Israel · Updated: October 12, 2026
Terms of use
These terms apply to the use of the kupali.co.il website and the KupaLi system, and they are the agreement between the service operator, KupaLi Software Solutions Ltd., company no. 517400875 ("we" or "KupaLi"), and the business and anyone acting on its behalf. Using the service constitutes agreement to them. The way to contact us on any matter relating to these terms, including giving notice under them, is support@kupali.co.il; notice from us will be sent to the email address registered in the account.
1. What the service is
KupaLi is cloud POS software for businesses: selling at the register, stock management, customers, staff, the online store and reports. The software subscription is provided through the browser and does not include the price of hardware. Any equipment purchase, if arranged, will be detailed separately.
KupaLi does not process credit card payments. Card payments are made on the business's own card terminal with its own card processor, and the POS records that the payment was made. We are not a party to the processing agreement, we do not hold transaction funds, and we are not responsible for the operation of the card terminal or the processor.
KupaLi does not issue tax invoices. The system issues the customer its own sales document, a receipt and record of the transaction, but it does not issue a tax invoice, does not assign allocation numbers under "Israel Invoice" (Heshbonit Israel) and does not issue credit invoices. You continue to issue the documents required for tax purposes in the invoicing or accounting software you use today, and responsibility for the documents you issue complying with the law remains yours.
KupaLi is registered in the Tax Authority's software registry and includes export of a uniform-format file (מבנה אחיד). Before filing a report, check that the export is available in your account and that it meets your business's reporting requirements, in consultation with your accountant.
2. Who may use the service
The service is intended for businesses and those acting on their behalf. By opening an account, you declare that you are authorized to act on behalf of the business and that the details you provided are correct. You are responsible for keeping your access details safe, for managing staff permissions and for actions taken in the account.
3. Plans, trial and billing
Free POS is intended for small businesses in Israel: one branch, one user and up to 300 receipts per month. The Register and Smart POS plans are billed per branch. The price and period are shown before you sign up for payment. Prices are before VAT, which will be added as required by law. With annual payment you get 12 months for the price of 10 months. The included features are listed on the pricing page.
A new business can try Register or Smart POS for 14 days without a credit card. One trial per business (Osek) number or company number. We will not charge for a trial without a separate payment approval. At the end of the trial, without a paid subscription, the account moves to Free POS, subject to that plan's limits. Login, support and data export remain available. The end of a trial or a lock does not delete data.
You can cancel a monthly subscription at any time. Cancelling stops the next renewal; paid access continues until the end of the period. Annual payment is not refunded, except where the law requires otherwise. At the end of the paid period, the account moves to Free POS, subject to that plan's limits. On Free POS, in the first month you go over 300 receipts you only get a notice. If it happens again the following month, selling stops until you upgrade; login, reports, billing and export stay open. Non-payment may block selling and editing; login, billing, support and export remain available.
An integrated card terminal is coming soon. An online store is included in Smart POS; customers pay on pickup or by payment link. Signing up for a waiting list is not a purchase and does not activate a service.
We may change plan prices. We will give 30 days' notice of a price change by email, and the new price will apply from the next billing cycle. On an annual subscription, the price is kept until renewal. You can cancel before the change takes effect.
4. Your data
The data you enter into the system, such as products, sales, stock, staff and customers, is yours. We process it to provide you with the service and make no other use of it. You can export it to CSV or Excel at any time.
You are responsible for the lawfulness of the information you enter, and in particular for managing your end-customer database under the Protection of Privacy Law, 5741–1981. See the privacy policy.
5. Fair use
You may not use the service to commit an offence, infringe the rights of others, try to break into the system or other accounts, deliberately create abnormal load, or resell the service to a third party as your own service.
6. Availability and support
We try to keep the service available continuously, but there may be interruptions for maintenance, upgrades or reasons beyond our control. An online store is included in Smart POS; customers pay on pickup or by payment link. After you prepare the device and turn on the option in your account, you can save cash and check sales even without an internet connection. Sales sync when the connection returns. This option does not include card processing without an internet connection. Creating and editing with AI is subject to the usage quotas shown in the system.
Support is included in the price and is given in two ways: the smart assistant inside the system, available at any hour, and email support at support@kupali.co.il Sunday to Thursday, 9:00–18:00.
7. Liability
The service is provided as is. We do not undertake that the service will suit any particular business need or that it will operate without faults. Nothing in this limits rights that cannot be waived under law.
To the extent we are found liable, our liability will not exceed the amounts you paid us in the twelve months before the event. We are not liable for indirect damage, loss of profit or loss of business opportunity.
We recommend keeping an exported copy of the data that matters to you, as with any business system.
