This is a translation for your convenience. If it differs from the Hebrew version, the Hebrew version governs. עברית

Israel · Updated: October 11, 2026

Privacy policy

This document explains what information we collect on the kupali.co.il site and in the KupaLi system, why, who it is shared with, how long it is kept and what rights you have regarding it.

Who we are What we collect Why Your customers' data Who we share with How long Your rights Security Contact

1. Who we are

KupaLi is a cloud POS system for businesses in Israel, operated by the service operator, KupaLi Software Solutions Ltd., company no. 517400875 ("we" or "KupaLi"), which is the controller of the database.

The address for privacy matters, including a request to access, correct or delete information, is support@kupali.co.il. Write "Privacy" in the subject line so we can route the request to the right team. The same address is also used for regular support for the system.

2. What information we collect

2.1 On the marketing site

On the marketing site we do not use advertising tracking tools, ad networks or third-party analytics tools. The site stores measurement cookies in your browser only if you have accepted them. The details you provide in the contact form and in the chat are collected when you contact us. In addition, limited usage events on the site are stored, as described below. From the contact form we collect:

Full name;
Phone number;
Business name and line of business, if you filled them in (optional field);
Email address, if you filled it in (optional field);
The page the form was sent from and the page you came from (referrer), to understand the source of the inquiry;
A one-way hash of the IP address. We do not store the IP address itself, only a fingerprint of it, used solely to limit repeat submissions and to prevent misuse of the form.

If our server is unavailable at the moment of sending, your browser saves the form content in the device's local storage (localStorage) so the inquiry is not lost. The information stays on the device and is sent automatically on a retry during your next visit to the site. After successful delivery it is removed from the local queue.

Product files for setting up the POS. The files you send will be processed by an artificial intelligence provider (Anthropic) solely to set up the catalog, and will be deleted within 30 days.

The chat on the site. All chat correspondence is subject to this policy. This is an AI-based sales assistant for people who are not yet customers. Using it is your choice and does not require an account or identification. The messages you send in it, together with the recent messages in the conversation needed for context, are passed to Anthropic, the artificial intelligence provider that drafts the reply for us. A draft that was not sent is not passed on. Messages and replies are kept by us for 12 months to improve our answers (see section 6). Before saving to our log, masking of identified sensitive details is applied, but this masking is not performed before messages are passed to Anthropic and does not guarantee that every sensitive detail is identified. So do not send sensitive information, passwords or payment details in the chat. Your IP address is not stored with the conversation. You can contact us instead through the contact form or by email at support@kupali.co.il.

Measurement on the site. We measure price list views, clicks on action buttons and receipt of inquiries. Measurement events store the event type, time, a known page path and a short action identifier. They do not store an IP address, visitor identifier, browser fingerprint, device details or form content. They are sent to our server, without a measurement cookie and without an external analytics provider, and are kept for up to 90 days. Do Not Track and Global Privacy Control requests in your browser stop measurement events from being sent from it. In addition, the pages and the sign-up form send counts to Growth OS, our sales measurement service (hosted on Vercel): page views (including the first page in a visit), clicks and sign-up steps. The IP address is not stored, only the country. Until you accept cookies, these counts are anonymous: they contain no identifier, and nothing is stored on the device (if you declined, only your choice is stored). If you accept, first-party cookies of the site itself make it possible to count how many different visitors came and how many visits there were (see the cookie policy). Do Not Track and Global Privacy Control requests also stop these counts.

2.2 In the system itself

For customers who use KupaLi, we also process: business and branch details, system users and their permissions, sales data, stock, accounting documents, customer records entered by the business, and technical usage data (access times, errors, approved device identifier) needed for operation and security.

While a user is logged in to the system, we also record the IP address the request came from and the browser string (user agent), alongside the approved device identifier and the login identifier. This record is used to investigate suspicious access and for auditing, so that it is possible to answer the question of who performed an action, from which device and from where. The retention period depends on the type of record. Login and audited action records, meaning who logged in to the system, when, from which device, and who changed a permission, exported data or overrode a price, are kept for 24 months. This is the minimum period set by the Protection of Privacy Regulations (Data Security) for control mechanism data. The regular request log, meaning which screens were opened and when, is kept for 90 days and then deleted, because it is not a security record and there is no reason to keep it longer. The record is created only from activity inside the system: browsing the marketing site does not create such a record, and from the contact form only the one-way hash described above is stored, not the IP address itself.

3. Why we process the information

To get back to you. The details in the form are used for one thing: contacting you about KupaLi, by phone, message or email.
To provide the service. Operating the system, setting up the account, support, billing and maintenance.
To protect the system. Preventing misuse, finding faults and information security.
To comply with legal obligations. Where we are subject to a retention or reporting obligation.

We do not sell personal information, and we do not pass it to advertisers.

4. Information about your customers

When a business manages end-customer records in KupaLi (name, phone, purchase history, club points, credit), the business is the database owner and is responsible for it, and we process the information on its behalf and only according to its instructions. The responsibility to inform end customers, to obtain their consent where required, and to manage the database in accordance with the Protection of Privacy Law, 5741-1981, lies with the business. We do not make any independent use of this information and do not use it to contact end customers.

