Privacy Policy
Last updated: Oct 10, 2026
Draft — pending legal review. Wording may change.
The Hebrew text is binding; this English translation is for convenience.
1. Who is responsible for your data
N.L.T.N Ltd., company no. 512932443, HaOrgim 13, Ashdod, Israel ("we"). Privacy inquiries and rights requests: support@nltn.co.il.
2. What we collect
- Account and profile: email address, password (stored hashed by our authentication provider), full name, phone number, profile photo, and the starting point you chose (inquirer / owner).
- When you send an inquiry (with or without an account): name, email, phone number, dates or rental period, number of adults and children, the message you wrote, and whether you prefer WhatsApp.
- When an owner publishes a listing: property details, prices, photos, description, information about suitability for Shabbat observers and students (information about the property, not about you), and the exact address and check-in notes — stored separately and never shown on the Site.
- Contact-release records: which inquiry was approved, when, and to whom details were released; and the charge created for the owner by that approval.
- Site activity: favourites, reviews, listing reports, notifications, an owner's calendar token (for exporting availability to an external calendar), and invoices.
- Internal event log: events such as "listing created", "inquiry approved", "review written" — with the user id and time, and no free text.
- Not collected: we use no analytics or advertising tools, and we infer nothing about your beliefs or lifestyle from your searches.
3. Data processed by our infrastructure providers
We store no IP addresses or browser details in our tables; the table structure prevents it. Our infrastructure providers (website hosting and delivery, the authentication service) process your IP address transiently for security and sign-in, under their own retention policies.
4. Is providing information mandatory?
There is no legal obligation. Without certain details we cannot provide the service: without an email there is no account; without a phone number and email no inquiry can be sent (it is the only way the owner can reach you).
5. Why we use your data, and on what basis
| Purpose | Basis (GDPR, for EU residents) |
|---|---|
| Operating your account and sign-in | Performance of a contract |
| Showing listings, delivering inquiries, and releasing contact details after approval | Performance of a contract; for an inquiry without an account — the legitimate interest of both parties in making the contact you asked for |
| Email and on-site notifications about inquiries and status changes | Performance of a contract |
| Charging owners and issuing invoices | Performance of a contract; legal obligation (accounting and tax) |
| Reviewing listings, handling reports, preventing fraud | Legitimate interest; legal obligation |
| Translating content at your request | Performance of a contract (explicit request only) |
| Improving the service using aggregated, non-identifying data | Legitimate interest |
We do not sell data and do not share it with third parties for marketing. We send no marketing email; if we ever offer it, it will be only with your explicit consent, which you can withdraw at any time.
6. Who sees your data
6.1. The owner you contacted: before approval — the name you gave, your dates, party size, message and contact preference. After approval — also your phone number and email.
6.2. The inquirer who contacted you (owners): after you approve — your name, phone number, email, exact address and check-in notes (if they used an account).
6.3. Visitors: the owner's name and photo appear on the listing; property photos are accessible to anyone with the link; reviews show the reviewer's name and photo.
6.4. Our staff: see listings, inquiries (dates, message, status) and reports for moderation — but not inquirers' phone numbers or emails; this is enforced in the database itself.
6.5. Processors acting for us and on our instructions:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | European Union (Ireland) |
| Cloudflare | Website hosting and delivery network | Global network |
| Resend | Transactional email (sign-up confirmations and notifications) | European Union (Ireland) |
| Google Cloud Translation | Machine translation of listing content, at your request | US / global |
| OpenStreetMap / Nominatim | Map tiles (loaded by your browser); server-side geocoding of the property address | UK / Netherlands |
6.6. Authorities, where the law requires it.
7. Maps and location services
When a map is shown, its tiles are loaded from OpenStreetMap, which receives your browser's network address in order to serve them. The public map shows an approximate location only. When an owner enters an address, our server sends it to the geocoding service (Nominatim) to compute coordinates. After an inquiry is approved, a Google Maps link opens only if you click it.
8. Transfers outside Israel and the EU
The database, authentication and file storage are located in the European Union (Ireland). Some other processors process data outside Israel and the EU, including in the US and the UK. Transfers are subject to Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and to the providers' data-processing agreements, which incorporate the EU Standard Contractual Clauses where applicable.
9. How long we keep your data
| Data | Period |
|---|---|
| Account and profile | While the account is active. Account closure — by email request (no self-service closure yet) |
| Hidden listings | Kept until the account is closed or deletion is requested (no self-service listing deletion yet) |
| Inquiries and contact-release records | No automatic deletion today. Kept as evidence for billing and disputes, until a deletion request, subject to law |
| Billing records and invoices | 7 years (Israeli Income Tax bookkeeping rules); issued invoices cannot be altered |
| Internal event log | 24 months; availability-block events — 6 months. Purged automatically |
| Staff moderation log | Retained as the evidence behind decisions; no automatic deletion |
| Listing reports | Retained as the evidence behind decisions; no automatic deletion |
| Notifications | No automatic deletion today; until the account is closed |
| Owner calendar token | Until rotated or the account is closed |
| Uploaded photos | Until removed by the uploader or the account is closed |
The only automatic deletion in operation today is the internal event log. Fixed periods for inquiries, notifications and hidden listings will be set and enforced in the future; until then the data is kept as described, and a deletion request is handled manually, subject to law.
10. Security
Data is encrypted in transit. Access is role-based and enforced in the database itself: an owner sees only inquiries for their own properties; an inquirer's phone number and email unlock only on approval; the exact address unlocks only for the approved inquirer; staff do not see inquirers' contact details. We will notify the Israeli Privacy Protection Authority (and EU authorities where relevant) of a serious security incident as the law requires.
11. Your rights
- Access to the data we hold about you.
- Rectification of inaccurate, incomplete or outdated data (some fields are editable in your dashboard).
- Erasure, subject to data we must keep by law (for example invoices) or for an open dispute.
- Objection to processing based on legitimate interest, and withdrawal of consent going forward. Withdrawal does not undo a release of details already made to an owner.
- For EU residents: also portability and restriction of processing.
To exercise your rights write to support@nltn.co.il. We reply within 30 days. You may also complain to the Israeli Privacy Protection Authority or to the supervisory authority of your EU country of residence.
12. Cookies and browser storage
The Site stores exactly two things in your browser:
| Name | What | Why | How long |
|---|---|---|---|
yiil_locale (cookie) | The language you chose | So the Site opens in your language | One year |
| Sign-in token (localStorage) | Your sign-in | So you do not have to sign in on every visit | Until you sign out |
There are no advertising, tracking or measurement cookies. Because all storage is necessary for the Site to work or reflects a choice you made, there is no cookie banner. If this changes we will update this section and ask for consent as required.
13. Analytics
The Site currently uses no analytics or tracking tools.
14. Minors
The Service is for persons aged 18 and over. We do not knowingly collect minors' data; if we learn that we have, we delete it.
15. Changes to this policy
We update this policy from time to time. The last-updated date appears at the top of the page; material changes are announced on the Site in advance.