8. Cancellation and account access
You can close an account by contacting support. Closing is different from cancelling renewal. We will allow you to export records and will keep or delete information according to the privacy policy and our legal obligations. Records needed for tax, accounting or resolving a dispute may be kept; a lock in itself does not delete data.
9. Intellectual property
The software, design, marks and content on the site belong to us or to whoever permitted us to use them. You may not copy, reproduce or create derivative works from them. Your data remains yours.
10. Changes to the terms
We may update the terms. A material change will be given in advance with reasonable notice, and continued use after it takes effect constitutes agreement to it.
11. Governing law and jurisdiction
These terms are governed by the laws of the State of Israel. Exclusive jurisdiction is given to the competent courts in the Tel Aviv–Jaffa district.
12. Contact
For questions about the terms: support@kupali.co.il, or through the contact page.
13. Data processing addendum
This section is the data processing addendum between the business and us, and it was written according to Regulation 15 of the Protection of Privacy Regulations (Data Security), 5777–2017, which deals with outsourcing of data processing. It details what section 4 already says briefly (your data is yours, and we process it for you) and does not limit it. Where more detail is needed, it is found in the privacy policy, which is an integral part of this addendum.
13.1 Who is who. With respect to your end customers' records (name, phone, email address, purchase history, club points, credit, appointments and notes), you are the database owner and the controller of the information, and KupaLi Software Solutions Ltd., company no. 517400875 is the holder and processor only. We process this information solely to provide you with the service and according to your instructions, and make no independent use of it: not for advertising, not for contacting your end customers, and not for building a product on top of them. Information that is ours directly (the account owner's contact details, billing data and inquiries received through the website contact form) is outside this addendum, and we are the database owner for it.
13.2 What is processed, and for what purpose. Processing covers the types of information you entered or that were created by your use of the system: catalog and prices, sales and returns, stock and its movements, staff records and their permissions, end-customer records as detailed above, and technical access records. The processing operations are storage, retrieval, calculation, backup, restore, sending messages on your behalf (for example, appointment confirmation and reminder) and display in the interface. The scope is limited to what is needed to provide the service, secure it, prevent misuse and meet a legal obligation. There is no processing for any other purpose without your instruction.
13.3 Who on our side touches the information. Access is limited to those who need it to operate the service or to handle your request, and only to the extent needed for that. An employee or provider exposed to the information is bound by confidentiality even after their employment or engagement ends.
13.4 Reasonable security measures. These are the measures that actually exist, and we do not list here any measure that does not:
- Encryption in transit. All communication to and from the system goes over HTTPS.
- Role-based access control. Permissions are enforced on the server, not in the interface, and every query is limited to the account it came from.
- New device approval. An unrecognized device cannot sell until the business owner approves it.
- Hashed passwords. Passwords are stored only as hashes and cannot be recovered, not even by us. The two-factor authentication secret, for those who turned it on, is stored encrypted.
- Rate limiting and input handling. Login attempts are rate limited, and all queries are parameterized, so that user input cannot become a command.
- Backup. The backup process is scheduled every hour. A readable copy of the database is transferred over HTTPS to a GitHub Actions environment and is checked and encrypted there before it is stored as a private backup file. The encryption secret is stored in GitHub Actions Secrets and is accessible to the authorized backup and restore processes. An hourly copy is kept for 7 days and a daily copy for 90 days, and then deleted automatically. During backup and restore checks, the information is also available in readable form in the run environment. Full details are in the privacy policy.
- Access and security records. Login records and audited actions are kept for 24 months, and the regular request log for 90 days. Both are used to investigate incidents.
- Encryption at rest. Information at rest relies on the encryption provided by the hosting infrastructure. We do not undertake here any additional field encryption beyond that, and we will not claim there is any as long as there is not.
No system is completely immune, and we do not claim otherwise. These measures are reviewed from time to time and may change, provided the level of protection is not reduced.
13.5 Sub-processors. We use service providers to operate the system, and pass each of them only what its role requires. The list, as detailed in section 5 of the privacy policy:
- Railway Corp.: the infrastructure the system runs on, which also stores the KupaLi database, on a dedicated storage volume connected to our service. Operates from the United States.
- Resend (Plus Five Five, Inc.): email delivery. Receives only the recipient address, subject line and content.
- Our internal inquiry management system: inquiries received through the website contact form. It contains no records of your end customers.
- Telegram (Telegram Messenger Inc.): alerts to the team about new inquiries from the website, including the name, phone and inquiry details provided, as well as alerts about plan expansion requests that include the business name and the requester's name. If an inquiry alert is not delivered on Telegram, it is sent by email to support. The business's end-customer records, sales data and access details are not sent through this channel. Details are in the privacy policy.
