Draft for legal review. A lawyer has not checked this text yet, and it is not binding. Details in square brackets are filled in before publication.
Privacy policy
What we collect on mystory.market and in the app at app.mystory.market, what we do with it and what your rights are. It follows Israel's Privacy Protection Law, 5741-1981, Amendment 13 included.
Contents
1.Who is responsible for your data
[Company name] Ltd., company number [Company no.], [Address], is the controller of MyStory's database. Questions about privacy: [Privacy email].
Privacy protection officer: [Name, if the duty to appoint one applies to us: to be checked].
2.Who this policy covers
- Visitors to mystory.market.
- Businesses and their staff who use MyStory to build and run a store.
- Shoppers in stores built on MyStory: the store you bought from is responsible for your data, and its policy applies. We process that data for the store only, as a holder, and never use it for our own purposes.
3.What we collect
- Account details: name, email, phone and password, stored encrypted. If you sign in with Google, the name and email from that account.
- Business details: business name, type of business, VAT or company number and address, for invoices.
- Billing: your plan, charge history and invoices. The card details themselves stay with the card processor; we keep only a token that lets us charge.
- Store content: products, photos, texts and settings, as well as orders and shoppers' details, which we keep for you.
- Usage: pages and actions, device and browser type, IP address and errors. If you agree, also a recording of how the screen is used, to find faults.
- Messages: what you wrote to us in support, feedback or the contact form, including screenshots you attached.
4.Why we use it
- To run the service: build your store, keep it and show it to shoppers.
- To charge for your plan and issue invoices.
- To give support and answer messages.
- To keep things secure and spot abuse, fraud and faults.
- To improve the product, from usage data in aggregate.
- To send service messages: billing, security and changes to the terms. Marketing email goes only to people who agreed to it, and every message has an unsubscribe link.
- To meet legal duties, such as keeping records for the tax authorities.
5.Do you have to give us data
No law requires you to give us data; you give it by choice and with your consent. Without account details you cannot sign up, without business details we cannot issue invoices, and without a payment method the store cannot open to the public.
7.Data that leaves Israel
Some providers keep data outside Israel, in the United States and the European Union. We transfer data to them under the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, and require them to protect it as the law demands.
8.How long we keep data
For as long as the account is active. When an account closes, there are 30 days to export the store; after that we delete it and the data in it.
Billing records and invoices are kept for as long as tax law requires. Usage data is kept for [period], then deleted or kept without identifying details.
9.Security
Connections to this site and the app are encrypted (HTTPS). The keys to each store are stored encrypted and never reach a browser. Our staff's access to data is limited to those who need it, and every access is logged.
We follow the Privacy Protection (Data Security) Regulations, 5777-2017. If a serious security incident happens, we report it to the Privacy Protection Authority and to the people affected, as the law requires.
10.Your rights
- Access: ask to see the data we hold about you.
- Correction and deletion: ask us to correct data that is wrong, incomplete or out of date, or to delete it.
- Marketing: take yourself off a mailing list, from the link in any message or by emailing us.
- Consent: withdraw consent to analytics cookies and screen recordings at any time.
To use these rights, write to [Privacy email]. We answer within [30] days. If the answer is not enough, you can complain to the Privacy Protection Authority.
Shoppers in a store built on MyStory should write to the store they bought from. If you write to us, we pass the request to the store.
12.Minors
The service is for people aged 18 and over, and we do not knowingly collect data about minors.
13.Changes to this policy
We update this policy when something changes. For a material change we tell you by email and in the dashboard before it applies. The date at the top of the page shows when it was last updated.
14.Contact
[Company name] Ltd., [Address]. Privacy: [Privacy email]. Phone: [Phone].