Privacy and Cookie Policy

  • Home Privacy and Cookie Policy

Privacy and Cookie Policy

Last updated: October 2026

1. General

This policy describes what personal information Elipaz Software ("Elipaz", "we" or "us") collects on the website www.elipaz.com, including its Hebrew and English pages, the Studio (our client area) and the job application wizard (together, the "Site"), why we use it, who receives it, how long we keep it and what rights you have regarding it. The policy also includes a section on cookies and local browser storage (section 11).

Elipaz is the controller of the databases created through the use of the Site, as that term is used in the Protection of Privacy Law, 5741-1981 (the "Privacy Protection Law"). Contact details: Elipaz Software, HaNagar 24, Floor 6, Hod HaSharon, Israel, phone +972-9-741-6556, email info@elipaz.com.

This policy applies to information collected through the Site. Information we receive while working on a project for a client, for example data in systems we develop for that client, is governed by our agreement with that client. This policy forms part of the Site's Terms of Use. It is also published in Hebrew, and if there is any inconsistency between the two versions, the Hebrew version prevails.

2. Providing information is voluntary

You are under no legal obligation to give us personal information, and providing it depends on your free will and consent. However, without certain details we cannot provide the service you asked for: without contact details we cannot reply to an inquiry, without identification and verification details you cannot sign in to the Studio, and without the fields marked as required in the application wizard you cannot apply for a job. You can browse the Site without providing any details, but technical information is still collected, as described in section 3.5.

By providing information, you agree that we may use it for the purposes and in the ways described in this policy.

3. What information we collect

3.1 Contact forms

Through the contact forms (on the contact page, the home page and the service pages) we collect the details you fill in: name, email address, phone number, company or organization name, the service you are interested in and your message. We also keep the address of the page the inquiry was sent from, the Site language, the time of submission, your IP address and your browser details (user agent).

The inquiry is sent to us by email and also stored in the Site's database. An inquiry blocked by the anti-spam checks is not sent or stored, but the system log records the reason for the block, the IP address, and the email address and phone number in partially masked form.

3.2 WhatsApp button clicks

When you click the WhatsApp button on the Site, we record for statistical purposes the IP address, the name of the page where you clicked, the page you came from (referrer), the Site language and the time of the click. The click opens a chat in WhatsApp. Your phone number, your profile name and the messages you send us reach us through WhatsApp, and their handling within that service is subject to WhatsApp's terms and privacy policy.

3.3 The Studio (client area)

The Studio is open only to clients we have given access to a project. When we open access for you, we keep the details you gave us: first and last name, email address, mobile number, the organization you are associated with, the interface language, the preferred channel for receiving sign-in codes and your notification preferences. Our team may add internal notes to the record.

While you use the Studio, the following information is collected and kept:

  • One-time sign-in codes, kept only as a one-way hash, together with the time they were sent, the channel and the IP address.
  • Session details: the time of sign-in, the time of last activity, the IP address and browser details.
  • An activity log of the actions you take, such as signing in and out, writing comments and replies, and approving and reopening pages, together with the IP address and browser details.
  • Comments and replies: the comment text, the author's name, the page and the element in the design that the comment refers to (including the text shown in that element), the size of the viewing window, the IP address and an image of the area of the design on which the comment was written. The image is created in the browser from the design itself and is not a capture of your screen or computer.
  • Page approvals: the approver's name, the time of approval and the approved design version.
  • Acceptance of the Studio terms of use: the terms version, the time of acceptance, the IP address and browser details.
  • A record of the emails and text messages sent to you (sign-in codes, updates and replies to comments): the recipient, the subject, a short description and the delivery result. The code itself is not recorded.

Google Analytics is not loaded in the Studio.

3.4 Job applications

Through the application wizard we collect the details listed in section 10, including your Israeli ID number, contact details, education, work experience, salary expectations and CV file.