With service providers who help us operate KupaLi, and only to the extent needed for that:

Railway Corp.: the infrastructure the application runs on, which also hosts the KupaLi database: the database is kept on a dedicated storage volume attached to our service there, not with a separate database provider. Railway operates from the United States;
Resend (Plus Five Five, Inc.): email delivery. It receives only what is needed to deliver the message: the recipient address, the subject line and the content;
Our internal inquiry management system: inquiries from the contact form are sent there: the name, phone, email address if provided, business name and line of business if filled in, the page the form was sent from, the page you came from and the campaign parameters (utm) in the link. It is used only to manage sales inquiries, not for advertising and not for onward transfer;
Telegram (Telegram Messenger Inc.): an alert to the team about a new inquiry. It contains the name, phone number, email address if provided, business name and line of business if filled in, what you asked to hear about and the page the form was sent from, so that we can get back to you the same day. If the alert is not delivered on Telegram, the very same message is sent instead by email to our support inbox. One operational alert from the system also goes through the same channel: when a customer's account reaches its plan limit, we are told the business name and the name of the person who asked to expand it. Nothing else is sent to Telegram (no customer records, no sales data and no access details), and the message is only a reminder; the information itself stays in our database;
Anthropic: the artificial intelligence that runs both the smart assistant inside the system and the chat on the site. It receives what is actually sent in the request: the question asked and the business data needed to answer it. From the system itself, no passwords, register codes or credit card numbers are sent to it;
SUMIT (SUMIT / OfficeGuy): the accounting and payment processing system through which the monthly subscription fees for using KupaLi are collected, and which issues the billing document for us. It receives only billing details: business name, company or business number, email address and phone for sending the document, and the billing amount. Credit card details are submitted directly from your browser to SUMIT and do not pass through our servers and are not stored by us. We store only the last four digits and the card type, for identification. If you chose a bank standing order, your bank, branch and account details are passed to it to set up the debit authorization;
Upay: the card processing company acting on behalf of SUMIT, which actually charges the credit card. It receives the transaction data and the card details provided to SUMIT as described, and no other information from the system;
GitHub: hosts the source code and runs the backup processes and restore tests. A readable copy of the database is transferred over an HTTPS connection to a GitHub Actions runner environment, checked there and then encrypted before it is saved as a private backup file. The encryption secret is stored in GitHub Actions Secrets and is accessible to the authorized backup and restore processes. Therefore, during backup and restore tests the information is also available in readable form in the runner environment; encrypting the saved file does not prevent this access. Retention periods are detailed in section 6.

We will also disclose information if required by law, by an order of a competent authority, or to protect our rights and the integrity of the system. In a future corporate transaction, information may pass to the acquirer, subject to this policy continuing to apply.

Some of our infrastructure providers operate outside Israel, so information may also be stored or processed outside the country. We choose providers that maintain an adequate level of protection, and we sign agreements with them that require them to safeguard the information.

6. How long information is kept

Contact form inquiries: inquiry details are kept for up to 24 months from our last contact with you, and are then deleted automatically.
Active customer data: for the duration of the engagement and a reasonable time after it, subject to retention periods required by law (for example, for accounting documents).
Support conversations: the questions asked in the website chat and in the smart assistant inside the system, and the answers given, are kept verbatim after sensitive details are masked, for 365 days (12 months), and are then deleted.
Login records and audited actions: 24 months, including the IP address and browser string, as described in section 2.2. This is the minimum period the Data Security Regulations set for audit mechanism data, and the system deletes them automatically after that.
Regular request and error log: 90 days, then deleted automatically.
Database backups: the backup process is scheduled every hour. The copy is transferred over HTTPS to a GitHub Actions environment, encrypted there and stored as a private backup file, as detailed in section 5. An hourly copy is kept for 7 days, and one copy per day is kept for 90 days; after that they are deleted automatically. The schedule is meant to reduce the window of activity between backups, but it does not guarantee that every run completes on time. The daily backups make it possible to return to an older copy if a fault is discovered late.

Deletion from backups. Information we deleted from the live system at your request may still appear in backup copies for up to 90 days. The stored files are encrypted and are used for recovery from faults and for integrity and restore checks. For these purposes, the authorized backup and restore processes open and read the copies in the GitHub Actions environment, as detailed in section 5. The copies are deleted automatically at the end of the retention period. If a backup is restored after a deletion we carried out, we will carry out the deletion again.

7. Your rights

Under the Protection of Privacy Law, 5741–1981 and its regulations, you have the right:

to review the information held about you;
to request correction of information that is not correct, complete, clear or up to date;
to request deletion of information, subject to the exceptions in the law;
to request removal from a mailing list or from marketing contact, at any time and without giving a reason.

To exercise any of these rights, write to us: support@kupali.co.il. We will reply within 30 days. If you are a customer of a business that uses KupaLi and you want to review, correct or delete the information that business keeps about you, contact that business, and we will help it handle the request.

If our answer does not satisfy you, you may contact the Privacy Protection Authority at the Ministry of Justice.

8. Information security

Traffic to and from the system is encrypted. Access to information is limited by role and permission, a new device cannot sell until the business owner approves it, and passwords are stored only as hashes. No system is completely immune; if a security incident occurs that requires it, we will notify whoever must be notified, when they must be notified.

9. Changes and contact

If we change this policy, we will update the date at the top of the page, and for a material change we will also notify existing customers. A changed version does not apply retroactively to information that has already been deleted.

For privacy questions and ongoing support: support@kupali.co.il.

Equipment images are renderings; 360° views are simulations for illustration.

Privacy in Israel

Protection of Privacy Law, 5741–1981

To request to review information, correct it, or exercise another right under the Protection of Privacy Law, write to support@kupali.co.il. We will verify your identity, explain any exception in the law that applies, and reply within the time set by law. You can also contact the Privacy Protection Authority.

Nothing in this policy limits rights that cannot be waived under Israeli law. You can contact support to clarify and resolve a dispute, without limiting your right to contact a competent authority or a court.

Personal information is kept only as long as it is needed for the stated purpose or for a legal obligation. Information about the business's customers is processed according to the business's lawful instructions. An accounting or legal need does not justify unlimited retention of information unrelated to it.

The law and the Authority