Venture Lab Public beta. This document is a DRAFT pending legal review. Items marked “pending” (such as business ID and address) will be published before any sales begin. Questions: use the support form.
Privacy Policy — DRAFT
Beta version. Operator: Roee. Business details will be published before sales begin.
DRAFT - REQUIRES LEGAL REVIEW. This document is a template prepared without legal advice. It must be reviewed and approved by a qualified Israeli lawyer (and, for EU/UK users, a GDPR-qualified adviser) before publication or use. Bracketed placeholders must be completed by the owner; no identity details have been assumed.
Last updated: beta draft of 2026-10-17 · Version: beta-draft-1
1. Who is responsible (controller)
Roee (Beta operator), business ID Business ID: pending, Business address: pending, Israel ("we"). Privacy contact: the in-app support form (https://venturelab-app.onrender.com/app/support).
- Israeli Privacy Protection Law, 5741-1981, as amended by Amendment 13 (in force 14 August 2025): we are the "controller" (בעל השליטה) of our account, billing-status, lead and log databases.
- Data protection officer: not appointed.
- EU representative (GDPR Art. 27):. UK representative (UK GDPR Art. 27):.
2. Two roles: controller and processor
- Controller: for your account, billing status, support, security logs, marketing (waitlist) and anonymous page events.
- Processor (on your behalf): for the content you upload or ask us to monitor (cost exports, refund records, CRM configuration snapshots, CI history, API specs, monitored URLs/domains, tender lists, reports). If that content includes personal data of *your* customers or staff (for example names or emails in a Shopify refund export or CI logs), you are the controller and our Data Processing Addendum (DPA) applies. Please upload only the fields the product needs and remove personal data you do not need us to process.
3. What we collect, why, and on what basis
Providing data is voluntary and not required by law; without the data marked "needed" we cannot provide that function (Israeli PPL s.11 notice).
| Category | Examples | Purpose | GDPR legal basis | Needed? | Retention |
|---|---|---|---|---|---|
| Account | email, organization name, password hash (argon2id), role, email-verified flag, date and version of Terms accepted | create and secure your account; prove acceptance of Terms | contract (Art. 6(1)(b)); legal claims (Art. 6(1)(f)) | yes | life of account + 30 days grace, then purged |
| Customer content (processor) | uploaded files, monitored domains/URLs, run results, snapshots, alerts | provide the Services | on your instructions (Art. 28) | yes, for the function used | run history, results, snapshots, alerts: 365 days, or earlier on deletion |
| Usage & security logs | IP address (transient, for rate limiting), timestamps, request metadata, rate-limit counters | security, abuse prevention, debugging | legitimate interests (Art. 6(1)(f)) | yes | rate-limit counters: 48 hours; application logs: Log retention: pending |
| Billing | handled by Paddle as merchant of record; we receive subscription status, plan, country, and transaction reference — never card numbers | entitlements, accounting, tax | contract; legal obligation (Art. 6(1)(c)) | yes, for paid plans | |
| Service emails | verification, password reset, alerts you configure, trial/billing notices | operate the Service | contract | yes | not stored beyond delivery logs |
| Beta waitlist | email, the consent statement you ticked and its version, campaign tags (utm_*), landing page path, referring domain | send you news about the product you signed up for | consent (Art. 6(1)(a)); s.30A Communications Law consent | no | until you unsubscribe, or 365 days |
| Anonymous page events | event name (e.g. page view, or that a free tool showed a result; never the domain, file or text analysed), page path, campaign tags, referring domain — no IP stored, no cookies, no device/user identifier; skipped when Do-Not-Track / Global Privacy Control is on | measure which pages and campaigns work | legitimate interests | no | 365 days |
| Support requests | your message and account email | answer you | contract / legitimate interests | no | 24 months |
We do not sell or "share" personal data (as those terms are defined in the CCPA/CPRA), do not use it for targeted advertising, do not use customer content to train AI models, and do not make decisions with legal or similarly significant effects based solely on automated processing.
4. Who receives data (recipients and sub-processors)
We use service providers listed on our Sub-processors page (hosting, database, email delivery, payment/merchant of record), each bound by a written agreement. Paddle processes payment data as an independent controller and merchant of record under its own privacy notice (https://www.paddle.com/legal/privacy). We disclose data to authorities only where legally required.
5. International transfers
We are in Israel, which has an EU adequacy decision (reaffirmed by the European Commission on 15 January 2024) and is recognised by the UK. Some sub-processors operate in Countries/regions: pending. Transfers out of Israel follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001; transfers of EU/UK data use adequacy decisions, the EU Standard Contractual Clauses or the UK IDTA/Addendum, as applicable.
6. Your rights
- Israel: review your data (s.13) and request correction or deletion (s.14).
- EU/EEA/UK: access, rectification, erasure, restriction, portability, objection (including to direct marketing, at any time), withdrawal of consent, and complaint to your supervisory authority.
- California and other US states: the CCPA thresholds are not currently met by us; we nonetheless honour access/deletion requests and Global Privacy Control signals.
- Self-service: Settings → Download all my data (JSON zip) and Delete account. Waitlist: the unsubscribe link in every email deletes your entry. Other requests: the in-app support form (https://venturelab-app.onrender.com/app/support). We verify identity through your account email and respond within 30 days (Israeli law requires a response to review requests within 30 days).
- Complaints in Israel: the Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority).
7. Security
Passwords hashed with argon2id; session tokens stored only as hashes; tenant isolation enforced on every query; HTTPS in production; outbound monitoring restricted to public addresses; access to production limited to the owner. We follow the Privacy Protection (Data Security) Regulations, 5777-2017. We will notify you and the competent authorities of a security incident as required by law (including the PPA under the Data Security Regulations and, for EU/UK data, within 72 hours under GDPR Art. 33 where applicable).
8. Cookies and similar technologies
App (app domain): strictly necessary cookies only — a session cookie (HttpOnly) and CSRF-protection cookies. Marketing site: no cookies or local storage; an anonymous page-event request is sent unless Do-Not-Track or Global Privacy Control is enabled. No advertising, cross-site tracking or third-party analytics.
9. Children
The Services are for professionals and are not directed to anyone under 18. We do not knowingly collect children's data.
10. Changes
We will notify material changes by email or in-app before they take effect and record the version you accepted.