3.5 Technical and usage information

As on most websites, technical information is collected even when you only browse the Site:

  • The Site's server logs record the IP address, the pages and files requested, the time of the request and browser details. The logs are used for operation, security and troubleshooting.
  • Google Analytics collects statistics on the use of the Site, such as the pages you viewed, the length of the visit, where you came from, the type of device and browser, and your approximate location. See section 11.
  • Google reCAPTCHA checks on the forms that the activity is carried out by a person and not by automated software. To do so, it collects information about your device, your browser and the way you use the page, and sends it to Google. On pages with a contact form it loads after your first action on the page (for example scrolling or clicking), and on the Studio sign-in page and in the application wizard it loads with the page.
  • Some parts of the Site (code libraries, icons and fonts) are loaded from third-party content delivery services such as Google Fonts, cdnjs, jsDelivr and unpkg. As with any request on the internet, these services receive your IP address and browser details.

3.6 Contacting us by email, phone or WhatsApp

If you contact us directly by email, phone or WhatsApp, we receive the details you give us, including the email address or phone number you contacted us from.

4. Why we use the information

  • To reply to inquiries and requests, and to provide quotes and information about our services.
  • To manage our relationship with clients and carry out projects, including showing designs in the Studio, receiving comments and approvals, and sending updates and replies.
  • For identification and verification: sending sign-in and verification codes by email and SMS, managing sessions and preventing unauthorized access.
  • For recruitment: reviewing applications, contacting candidates and keeping applications for consideration for similar positions, as described in section 10.
  • For information security and the protection of the Site, including detecting and blocking spam, intrusion attempts and misuse.
  • To produce statistics on the use of the Site and on the inquiries we receive, and to improve the Site and our services.
  • To comply with legal obligations, keep records and protect our rights in legal proceedings.

We do not sell personal information. We do not use the details you provide on the Site to send you advertising by email or SMS unless you agree to this in advance and explicitly, as required by section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982. Service messages, such as verification codes, replies to your inquiry and project updates, are not advertising.

5. Sharing information with third parties

Information is available to Elipaz employees and service providers who need it for their role, to the extent needed. We share information with third parties only in the following cases:

  • Service providers acting for us: an email delivery service (Resend), which sends inquiries, verification codes and notifications; an SMS service (ActiveTrail), which sends sign-in and verification codes; Google, which operates Google reCAPTCHA and Google Analytics; the hosting and infrastructure providers on whose servers the Site runs and the information and files are stored; and the email service through which we receive inquiries in our mailboxes.
  • The Studio team's work tools: to make the changes you asked for, the content of comments, the details of the elements they refer to and the authors' names may be passed to development and design tools we use, including artificial intelligence tools provided by third parties.
  • Services you choose to use, such as WhatsApp: the information you give there is provided to that service under its own terms.
  • Professional advisers, such as lawyers and accountants, to the extent needed to obtain advice and subject to a duty of confidentiality.
  • Where this is required by law or by an order of a court or competent authority, or to protect the rights, property or safety of Elipaz, of users or of others.
  • In a merger, acquisition or transfer of all or part of the business of Elipaz to another entity that undertakes to act in accordance with this policy.

Our service providers receive only the information they need to provide their service. The use of Google reCAPTCHA and Google Analytics is also subject to Google's privacy policy.

6. Transfer of information outside Israel

Some of our service providers store and process information on servers outside Israel, including servers in the United States and in European Union countries. For example, Google, the email delivery service, WhatsApp and the content delivery services process information on servers abroad. Information is transferred in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, among other things on the basis of the service providers' undertakings to protect the information and to use it only to provide their service. By providing information, you agree to such transfer.

7. Information security

We take reasonable and accepted measures to protect information, in accordance with the Privacy Protection (Data Security) Regulations, 5777-2017, including:

  • An encrypted connection (HTTPS) between your browser and the Site.
  • Restricting access to information to authorized employees and providers who need it, and allowing access to management systems only to users who were granted permission.
  • Keeping sign-in and verification codes only as a one-way hash, and only for a short time.
  • Limiting the number of attempts and requests, Google reCAPTCHA checks and blocking of suspicious activity.
  • Automatically scanning CV files for malicious code, and storing them outside the Site's public folder.
  • Sign-in cookies that scripts in the browser cannot read (HttpOnly) and that are sent only over an encrypted connection.

