Privacy Policy

This Privacy Policy describes how Listora ("we", "us", "our") collects, uses, and shares information about you when you use our business automation platform at app.ahava-mehateva.co.il (the "Service").

1. Information We Collect

Account information

When you sign up, we collect your name, email address, business name, and authentication credentials. We use industry-standard password hashing (bcrypt) and never store plaintext passwords. Sessions are secured with signed, httpOnly cookies and CSRF tokens.

Business data

To operate commerce, SEO, and tax features, we process the business data you provide or authorize us to retrieve: product catalog, customer records, orders, invoices, marketing assets, website content, landing pages, and analytics events.

Google account data (OAuth)

If you connect a Google account, we request specific OAuth scopes only for features you explicitly enable:

• https://www.googleapis.com/auth/adwords — to read and manage Google Ads campaigns you own. We display campaign performance, suggest keyword ideas, and let you optimize bids from within Listora.
• https://www.googleapis.com/auth/webmasters.readonly — to read Search Console performance data (queries, clicks, impressions, CTR) for SEO recommendations.
• https://www.googleapis.com/auth/business.manage — to read and update Google Business Profile listings you own: posts, reviews, hours, photos, Q&A.
• https://www.googleapis.com/auth/indexing — to submit new and updated URLs from your sites to Google's Indexing API for faster discovery.
• https://www.googleapis.com/auth/userinfo.email, openid, profile — to identify the connected Google account in your Listora dashboard.

We only receive scopes you explicitly consent to during the OAuth flow. You can revoke access at any time at myaccount.google.com/permissions.

Technical data

We log IP addresses, browser type, and request timestamps for security, abuse prevention, and debugging. Errors are reported to Sentry with PII redacted. We do not use cross-site tracking, third-party advertising cookies, or fingerprinting.

2. How We Use Your Data

• Provide the Service features you enabled (commerce, SEO, invoicing, marketing, analytics)
• Authenticate you across sessions and devices
• Generate SEO recommendations, ad optimizations, and business insights
• Send transactional notifications (password reset, security alerts, invoices, order updates)
• Debug and improve the Service
• Comply with Israeli legal obligations (e.g., SHAAM digital invoicing, BKMV tax export)

3. Google API Services — Limited Use Compliance

Listora's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide or improve user-facing features of Listora that are prominent in the Service's user interface.
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with user notice.
• We do not use Google user data for serving advertisements.
• We do not allow humans to read Google user data unless: (a) we have obtained the user's explicit consent; (b) it is necessary for security purposes (e.g., investigating abuse); (c) it is necessary to comply with applicable law; or (d) the data is aggregated and used for internal operations and has been de-identified.
• We do not sell Google user data.

4. Data Storage & Security

• All data is stored on Cloudflare infrastructure (D1 databases, R2 object storage, KV) with encryption at rest.
• All network traffic uses TLS 1.2 or higher.
• OAuth refresh tokens are encrypted at rest with AES-256-GCM before storage.
• Per-tenant data isolation — each business's data lives in a dedicated D1 database. No shared-table tenant-id patterns.
• Access to production systems is restricted to authorized Listora SaaS personnel with 2FA required.
• All administrative actions are audit-logged.

5. Data Sharing

We do not sell your data. We share data only with:

• Service providers required to operate the Service (Cloudflare for hosting, Google for OAuth'd API calls, Sentry for error monitoring, Cardcom for payment processing, Twilio for WhatsApp Business API) — each under their own data-protection commitments.
• Legal authorities when required by law, court order, or valid legal process.
• You — via data exports, the API, and download endpoints available from your dashboard.

6. Your Rights

Under Israeli law (Protection of Privacy Law, 5741-1981) and, where applicable, the EU GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format (JSON, CSV)
• Revoke OAuth consent at any time
• Lodge a complaint with the Israeli Privacy Protection Authority or your local data protection authority

To exercise these rights, email pluschatgpt856@gmail.com. We respond within 30 days.

7. Data Retention

We retain account data for as long as your account is active. After account deletion, we permanently delete your data within 30 days, except where legally required to retain (for example, invoicing records required by Israeli tax law for 7 years). OAuth tokens are deleted immediately on disconnect.

8. International Data Transfers

Listora runs on Cloudflare's global edge network. Data may be processed in regions closest to your users, including the European Union, Israel, and the United States. We rely on standard contractual clauses and adequacy decisions for lawful transfers.

9. Children

Listora is a business-to-business service not intended for individuals under 16. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this policy. Material changes will be notified via email to all account holders at least 14 days before taking effect.

11. Contact

Listora SaaS
Email: pluschatgpt856@gmail.com