- Anthropic: the AI that runs the smart assistant inside the system and the website chat. It receives what is actually sent in the request. Passwords, POS codes and credit card numbers are not sent to it from the system.
- SUMIT (SUMIT / OfficeGuy): collection of subscription fees and issuing the billing document. Credit card details are sent directly from your browser to SUMIT, do not pass through our servers and are not stored with us; we store only the last four digits and the card type.
- Upay (Upay): the card processor that operates on behalf of SUMIT and actually charges the card.
- GitHub: storage of the source code and running the backup processes and restore checks described in section 13.4. The run environment processes a readable copy of the database and uses the encryption secret stored in GitHub Actions Secrets. The stored backup files are private and encrypted, for 7 days for an hourly copy and 90 days for a daily copy.
What is not used by the Israeli service: Supabase is used only by our US brand (VoVi). The KupaLi database does not sit with it, and it has no access to your information.
Adding or replacing a material sub-processor will be updated in the list in the privacy policy. If the replacement materially changes how the information is protected, we will give advance notice with reasonable notice, and in any case we will sign an agreement with every sub-processor that binds it to a level of protection no lower than that in this addendum.
13.6 Processing outside Israel. Some of the infrastructure providers above operate outside Israel, so information may also be stored or processed outside the country, as also stated in the privacy policy. We choose providers that maintain an adequate level of protection and sign agreements with them that require them to safeguard the information. If a specific location restriction applies to your database by law or by a commitment you made to a third party, raise it with us before the engagement, not after.
13.7 Notice of a security incident. If we learn of a security incident that affected your information, or where there is a real concern that it did, we will notify you without delay and by the most direct means we have: the email address registered in the account. The notice will include, to the extent we have the information at the time: what happened and when it was discovered, which types of information and which accounts are involved as far as is known, what has already been done to stop the incident, what we recommend you do on your side, and the contact person for questions. We will keep you updated as the picture becomes clearer, and we will not wait for a full investigation to give the first notice. The duty to report to the Privacy Protection Authority and to data subjects applies to you as the database owner, and we will help you with the information and evidence needed for this.
13.8 Deletion or return at the end of the engagement. At the end of the engagement, we will give you a reasonable window of time, and no less than 30 days, to export your data, as stated in section 8; export to CSV and Excel is available to you at any time anyway. At the end of this window, and at your request, the information will be deleted on our side. Three reservations worth stating in advance: information we must keep by law (for example, billing documents) will be kept for the period the law requires and will not be used for any other purpose; database backups are encrypted and rotate automatically (an hourly copy within 7 days and a daily copy within 90 days), so information deleted on our side may still appear in them until the end of that period, as detailed in the privacy policy; login records and audited actions are kept for 24 months (the minimum period the Data Security Regulations set), and the regular request log for 90 days. Deletion requests are answered within 30 days at support@kupali.co.il. Conversations with the smart assistant are kept for 365 days and then deleted, and contact form inquiries for up to 24 months from the last contact.
13.9 Help with audits and data subject rights. At your request, to a reasonable extent and at a reasonable frequency, we will give you: an up-to-date description of the security measures in section 13.4, the list of sub-processors in section 13.5, information about a security incident that affected your database, and help responding to a request from one of your end customers who asked to review, correct or delete their information. Such a request is directed to you as the database owner, and we help you handle it. We do not undertake to allow a physical audit of third-party facilities that are not under our control; for those, we will pass on the documentation we received from them, to the extent we have it and it can be passed on. Requests under this section: support@kupali.co.il.
13.10 What remains your responsibility. Registering the database where required, informing end customers and obtaining their consent where required, setting internal policy, managing your staff's permissions in the system and removing access for anyone who has stopped working for you: all of these are yours, and section 4 also repeats them.
Invite a neighboring store: short rules
The program is for KupaLi stores that invite a new store to sign up with their invite code. A store cannot use its own invite code.
The reward is recorded after the invited store issues 3 real receipts within the first 7 days after signing up. Sales that include only sample products from the starter catalog do not count.
Each side gets one free month on a paid plan. The reward is saved in the account and will be used on the first charge on a paid plan.
An inviting store can collect up to 3 reward months for inviting stores. Even after it reaches the cap, every new store it invites gets its own month.
The reward has no cash value. We may change or end the program.
Privacy in Israel
Protection of Privacy Law, 5741–1981
To request to review information, correct it, or exercise another right under the Protection of Privacy Law, write to support@kupali.co.il. We will verify your identity, explain any exception in the law that applies, and reply within the time set by law. You can also contact the Privacy Protection Authority.
Nothing in these terms limits rights that cannot be waived under Israeli law. You can contact support to clarify and resolve a dispute, without limiting your right to contact a competent authority or a court.