However, no system is completely secure, and we cannot guarantee that information will never be exposed to unauthorized access. If you suspect that your access to the Studio has been compromised, or if you have come across a security problem on the Site, contact us immediately at info@elipaz.com.

8. How long we keep information

We keep personal information for as long as it is needed for the purposes for which it was collected, and after that as required by law, for record keeping or to protect our rights. In particular:

  • Contact form inquiries and direct inquiries: for as long as they are needed to handle the inquiry and to manage any business relationship that follows, and after that as required by law or to protect our rights.
  • WhatsApp click records: for statistical purposes, for as long as they are needed for that.
  • The Studio: client details, comments, replies, approvals and the activity log are kept for the duration of the project and the engagement, and after that as needed to document the work and protect our rights. A Studio session ends no later than 12 hours after sign-in, or 30 days after sign-in if you chose "remember me" (where that option is available). A sign-in code is valid for 10 minutes.
  • Job applicants: see section 10.
  • Google Analytics data: according to the retention settings of the Site's Google Analytics account and Google's policies.
  • Server and security logs: for a limited time, for operation and security purposes.

9. Your rights: access, correction and deletion

  • Right of access: under section 13 of the Privacy Protection Law, you may inspect the personal information about you held in our databases, yourself, through a person you authorized in writing, or through a guardian.
  • Right to request correction or deletion: under section 14 of the Law, if you find that information about you is not correct, complete, clear or up to date, you may ask us to correct or delete it.
  • Deletion for other reasons: you may ask us to delete information about you even if it contains no error, for example an old inquiry or a job application. We will delete it unless we must keep it by law or to protect our rights, and if so, we will let you know.
  • Direct mail: we do not use information collected on the Site for direct mail. If we do so in the future, we will ask for your consent, and you may ask us at any time to stop and to remove you from the mailing list, under section 17F of the Law.

To exercise these rights, send a request to info@elipaz.com (with the subject "Privacy request") or by mail to our office address. Please include your full name, your contact details, the channel through which you provided the information (contact form, Studio, job application or other) and what you are asking for. To protect the information, we may ask you to verify your identity before we handle the request. We will handle the request within the time limits set by the Privacy Protection Law and its regulations, and generally within 30 days of receiving it.

If you believe that we did not handle your request properly, you may also contact the Privacy Protection Authority.

10. Job applicants

This section applies to applications submitted through the application wizard on the Site's jobs page.

10.1 What details we collect

  • Identification and contact details: Israeli ID number, email address and mobile number (both verified by a code), first and last name and town of residence.
  • Education: level of education, institution, field of study, graduation year (optional) and a short description you wrote about yourself.
  • Experience and terms: current occupation, years of experience, AI tools you work with (optional), a description of your experience, salary expectations, possible start date and a link to a professional profile (optional).
  • The CV file you attached and the result of its security check.
  • Submission details: reference number, the position, the times of verification, the time of consent and the consent text you approved, the IP address and browser details.
  • Information our team adds during recruitment: the application status and internal notes.

The ID number is used to identify the candidate in the recruitment process. Verification codes are kept only as a one-way hash, and only for a short time.

10.2 What the details are used for

The details are used to review your application for the position you applied for, to contact you about it, and to consider whether you are suitable for similar positions at Elipaz, as you approved in the application wizard. We do not use the details for other purposes.

10.3 Who sees the details

  • Elipaz employees involved in recruitment who were given access to the recruitment area in the Site's management system.
  • The recruitment team's mailbox, which receives a notification of each application with its main details (without the ID number). Depending on the recruitment settings, the CV file is attached to the notification or kept on the server only.
  • The service providers described in section 5: the email service that sends the verification code, the notification and the confirmation of receipt; the SMS service that sends the verification code to your phone; Google reCAPTCHA; and the hosting provider.

We do not pass the details to other employers or to recruitment agencies.

