Privacy Policy

1. Who we are (data controller)

The MarketLed service is operated by Rafael Cohen, an Israeli Osek Patur sole proprietor. Business registration details are disclosed on receipts issued to paying customers and upon written request.

Contact: [email protected]. WhatsApp: +972508722262.

For the purposes of Israel's Privacy Protection Law Amendment 13, Rafael Cohen is the controller of your personal information.

2. What we collect

Account information

Email, name (optional), password (stored as a bcrypt hash), language, time zone.

Content you upload

Everything you enter into the wizard: business name, sector, target audience, briefs, plus the assets we generate for you (research, positioning, copy, landing pages, lead magnets, ads, video), brand assets, and images.

Usage information

Country derived from IP address, device type, pages viewed, token wallet events, error logs, and request metadata. Vercel Analytics uses a daily-rotating hash, not a persistent identifier. For logged-in users, we use PostHog to record product usage and session replays (with all form inputs masked) so we can improve the product.

WhatsApp information

If you contact us or leave your details through our business WhatsApp number, we receive your phone number, your name (if provided), and message content via Meta's WhatsApp Business Cloud API, so we can reply and manage your inquiry. You can request deletion of this data at any time via our data deletion page.

2A. Leads collected for our customers

MarketLed customers publish landing pages, forms, and booking pages through the Service. If you left your details on such a page (name, phone, email, message content), that information was collected for the business that published the page, and that business is its controller. MarketLed holds the data and processes it solely for that business: secure storage, display in its dashboard, notifications to it, and delivery to systems it connected itself (a webhook, for example Zapier or a CRM), over HTTPS only.

We do not use the details you left for our own purposes, do not contact you, and do not sell the data. To exercise access, correction, or deletion rights regarding an inquiry you submitted, contact the business you reached out to first. You can also contact us directly at [email protected] or via our data deletion page, and we will handle the request with the business within 30 days.

3. Why we collect it (purpose and legal basis)

4. Who we share with (subprocessors)

We do not sell personal information. We do not share data for third-party advertising.

5. International transfers

Your data may be transferred outside Israel, primarily to the USA and the EU. Our main AI provider, Anthropic, is a US company: it stores the data in the USA, and processing may also happen in other countries.

To providers outside the EU we transfer data on the basis of their contractual data-processing terms, including data processing agreements (DPAs) where the provider offers one.

6. Retention

• Account information: while the account is active. After a deletion request it is deleted within 30 days (see the data deletion page).
• Generated content: while the project exists. Deleting a project deletes its content and leads from our system, and most of its files, at once.
• What remains after a project is deleted: what stays with us (for example files in storage, WhatsApp conversations through our business number, the account's credit log and analytics data) is deleted on request, within 30 days (see the data deletion page). Copies at providers (for example emails sent through our email provider) are deleted per their retention periods. What has already left the service, such as emails in your inbox, posts you published on social networks and systems you connected by webhook, stays there, and deleting it is up to you.
• Leads collected for a customer: while that customer's project exists (what remains after it: see the previous item).
• Accounting and payment records: 7 years (tax law).
• Technical server logs: per the hosting provider's retention, at most 90 days.
• Operational backups: deleted data leaves them in the regular backup cycle, within 90 days at most.
• Marketing-consent records: lifetime of the account, plus 3 years.

7. Your rights (Amendment 13)

• Access. Request a copy of your personal information.
• Correction. Request that inaccurate information be corrected.
• Deletion. When the data is no longer needed or has no legal basis.
• Object to processing. Especially direct marketing.
• Portability, where technically feasible.

To exercise a right, email us at [email protected]. We respond within 30 days. You also have the right to file a complaint with the Israeli Privacy Protection Authority.

8. Security

Encryption in transit (TLS 1.2+), encryption at rest (managed by Supabase and Vercel), authentication via Supabase with bcrypt hashing, principle of least privilege, and Row-Level Security on every table. Security incident notice will be provided in line with Amendment 13 timelines, without unreasonable delay.

9. Cookies

We use essential cookies (Supabase session, language preference) and Vercel analytics, which is cookieless. For logged-in users, PostHog sets cookies and local storage for product analytics and session replay. During the beta they are part of the service: a cookie notice is shown when you enter the site, and continuing to browse means you agree. They cannot be turned off separately. If you do not agree, you can stop using the service and ask us to delete your data. We do not load any third-party advertising trackers.

10. AI disclosure

The content you enter is sent to external AI providers to generate output: Anthropic (Claude) for most text, research and web search; Google Gemini in some features, as a fallback and for voice-over; ElevenLabs for voice-over in some video types; Perplexity AI as a research fallback; and fal.ai for images and caption transcription, and through it OpenAI, Google and Recraft, which run some of the image models. Each provider receives only what its task needs.

With Anthropic and Google we use the paid API, where the provider does not train models on the input. ElevenLabs may use the text sent for voice-over to improve its models, under its own terms. We do not use your content to train our own models.

11. Children

The service is not intended for users under 18, and we do not knowingly collect information from children.

12. Changes to this policy

This version applies to new users from 26.10.2026, and to existing users 30 days after the notice about it.

Material change: email and in-app banner notice 30 days in advance. Non-material change: we update the effective date. Continued use after notice means consent.

13. Contact

Email: [email protected]
WhatsApp: +972508722262

Israeli Privacy Protection Authority: www.gov.il/en/departments/the_privacy_protection_authority