DRAFT — pending review by the owner and legal counsel. Not yet in effect.
Privacy Policy
This policy explains what Mapapo (mapapo.co.il) collects, why, and your rights. [Owner to complete: legal entity name, address and contact email.]
1. Partner enquiries
Only after you explicitly consent will we share the name, phone, optional email and note you provide, together with the listing or area context, with the partner named in the form. Delivery uses email and, when configured, a signed webhook, solely to respond to your enquiry.
We retain the consent time, named partner and delivery status. Partners pay for enquiries; no details are shared without consent. Account deletion erases enquiries linked to your account from our system; contact the partner to erase copies already delivered. For anonymous enquiries or privacy requests: [privacy contact email].
2. What we collect
Account: email address, display name, and your Google or Apple account identifier when you sign in with them.
Sessions: a secure sign-in cookie with creation, last-use and expiry times.
Usage: a daily count of assistant questions and API requests. For visitors who are not signed in, the count uses a random device cookie and a keyed hash of the IP address; the IP address itself is not stored.
Content you create: likes, saved searches and, for signed-in users, the questions and answers in assistant chats.
Payments: plan, status, billing period, PayPlus transaction reference and invoice links. Card details are handled by PayPlus and never reach us.
API keys: only a hash of each key is stored, with its name, scopes and last-use time.
3. How we use it
To run the service, your account and sync across devices.
To enforce usage quotas and prevent abuse.
To bill subscriptions and issue invoices.
To email sign-in links. We do not send marketing email without consent.
4. Who we share it with
The AI model provider that generates assistant answers receives your question and search context. [Owner to confirm: provider name and data-processing terms.]
Google and Apple — only when you choose to sign in with them.
Our email provider (Amazon SES) — to deliver sign-in links.
PayPlus — to process payments, recurring subscriptions and invoices.
Map tiles load from OpenStreetMap servers and listing photos load from the original listing sites; those servers see your IP address as with any content request.
We do not sell personal data.
5. Cookies and browser storage
We use strictly necessary cookies only: a sign-in session cookie, a short sign-in flow cookie (10 minutes) and a device cookie for the free assistant quota.
Your browser also stores language, theme, likes, searches and local chats. There are no third-party analytics or advertising tools, so no consent banner is required.
6. Retention and deletion
Account data is kept until you delete the account. Deleting it from the account page erases your profile, sessions, chats, likes, saved searches and API keys.
Payment records and invoices are kept for the period the law requires, even after the account is deleted.
7. Your rights
You can access, correct and delete your data under the Israeli Protection of Privacy Law, 5741-1981, and, for users in the EU, the GDPR.
You can delete your account yourself or contact us at [privacy contact email].
8. Security
HTTPS, HttpOnly cookies, CSRF protection, one-time sign-in links valid for 15 minutes, and only hashes of tokens and keys are stored.
9. Children
The service is intended for people aged 18 and over. [Owner to confirm the minimum age.]
10. Changes
We will update this page and its date. Signed-in users are notified of material changes.