1. Who we are (data controller)
The MarketLed service is operated by Rafael Cohen, an Israeli Osek Patur sole proprietor. Business registration details are disclosed on receipts issued to paying customers and upon written request.
Contact: [email protected]. WhatsApp: +972508722262.
For the purposes of Israel's Privacy Protection Law Amendment 13, Rafael Cohen is the controller of your personal information.
2. What we collect
Account information
Email, name (optional), password (stored as a bcrypt hash), language, time zone.
Content you upload
Everything you enter into the wizard: business name, sector, target audience, briefs, plus the assets we generate for you (research, positioning, copy, landing pages, lead magnets, ads, video), brand assets, and images.
Usage information
Country derived from IP address, device type, pages viewed, token wallet events, error logs, and request metadata. Vercel Analytics uses a daily-rotating hash, not a persistent identifier. For logged-in users who consent to analytics, we use PostHog to record product usage and session replays (with all form inputs masked) so we can improve the product.
3. Why we collect it (purpose and legal basis)
| Purpose | Legal basis | Data used |
|---|---|---|
| Operating the service | Contract | Account + content |
| Accounting and tax records | Legal obligation (Israeli tax law) | Account + payment metadata |
| Abuse prevention and security | Legitimate interest | Usage + IP |
| Product analytics (aggregated) | Legitimate interest | Usage (no cookies) |
| Session replay and behavior analytics | Consent | Usage + masked session recording |
| Marketing email | Consent (opt-in) | |
| Customer support | Contract | Account + ticket content |
4. Who we share with (subprocessors)
| Subprocessor | Purpose | Region |
|---|---|---|
| Vercel Inc. | Hosting, analytics, Speed Insights | USA / global edge |
| PostHog | Product analytics, session replay (logged-in users) | EU (Germany) |
| Supabase | Database, auth, storage, Realtime | EU (Frankfurt) |
| Google (Gemini API) | AI text generation | USA / EU |
| Perplexity AI | AI for research | USA |
| fal.ai | Image generation | USA |
| Firecrawl | Web scraping on your behalf | USA |
| Resend | Transactional email | USA |
| Cloudflare | DNS, CDN (R2 storage planned) | USA / global |
| Stripe (once payments launch) | Payments | USA / EU |
We do not sell personal information. We do not share data for third-party advertising.
5. International transfers
Your data may be transferred outside Israel, primarily to the USA and the EU. Israel-EU transfers are covered by mutual adequacy (effective January 2024). Transfers to the USA rely on the subprocessor's contractual commitments and certifications (for example, DPF).
6. Retention
- Account information: while the account is active, plus 12 months after deletion.
- Generated content: while the project exists, plus a 30-day soft-delete window.
- Accounting and payment records: 7 years (tax law).
- Logs: 90 days.
- Marketing-consent records: lifetime of the account, plus 3 years.
7. Your rights (Amendment 13)
- Access. Request a copy of your personal information.
- Correction. Request that inaccurate information be corrected.
- Deletion. When the data is no longer needed or has no legal basis.
- Object to processing. Especially direct marketing.
- Portability, where technically feasible.
To exercise a right, email us at [email protected]. We respond within 30 days. You also have the right to file a complaint with the Israeli Privacy Protection Authority.
8. Security
Encryption in transit (TLS 1.2+), encryption at rest (managed by Supabase and Vercel), authentication via Supabase with bcrypt hashing, principle of least privilege, and Row-Level Security on every table. Security incident notice will be provided in line with Amendment 13 timelines, without unreasonable delay.
9. Cookies
We use essential cookies (Supabase session, language preference) and Vercel analytics, which is cookieless. For logged-in users, PostHog sets cookies and local storage for product analytics and session replay. These load by default once our cookie notice has been shown and you continue using the site. You can opt out at any time from the cookie settings (in the banner or the footer link). We do not load any third-party advertising trackers.
10. AI disclosure
The content you enter is sent to external AI providers (Google Gemini, Perplexity AI, fal.ai) to generate output. We use the paid API tiers of these providers, where the provider contractually commits not to train on input received via the API. We do not use your content to train our own models.
11. Children
The service is not intended for users under 18, and we do not knowingly collect information from children.
12. Changes to this policy
Material change: email and in-app banner notice 30 days in advance. Non-material change: we update the effective date. Continued use after notice means consent.
13. Contact
Email: [email protected]
WhatsApp: +972508722262
Israeli Privacy Protection Authority: www.gov.il/en/departments/the_privacy_protection_authority