
5. International transfers
Some providers process information outside Israel. Transfers follow Israel’s Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, based on contractual commitments to protect the information, including a data processing agreement.
6. Information security
Access to your project is restricted to your account. Communication with the website is encrypted using HTTPS, and administrator access is limited to people who need it for support and maintenance. We operate under Israel’s Privacy Protection (Data Security) Regulations, 2017. No system is completely immune to security incidents. If a serious incident occurs, we will act as legally required and notify affected people.
7. How long information is retained
| Information | Retention period |
|---|---|
| Account and project content | Twelve months after the last activity, followed by deletion after advance notice |
| Usage data | Up to twelve months |
| Product security events and administrator access logs | Up to 90 days; pilot deletion follows a documented manual procedure |
| Hosting provider access logs | The Hostinger dashboard displays up to seven days. This is a viewing window. The provider may retain other security and operational logs under its policies and obligations. A comprehensive deletion deadline has not been verified, and there is no commitment that all provider logs are deleted after seven days |
| Backups with the hosting provider, in Drive, and on the Company’s computer | Hostinger manages hosting backups on a rotating basis. Its documentation describes seven days for daily backups and six weeks for weekly backups. The account review on October 6, 2026 found 20 restore points from consecutive dates and weekly copies dating back to August 23, 2026, or 44 days. We therefore do not promise provider deletion within seven or 42 days. Availability may vary with the provider’s cycles. During launch, UpdraftPlus also creates database and site-file backups every twelve hours, retaining up to 28 rotating restore points of each type in the Company’s Google Drive account. After launch, the schedule will change to daily backups. Local working copies and manually locked backups are reviewed weekly and intended for deletion within 42 days, subject to a documented restoration need or legal retention duty. Deleting active-system data does not immediately delete a backup copy. Recorded deletion requests will be reapplied after restoration. |
| Payments and receipts | As required by tax law, generally seven years |
| Consent records | For the duration of the consent, plus three years |
8. Your rights
8.1. You may access information held about you and request correction or deletion. Deletion is subject to information we are legally required to retain.
8.2. If European law applies to you,GDPR also provides rights to portability, restriction, objection, and complaints to a supervisory authority.
8.3. To exercise a right, send a request from your registered email address to office@c2c.org.il. We will respond within 21 days at most.
8.4. If you are dissatisfied with our response, you may contact Israel’s Privacy Protection Authority.
9. Marketing communications
We send promotional messages only with your explicit consent. Each contains an unsubscribe link, and you may also opt out in writing. Service messages related to your account will continue.
10. Cookies and browser storage
We use cookies and local browser storage necessary to operate the service, including sign-in, security, and display preferences. We do not use advertising cookies. Product logs collect necessary operational data. External advertising and analytics tools are not enabled as part of the beta without separate consent. You may block cookies in your browser, but parts of the service may then stop working.
11. Minors
The service is for people aged 18 and older. We do not knowingly collect information about minors.
12. Policy changes
We may update this policy. Material changes will be announced on the website and by email at least 14 days in advance.
13. Contact
Mitchabrim LaAsiya Ltd. · 2 HaMatmid Street, Herzliya, Israel · office@c2c.org.il.
AI usage control during the beta
Service consumption is attributed to an account for monitoring and abuse prevention. The product administrator may see operational usage data and pause an account’s AI service. Access to research content for quality review still requires separate consent. Cost estimates are conservative and are not provider invoices. Pending requests or attempts without confirmed usage may continue to reserve budget until reviewed. Control records are retained during the beta and for up to 90 days afterward for investigation, subject to legal obligations and deletion requests. Pilot deletion follows a documented manual procedure.
Measurement update: October 15, 2026
For people registering after the new route is enabled, basic aggregate measurement operates by default. Existing users without a choice are not enrolled automatically, and previous choices are preserved. This supplements Section 10: basic summaries without a user identifier are separate from detailed usage analysis requiring consent.
To improve product operation, we count stage actions, exports, and AI successes or failures. Counters remain on the site for up to 14 days without a user identifier, session identifier, IP address, research content, or entered information. Reduced daily summaries are transferred to PostHog in Europe. Counts below five are suppressed and others rounded to multiples of five. A summary identifier refers only to a day, not a person. There are no additional measurement cookies or screen recordings.
Detailed analysis over time using a persistent identifier starts only after an explicit choice. An existing refusal of external measurement is preserved and also excludes the new summaries. You may stop future external submissions through Measurement and feedback in the workspace. Historical activity is not resent. Operational and security logs necessary for the service remain separate, as described in this policy.
Public website measurement, October 16, 2026
Basic public-page views are stored on this site for up to 14 days as daily counters, without a person or session identifier, IP address, form content, or browsing URL. A saved refusal excludes future submissions. These are action counts, not unique visitor counts.
Google Analytics and Tag Manager run on public pages only after a separate opt-in, which you can withdraw through “Measurement preferences.” Previous PostHog consent is not treated as Google consent. Research and form content are not sent; session recordings and ad personalization are disabled. Signed-in users are excluded from Google website analytics. Research workspace measurement choices remain separate.