10.4 How long the details are kept

  • The CV file is deleted from the server automatically at the end of the retention period set in the recruitment system, 12 months from submission. If the file was sent by email only, it is deleted from the server once the email has been sent. A copy of a file sent by email stays in the recruitment team's mailbox until it is deleted there.
  • A file uploaded for an application that was not completed is deleted automatically within a few hours.
  • The other application details are kept for as long as they are needed for the recruitment process and for considering you for similar positions, and after that as required by law or to protect our rights.

10.5 Asking to delete an application

You may ask us at any time to delete your application, including your CV file, by writing to info@elipaz.com. Please include your name and, if you have it, the reference number you received at the end of the application. Deletion covers the application details, the internal notes and the file kept on the server. After deletion, the event log of the recruitment system keeps a record of the deletion itself, which includes your name and reference number.

11. Cookies and local browser storage

11.1 What cookies and local storage are

Cookies are small text files that a website saves in your browser and that are sent back to it with later requests. Local storage and session storage are areas in the browser where a website saves settings and information without sending them to the server automatically. The Site uses all three for the purposes described in this section.

11.2 Google cookies

  • _ga, and _ga_ followed by an identifier: Google Analytics cookies that distinguish between visitors and between visits for statistics. They are kept for up to two years.
  • Google reCAPTCHA may set its own cookies (for example _GRECAPTCHA) on Google's domain, to detect automated activity.

11.3 Cookies needed for the Site to work

  • elipaz.design.session: the Studio sign-in cookie. It holds a random session identifier, and scripts in the browser cannot read it. Without "remember me" it is deleted when you close the browser, and the session itself expires no later than 12 hours after sign-in. With "remember me" it is kept for up to 30 days.
  • elipaz.jobs.apply followed by the job number: a cookie that identifies your session in the job application wizard. It is deleted when you submit the application and expires no later than two hours after you started.
  • .AspNetCore.Antiforgery followed by an identifier: a security cookie of the application wizard that protects against requests sent in your name from other websites. It is deleted when you close the browser.

11.4 Settings kept in local storage

  • elipaz-a11y-v1: the settings you chose in the accessibility menu (text size, contrast, highlighting and more), so that they stay in effect across pages and on later visits.
  • elipaz.cookieConsent: your choice in the cookie notice ("accepted" or "declined"), so that the notice is not shown again.
  • client-design.favs and client-design.menu, followed by the project identifier: the pages you marked as favorites in the Studio and its menu settings.
  • In session storage, the Studio temporarily keeps the key from your personal link until you close the tab.

11.5 Google Analytics and your choice

Google Analytics currently loads as soon as you open any public page of the Site, except the Studio. When the Site shows a cookie notice, your choice in it is saved in your browser, but at present it does not prevent Google Analytics from loading. To prevent this collection, you can block cookies in your browser settings or install Google's Google Analytics Opt-out Browser Add-on. If we change how this works, we will update this section.

11.6 How to block or delete cookies

Most browsers let you view cookies and the information saved in local storage, delete them, and block cookies, either all of them or those of specific websites. The settings are usually in the privacy or security menu of the browser (Chrome, Edge, Firefox, Safari), and on a phone in the settings of the browser you use. Clearing local storage also resets your accessibility settings and your choice in the cookie notice.

Blocking the cookies the Site needs will prevent signing in to the Studio and submitting a job application. Blocking Google Analytics cookies does not affect your use of the Site. Blocking Google cookies may cause the reCAPTCHA check to fail, and if that happens, you can contact us by phone or email.

12. Minors

The Site and our services are intended for businesses, organizations and adults. We do not knowingly collect personal information from minors under 18 without the consent of a parent or guardian. If you are under 18, do not give us personal details without such consent. If we learn that we received a minor's information without consent, we will delete it.

13. Changes to this policy

We may update this policy from time to time, for example when we add a new service to the Site, replace a service provider or when the law changes. The updated version will be published on this page, with the date of the update at the top. If we materially change the way we use information already collected, we will post a notice on the Site and, where needed, ask for your consent.

14. Privacy contact

For questions, requests and complaints about privacy, you can contact Elipaz Software: