Privacy Policy – Vanilla Market

Vanilla Market is a service owned and operated by Easylive Group.

1.1. Nature of the service and identity of the data controller

Vanilla Market is an online service owned and operated by EASY LIVE GROUP (the “Company” or the “Platform”). The Platform provides technological infrastructure for building websites, catalogs, cards and digital profiles, alongside a community and trading space (Vanilla Scoops), and is intended for creators, private users, business owners and brands. The Company is committed to protecting users’ privacy in accordance with the Israeli Protection of Privacy Law, 5741–1981 (including Amendment 13), and its regulations.

• Data controller: EASY LIVE GROUP.
• Address for service and official email for privacy inquiries: support@easylive.click
• WhatsApp inquiry center: 055-995-5679
• Online inquiries: through the contact form on the platform website.

1.2. The parties’ roles and separation of databases

The system operates on a model of database separation according to the nature of the information and control over it:

(a) Personal information of Platform users: For registration details, account settings, security data, payment details, and profile and community content entered by a registered user, the Company is the Data Controller. Users provide this information on their own initiative and of their free choice, and are solely responsible for its accuracy and their right to publish it.

(b) Inquiry and end-customer information (Express Pipe — zero retention): Information originating from visitors and end customers contacting a profile owner or business through contact buttons, forms, a local shopping cart or attendance confirmations is transferred in real time, through a momentary relay, directly to the profile owner’s endpoint channels, such as WhatsApp or external email, without storage, backup or accumulation in the Company’s databases. For this information, the profile owner or business receiving the inquiry is the sole data controller and bears all legal obligations applicable to a controller toward those inquirers.

The sole exception is attendance confirmations for a digital invitation: these are stored solely for that invitation and permanently deleted 60 days after it was opened.

(c) Digital invitations: Details a guest enters when confirming attendance (name, phone number, number of participants and greeting), and notes added by the invitation owner, are used solely to manage that invitation. They are not used for marketing and are permanently deleted together with the invitation 60 days after it was opened. A WhatsApp number entered in an invitation is displayed to guests solely for contact purposes.

(d) System backups: The Company backs up the entire system for recovery from failures. Information deleted from active systems may remain in encrypted backups for a limited period until automatically deleted. These backups are not a service for users.

1.3. Scope of the policy and types of users

This policy applies to every person or entity using the Platform, including unregistered visitors and browsers (for technical information and browsing data), registered users, and editors and designers acting as agents of account holders. An authorized person’s action within an account binds the account holder and is regarded as a direct action of the account holder.

2.1. Appointment and role of the officer under Amendment 13

In accordance with the Protection of Privacy Law, 5741–1981 (including Amendment 13), and its regulations, the Company has appointed a Data Protection Officer (DPO). The officer serves as the professional responsible for implementing, supervising and monitoring the privacy policy, legal requirements and information-security regulations across all Platform systems, and for training authorized personnel within the organization.

2.2. Direct contact details for the officer

Users, visitors and data subjects may contact the Data Protection Officer according to the following channels:

• Officer’s name: Yishai Cohen.
• Exclusive official channel for formal legal requests, reports and exercising statutory rights: in writing only by email to support@easylive.click (marked “For the attention of the Data Protection Officer”) sent from the verified email address registered to the account.
• General inquiry and service channels (do not constitute a formal report or legal request): official WhatsApp center at 055-995-5679 or online inquiry through the contact form on the platform website.

2.3. The officer’s powers, response times and liaison with the authority

The Data Protection Officer is authorized to conduct periodic internal audits of the management and security of information on the Platform, examine the integrity of databases and processing chains, and act as the official liaison with the Privacy Protection Authority.

• Operational questions and routine inquiries: handled on an ongoing basis through the Platform’s support and WhatsApp center during operating hours.
• Formal legal requests: formal requests to exercise data-subject rights, such as access to, correction or deletion of personal information under law, will be handled by the officer as soon as possible and no later than 30 days after receipt of a complete and verified request.

3.1. Account details, business profile and geographical location

When an account is opened and a card or business website is managed, the details entered by the user are collected: display name, business name, business description (Bio), occupation, business category and subcategory, operating hours, profile and cover images, and design settings. Where entered by the user, geographical information is collected, including the city of operation (from a closed list of localities), physical address, postal code and country. These details are collected directly from the user to display the profile, navigate customers, promote local search visibility (Local SEO) and locate businesses within the system.

3.2. Contact information and social networks

The Platform collects communication channels and external links the user chooses to display in the profile or use for account management: mobile and WhatsApp numbers (also used for verification and service communications), landline number, Telegram identifier, email address, direct links to social-network profiles such as Instagram, Facebook, TikTok, LinkedIn and YouTube, and external websites.

3.3. Visual content, media and use of the Studio

The Platform allows visual and audio content to be uploaded, edited and created. Such content is collected and processed as follows:

• Images, documents and graphics: product images, albums, PDF files and graphics uploaded by users or generated using the Platform’s AI tools are stored in secure cloud storage infrastructure.
• Platform video and audio files: videos uploaded by users and original music tracks of the Platform are stored and streamed using advanced storage and content-delivery infrastructure (CDN).
• Clip Maker: images and short videos uploaded by the user to create a clip, together with a song from the Platform library or a personal song uploaded by the user. Video processing, song-beat analysis and transition synchronization are performed locally on the user’s device. When a personal song is uploaded, the user’s confirmation of copyright ownership is recorded in the Platform’s secure activity log. The finished clip is downloaded directly to the user’s device and stored on Platform servers only if the user chooses to publish it as a public post.
• Fashion Video: a product or model image and textual instructions (prompts) entered by the user are transferred for specific processing to produce a dedicated video using specialized video-processing and AI models in a secure server environment, without using the information to train public models.
• Captions and video transcription: videos uploaded by users for transcription and captions. The soundtrack is extracted on the user’s device and transferred as a specific audio file to speech-to-text processing and transcription tools. The audio file is used solely to extract words and time ranges and is not retained as an audio database for other uses.
• Sound waves: a background image and audio file uploaded by the user to create a music video with sound waves and visual effects. Audio-frequency analysis, visualization generation and video encoding are performed directly on the user’s device and browser (client-side). The user’s confirmation of rights in the song is recorded in the Platform’s secure activity log. The finished video is downloaded directly to the user’s device and stored on Platform servers only if the user chooses to publish it as a community post (Scoop).
• PopOut Tool: promotional videos from the Platform library combined with text, stickers and original sound effects, processed and exported directly on the user’s device.

3.4. Activity, community (Vanilla Scoops) and Showcase (Vanilla Showcase) data

Use of the Platform’s community and trading features involves collection of the following information:

• Public community posts (Scoops): posts, images, videos, accompanying songs, location tags and linked product or article tags published by users. This content is visible to all internet users and displayed alongside the display name and profile image.
• Social interaction data: Vibe Score marks, likes, comments, profile follows, saved content, reports of offensive content and user blocks. These actions are stored in the database linked to the identifier of the account performing them.
• Vanilla Showcase: sale or trading listings uploaded by users, including a title, product or service description, price, images and contact details. Listings are retained for 30 days after publication or until removed by the user.
• Reviews and ratings: reviews, star ratings (1–5), text and images posted by registered users about a card or business. Approved reviews are publicly displayed alongside the reviewer’s name. Each review is linked to its author’s verified account; this link is not displayed publicly and may be disclosed only as described in section 6.4.
• Aggregate performance metrics (“My Pulse”): aggregate statistical counts of impressions, profile views and clicks on links and contact buttons. These data are stored solely as aggregate numbers, without user identifiers, IP addresses or personal tracking cookies.

3.5. Payment, processing (Cardcom) and subscription data

The seller in all purchase, subscription and token transactions on the Platform is EASY LIVE GROUP, the operator of Vanilla Market, which issues tax invoices as required by law. Credit-card payments are securely processed by the authorized processor Cardcom, which meets the stringent PCI-DSS Level 1 standard. Full payment-method details, including card number, expiry date and CVV, are entered directly on the processor’s secure payment page and are never exposed to, transmitted through or stored on Platform servers. Platform databases retain only operational reference data: a unique processor transaction identifier, an encrypted payment token for recurring charges (renewing subscriptions only), the card’s last four digits and expiry date (for user identification), plan type (PRO+), billing cycle (monthly or annual), transaction amount, billing dates, action status and system-token balance (✦).

3.6. Technical data, device identifiers and access security (under Amendment 13)

To protect information systems, prevent cyberattacks and comply with information-security regulations, the system automatically collects and records:

• Access verification and identification: at login, the user’s IP address and a digital device fingerprint (a User-Agent string encrypted using a one-way SHA-256 hash function) are recorded to identify suspicious logins and alert the user to access from a new device.
• Security activity log (Audit Logs): detailed records of critical account actions, such as login, password changes, consent approval or withdrawal, Studio copyright confirmations, account freezing or deletion, and formal data-subject requests. This log is retained in a secure, protected environment for 730 days (two years) under an evidentiary retention tier for monitoring, legal defense and compliance with Amendment 13 regulatory requirements.
• Spam and flooding prevention counters (Rate Limiting): temporary counters for inquiry-submission or verification attempts that retain only a technical identifier and are automatically deleted from the database 24 hours after creation.

3.7. Business-player playback-log data (PRO+ Music)

To provide your business with peace of mind and full support in dealings with copyright organizations, the system digitally records playback history (song identifier, playback time, duration, branch identifier and basic connection data). The information is collected to manage the license, secure the service and provide organized records in the event of an audit or inquiry. We respect your privacy and do not collect or track the live GPS location of the playback device; legal protection relies exclusively on the branch address you entered in your account settings.

3.8. Communications, messages and the Counter (Vanilla Counter)

When registered, verified users use the Counter messaging service, the following data are processed:

• Direct messages (1:1): text messages, image files, video files and voice recordings transferred between participants, together with content-free technical delivery receipts.
• Group spaces: message content, media files and voice recordings, group details (name and group image) and participation or broadcast permissions set by the group manager.
• Abusive-content report samples: when a user actively reports an abusive, violent or harassing conversation, a sample of up to the last five messages and media markers, without the media files themselves, is submitted with the reporter’s consent for review and security purposes.

The Company processes personal information only for defined, explicit and legitimate purposes, and in accordance with the legal bases recognized under the Protection of Privacy Law (including Amendment 13) and international law:

4.1. Providing Platform and Studio services and performing the agreement (performance of a contract)

• Establishing, managing, editing and hosting digital business cards, business websites and profile pages.
• Operating Studio and AI tools (image processing, video editing, audio transcription, clip creation and content writing) at the user’s initiated request.
• Operating Vanilla Scoops and Vanilla Showcase for publishing content, updates, listings and catalogs.
• Processing payments, managing PRO+ subscriptions, renewing periodic charges and allocating system tokens (✦) through the authorized payment processor.
• Managing follows, reviews, ratings and identified social interactions between users.

4.2. Exposure, promotion and discovery services (performance of a contract and legitimate interest)

• Displaying the profile and products in search engines (SEO) and on social networks according to the user’s choice.
• Including the profile in maps, sector directories, local indexes, the Vanilla Scoops recommendation network and breadcrumbs to improve business discovery and exposure.

4.3. Information security, fraud prevention and legal defense (legitimate interest and legal obligation)

• Protecting Platform servers and databases, blocking cyberattacks and preventing flooding and spam (Rate Limiting).
• Identifying unauthorized access, alerting users to new-device logins and protecting against abuse of Platform tokens or duplicate accounts.
• Recording critical actions in Audit Logs in accordance with the Protection of Privacy Regulations (Data Security), 5777–2017.
• Retaining legal evidence and licenses, including copyright declarations and acceptance of terms, for evidentiary and legal-defense purposes.

4.4. Operational and service communications (performance of a contract and consent)

• Sending service and operational emails (account verification, receipts and payment confirmations, security alerts and administrative notices).
• Sending browser push notifications of updates and new content only with active, explicit consent (Opt-in), revocable at any time.

4.5. Content personalization, advertising and service improvement (legitimate interest)

• Displaying advertisements and marketing or sponsored content across all system plans, on cards and in the community feed, in accordance with the Terms of Use.
• Aggregate, anonymous statistical analysis of usage patterns and card performance (“My Pulse”) to optimize and continuously improve the Platform.
• General geographical and business segmentation to tailor relevant services by region and develop future system capabilities.

5.1. Nature of cookies and local technologies (Cookies & Web Storage)

Cookies and local storage technologies (LocalStorage and SessionStorage) are small text files or data records stored in the user’s browser or device when visiting the website.

The Platform uses local storage records only for essential operational purposes: retaining interface-language choices and customized accessibility preferences, managing items in a business card’s local shopping cart (stored only on the user’s device), retaining management-dashboard editing drafts to prevent information loss, recording cookie-consent status, and locally storing direct-conversation history in the Counter (in the browser’s or app’s local database on the user’s device only) for continuous viewing of messages.

5.2. Platform cookie categories and retention periods

• Essential & Security cookies: necessary for basic, proper website operation, verification of signed-in users, cyberattack protection, retention of system preferences and continuous operation. These cookies are always enabled and cannot be disabled through the consent banner. Validity: from the duration of a visit (Session) up to 7 days.
• Analytics cookies: used to collect aggregate, anonymous statistical data on website usage (page views, time spent and browsing paths), for measurement, efficiency and Platform performance improvements. Disabled by default and enabled only with active consent. Validity: up to 12 months.
• Marketing and advertising-measurement cookies: used to measure the effectiveness of the Platform’s advertising campaigns. Disabled by default and enabled only with active consent. Validity: up to 12 months.

5.3. Statistical measurement using Google Analytics 4 (subject to consent)

The Platform integrates Google Analytics 4, operated by Google. It is activated only after the user expressly consents to the statistics-cookie category in the consent banner. Measurement is aggregate and anonymous, without sending names, phone numbers, email addresses or any personally identifying user details to Google.

5.4. Advertising-performance measurement using Google Ads (subject to consent)

The Platform measures advertising-campaign results using Google Ads tags for only two defined target actions: account registration and purchase of a PRO+ subscription or tokens.

The tag is completely blocked and does not load on the user’s device until active, explicit consent is given to the marketing category in the consent banner.

The Platform does not transfer payment details, credit-card numbers, usernames or personal contact details to Google through conversion tags. Duplicate conversion registration is prevented using a temporary technical identifier held only in the device’s local memory.

5.5. Preference management, consent withdrawal and cookie deletion

On the first website visit, a consent banner allows users to accept all cookies, reject statistics and marketing cookies (essential only), or individually customize approved categories. The choice is retained for 365 days unless the user deletes it earlier.

Users may change their choice or withdraw consent at any time by opening the website’s cookie-settings banner or changing browser settings (blocking cookies, deleting browsing data or using private browsing).

Blocking all essential cookies through browser settings may prevent account login, disrupt payment and purchase processes, or impair proper operation of various website features.

6.1. Non-sale of information and scope of sharing

The Company does not sell, rent or trade users’ personal information with third parties for their independent commercial or marketing purposes. Personal information is shared only to operate, secure and provide Platform services, as detailed below.

6.2. Categories of authorized service providers and data processors

To provide services, the Platform uses service providers and subcontractors acting as Data Processors in the following categories:

1. Cloud infrastructure, storage and databases (Supabase, Cloudflare): hosting system servers, managing secure databases, backups, and storage of media and documents uploaded by users.
2. Cybersecurity, content delivery networks (CDN) and load protection (Cloudflare): global browsing acceleration, web application firewalls (WAF) and protection against distributed denial-of-service attacks (DDoS).
3. Payment processing (Cardcom): an authorized processor meeting PCI-DSS Level 1 for financial charges, lawful tax-invoice issuance and subscription management.
4. Operational email, push notifications and service messages: systems sending service messages, account verifications and security alerts by email from official Platform domains, including notify.vanilla.market, and browser and app push-notification services (Web Push and Firebase Cloud Messaging) for users who expressly consented.
5. Artificial intelligence and advanced media processing: specialized model providers operating editing, transcription and Studio tools, processing specific information at the user’s request without using it to train public models.

6.3. Provider obligations and outsourced processing security

All external data processors and subcontractors (infrastructure, cloud, payment and AI providers) operate under binding Data Processing Agreements (DPA) or protected commercial terms of service. They are carefully selected and hold leading international security and quality certifications, such as ISO 27001, SOC 2 or PCI-DSS Level 1, or comply with GDPR principles. Providers may access and process information only according to the Company’s explicit instructions and solely to provide services, are subject to contractual confidentiality obligations, and must implement appropriate information-security measures.

6.4. Disclosure required by law, judicial orders and legal defense

The Company may disclose personal information to competent authorities, law-enforcement agencies or courts when required by judicial order or binding law, or to defend against claims, prevent serious fraud, thwart cyberattacks and protect the rights and safety of users or the public.

6.5. Restructuring, mergers and transfer of operations

If the Company’s ownership structure changes, it merges, sells Platform operations or transfers all or part of its assets to a third party, the Company may transfer databases to the transferee, provided the transferee assumes all obligations and conditions in this Privacy Policy.

7.1. Specific information transfers to AI providers

Data transfers (images, textual instructions, prompts or audio files) to operate AI and Studio editing tools take place directly with authorized technology and AI providers through paid commercial APIs.

7.2. Exclusion of model training and temporary provider retention conditions

Under AI providers’ service and privacy terms for commercial API accounts, transferred data are not used to train public models. Information is processed in real time and may be retained on provider servers only for a temporary, limited period as required for system security, monitoring and abuse prevention (Trust & Safety), in accordance with the official terms of service and privacy policies published on those providers’ websites.

7.3. Limits on internal retention, disclaimer and user responsibility

The Platform itself does not retain raw audio files transferred for transcription and does not accumulate audio or prompt databases for independent analysis. The Company does not control and is not responsible for policy changes, security failures or information management on external providers’ servers. Use of these tools is subject to the stated technological limitations and provider terms. Users are solely responsible for ensuring that submitted information and files do not contain confidential information, unauthorized sensitive third-party information or copyright-infringing content.

8.1. Profile owner’s role as an independent Data Controller

Across all service plans, the business-profile user is the sole controller and database manager for all inquiries, messages, leads and attendance confirmations received from passersby and visitors through their digital card.

8.2. Use limitation and explicit consent for information transfers

The profile owner undertakes to use inquirers’ details solely for the direct, specific purpose for which they were provided when the inquiry was sent. The profile owner will not sell, rent, trade or transfer inquirer details to any third party for independent commercial use unless, before the information is provided or while it is entered, the inquirer receives explicit, clear and transparent disclosure of the intention to transfer the inquiry to additional parties (for example, to obtain quotations from external suppliers) and provides active, informed and explicit consent (Opt-in) under law. Full and sole responsibility for obtaining and documenting lawful consent rests with the profile owner.

8.3. Operational cooperation with the profile owner’s service providers

The profile owner’s transfer of inquirer details to service providers acting on their behalf solely to fulfill the inquiry and provide the direct service (such as shipping and distribution companies, customer relationship management systems, tax advisers and accountants, or authorized employees), or disclosure required by judicial order or binding law, does not constitute sale, trading or a prohibited transfer of information and does not require separate consent, provided it is lawful and solely for that purpose.

8.4. Compliance with privacy law and prohibition of spam

The profile owner declares and undertakes to comply with the Protection of Privacy Law, 5741–1981, its regulations and Privacy Protection Authority guidance, and strictly comply with section 30A of the Communications Law (Telecommunications and Broadcasting), 5742–1982 (the “Spam Law”), including absolutely refraining from sending advertising messages without lawful explicit consent and providing a simple unsubscribe mechanism in every future communication.

Profile owners are strictly prohibited from requiring sensitive information in inquiry forms, questionnaires or attendance confirmations, including full credit-card details, security codes, access passwords or medical information.

8.5. Independent handling of access, correction and deletion requests

Because the Platform does not retain inquiry details in its databases and transfers them directly to the profile owner’s communication channels, the profile owner is solely responsible for providing a direct and complete response to all inquirer requests to exercise legal rights, including access, correction of inaccurate information, deletion from the owner’s independent databases or exclusion from mailing lists.

8.6. Technological conduit (Express Pipe), absence of a legal relationship and full indemnification

Vanilla Market provides only technological infrastructure and a conduit for real-time information transfer and is not a party to any engagement, commercial relationship or exchange between a profile owner and inquirers. Any allegation, demand, complaint or claim by a visitor or third party concerning use of their details, inquiry handling, unauthorized mail or privacy infringement must be directed directly and exclusively to the profile owner. The profile owner undertakes to indemnify, compensate and defend Vanilla Market, its operators, directors, employees and representatives against any damage, loss, expense (including attorneys’ fees and legal costs), administrative fine or financial liability imposed on them due to the profile owner’s breach of this chapter or the law.

Personal information may be stored, backed up and processed on secure servers outside Israel, including in European Union countries and the United States. Information is transferred only to world-leading cloud infrastructure, storage, computing, cybersecurity and AI providers acting as authorized data processors for the Company.

All providers are subject to binding DPAs, meet stringent international security standards such as SOC 2 and ISO 27001, and are committed to protection no lower than that required by Israeli law and regulations on information transfers abroad, including appropriate contractual commitments (Standard Contractual Clauses — SCCs) and GDPR principles.

10.1. Storage quotas and behavior when capacity is exceeded

The Platform allocates cloud storage to each user according to their plan:

• Vanilla Shot plan: maximum storage of up to 100MB.
• PRO+ plan: maximum storage of up to 15GB.
• Exceeding capacity: once the quota is fully used, including after moving from a paid plan to Vanilla Shot, new media, image and content uploads are blocked until the user frees space or upgrades. Exceeding the quota does not cause existing files to be deleted.

10.2. Structural distinction between user-initiated deletion and freezing and deletion at the end of Vanilla Shot

The system manages two separate procedures for data and accounts:

• User-initiated account deletion (exercise of the “right to be forgotten”): when a user deletes their account through the management interface or expressly requests deletion, the Company permanently deletes personal information, the business profile, content and files stored in cloud buckets. At the same time, for information security, cyber protection and prevention of fraud or abuse, the system generates a one-way mathematical security signature (an encrypted SHA-256 hash) of the email address. This signature contains no identifying information (No PII), does not allow reconstruction of the email address and is retained in a protected internal security table to prevent malicious registrations and repeated use of benefits, and to prevent re-registration of a blocked account until its block period ends.
• Freezing and deletion at the end of Vanilla Shot: Vanilla Shot is valid for up to 12 months from the first Platform registration. The period is continuous and does not reset on upgrading, downgrading or deleting and re-registering an account. At the end of the period, an account without an active paid subscription is frozen: the card and content are hidden from all public pages and data are retained for 90 days. Upgrading to a paid subscription during freezing restores the account and content. After 90 days of freezing without upgrading, the account and all its data, files and content are permanently deleted in the same manner as user-initiated deletion.

10.3. Inquiry, lead and RSVP data

Inquiry details, business-card contact forms and attendance confirmations (RSVP) are not accumulated or backed up in Company databases, but are transferred directly in real time to the profile owner’s external communication channels (Express Pipe). Limited technical data used to thwart spam and flooding attacks (submission counters by IP address) are automatically deleted after 24 hours. These provisions apply to external website inquiries and do not concern the Counter’s internal messaging service, which operates under a separate framework.

10.4. Appointment scheduling (Booking) data

Appointment scheduling through a business card includes only the inquirer’s name and appointment time, without storing phone numbers or other identifying details in the database. These data are automatically deleted one day after the scheduled appointment.

10.5. Community content, Scoops and social interactions

Content and posts published in the community are retained while the account remains active, subject to community rules and law. Vibe marks, likes and comments are retained for as long as the relevant post exists; deleting a post removes its comments and interactions. User-initiated account deletion also deletes that user’s interactions on other users’ content.

10.6. System notifications and routine communications

Internal messages and notifications displayed in the dashboard bell interface are automatically deleted 90 days after creation, regardless of whether users read them or mark them as read. Specific system notifications relating to messages in Counter groups are deleted in line with the message lifecycle and are not retained beyond 14 days.

10.7. Security logs, audits and legal records

• Routine security logs (Audit Logs): records of security actions, account access, permission changes and copyright declarations are retained for 730 days (24 months) in a secure environment, under regulation 17 of the Protection of Privacy Regulations (Data Security) and Amendment 13.
• Contractual and transaction records: legally significant records (acceptance of terms, plan changes, payment-transaction identifiers and receipts) are retained for 7 years for accounting audits, tax law and defense against legal claims.
• Technical error logs: software-error and system-monitoring data are automatically deleted after 90 days.
• Business-player playback-history report (PRO+ Music): to provide organized records and support in dealings with enforcement bodies, playback logs are retained throughout the subscription. The dashboard offers a convenient Export tool to download a detailed report at any time. Upon subscription cancellation or account closure, the data remain available for download for another 90 days and are then deleted from the personal area. Users are solely responsible for downloading and retaining the report before the period ends to preserve future evidence. Beyond 90 days, we cannot reconstruct or produce the report again, except for closed technical records retained by the Platform “behind the scenes” for security, internal monitoring and legal compliance.

10.8. Counter conversation and message data (Vanilla Counter)

• Direct conversations (1:1): text and media messages pass through system servers as a temporary Store-and-Forward Relay for routing and delivery. Once a technical confirmation is received that the message was saved on the recipient’s device, the text content is removed from the active database and permission to retrieve the media is revoked. Undelivered messages and media remain available for delivery for up to 14 days from sending; after that, access to retrieve them again is revoked and they are queued for physical deletion in an hourly maintenance cleanup.
• Group conversations: messages and media in group spaces are retained for display to authorized participants for up to 14 days from the sending of each message, after which access is revoked and they are queued for physical deletion in an hourly maintenance cleanup.
• Local device history: direct-conversation history is stored locally on the user’s device and is the user’s sole responsibility. The Company provides no archive, restore or cloud-backup service for these conversations, and deleting data from system servers does not delete copies already saved on the device.
• Report samples: report samples submitted at a user’s initiative (up to the last five messages) are retained in a secure management environment for the period required to review the complaint and for legal-defense purposes, and are not subject to the regular hourly deletion.

11.1. Security principles and data encryption

The Company implements advanced technological and organizational information-security measures in accordance with the Protection of Privacy Law, 5741–1981, the Protection of Privacy Regulations (Data Security), 5777–2017, and accepted international standards.

• Encryption in transit: all communications and data transfers between the user’s browser, Platform interfaces and cloud servers are protected and encrypted using stringent TLS/SSL protocols.
• Encryption at rest: databases, cloud storage servers and system data are encrypted using modern mechanisms accepted in the cloud industry, according to the stringent standards of the Platform’s secure infrastructure providers.

11.2. Permission control and database isolation

The system architecture follows Least Privilege and Zero Trust principles:

• Row-Level Security: user access to database records is limited and managed directly by the data engine, so users may view and edit only information associated with their verified account.
• Public information isolation through dedicated views: public profile and card pages access only cleaned, isolated data views that do not contain or expose internal system identifiers, security data or sensitive personal fields.
• Denial of bypass permissions: anonymous access roles are limited to authorized public reads only, with complete blocking of modification or system-command execution capabilities.

11.3. Identity verification, account protection and device identification

The Platform uses multilayer protection to safeguard user accounts and prevent hostile takeover:

• Access verification and password hashing: passwords are never retained as readable text, but stored using secure one-way cryptographic hash functions with unique salt encryption.
• New-device login detection: the system produces an encrypted SHA-256 digital fingerprint of device and browser characteristics at login. Access from a new or unknown device triggers an immediate security alert to the account holder’s email address.
• Multistep verification for sensitive actions: critical security actions, particularly final user-initiated account deletion, require enhanced verification through a one-time code (OTP) or a dedicated confirmation.

11.4. Protection against attacks, bots and file filtering

Platform interfaces and servers are protected against network attacks and automated malicious activity:

• Load control and flooding prevention (Rate Limiting): request-frequency limits by IP address and usage level apply to sensitive paths, including inquiry forms, sending actions and file uploads, alongside cloud-infrastructure protections against denial-of-service attacks (DoS/DDoS) and interface flooding.
• Hidden bot filtering (Honeypot): contact and RSVP forms include dedicated code traps to identify and silently block bots and automated scanners without burdening human visitors.
• Closed file-type list (MIME Allow-list): storage servers enforce strict filtering allowing only images, videos and PDF documents, and entirely block executable files, scripts such as HTML, SVG or code files, and archives that may contain malicious content.

11.5. Security logs, monitoring and ongoing control

Under regulation 17 of the Protection of Privacy Regulations (Data Security), the system maintains automatic, controlled and secure records of every material security event (Audit Logs), including login attempts, permission changes and legal consents. These logs are stored in an isolated, protected environment without users being able to independently edit or delete them.

11.6. Security-incident response and reporting under law

The Company maintains an organized Incident Response Procedure. In a serious security incident raising a real concern of harm to the confidentiality, integrity or availability of personal information, the Company will act immediately to contain, investigate and remedy the incident. The Company will report to the Privacy Protection Authority under law (no later than 72 hours after learning of the serious incident) and notify potentially affected data subjects as required by law and authority guidance.

11.7. User responsibility for safeguarding access details

Information security is a shared responsibility. Users bear full and sole responsibility for keeping passwords, verification codes and account-access details confidential and not sharing them with third parties. Suspected unauthorized use, leaked access details or an account breach requires users to immediately change login details and notify the Company without delay.

The Company applies advanced, stringent security measures meeting legal requirements, but cannot guarantee absolute, final immunity of its systems from unauthorized access or malicious cyberattacks by hostile parties.

12.1. Right of access and independent updates

Under section 13 of the Protection of Privacy Law, 5741–1981, every user may access personal information about them held in Company databases. Most information (profile details, content, products and account settings) can be viewed and independently updated directly through the dashboard at any time without contacting the Company.

12.2. Right to correct, delete and complete information

Under section 14 of the Law, users who find that stored personal information is incorrect, incomplete, unclear or outdated may correct or delete it through the dashboard or request that the Company do so.

12.3. Data portability and downloading personal information

Registered users may independently download a JSON file through the dashboard (Account tab → “Download my data”), containing profile, content, product, billing, notification and security-log data, as well as community activity (Vibe marks, likes, comments, clicks, blocks, reports and points). One file may be downloaded every 24 hours.

For security reasons, the file excludes payment-method details, bank-account details, technical keys and tokens. It excludes visitor inquiries and leads because they are transferred in real time and not stored in Company databases, and excludes identifying information about other users.

12.4. User-initiated account deletion (the “right to be forgotten”)

Users may independently delete their account through the dashboard after enhanced identity verification. Deletion is immediate, complete and irreversible: personal information, the profile, content and files are permanently deleted, and no copies are retained for restoration.

After deletion, only the following are retained: an anonymous one-way email-address hash that does not allow reconstruction of the address and prevents abuse of registration benefits; financial transaction records for 7 years under tax and legal obligations; and security logs for 730 days under the Protection of Privacy Regulations (Data Security).

12.5. Submitting requests, identity verification and response timelines

Requests to exercise rights that cannot be fulfilled independently through the dashboard must be submitted to the DPO in writing only, by email to support@easylive.click. To protect personal information and prevent unauthorized disclosure, requests must be submitted from the verified email address registered to the account to enable identity verification. An inquiry via WhatsApp, the contact form or social networks does not constitute a formal request and does not trigger the statutory response timelines under law.

The Company will respond to an access or correction request within 30 days of receipt. If refused, a reasoned written refusal will be provided.

12.6. Right to contact the Privacy Protection Authority and appeal to court

Under section 15 of the Law, a user whose access or correction request was refused or not answered within 30 days may appeal to the Magistrates’ Court within 30 days after delivery of the refusal or expiry of the response deadline. Every user may also submit a complaint to the Privacy Protection Authority.

12.7. Minimum age (18+) and protection of minors

The Platform is intended only for users aged 18 and over, and users declare their eligibility when registering. The Company does not knowingly collect information from minors. If an account is found to have been opened by a minor, the account and associated information will be removed immediately.

13.1. Fundamental distinction between operational and marketing messages

The Platform strictly distinguishes service and operational messages necessary for account operation, security and contractual service provision from marketing and advertising messages subject to section 30A of the Communications Law (Telecommunications and Broadcasting), 5742–1982 (the “Spam Law”), and Chapter D of the Protection of Privacy Law, 5741–1981.

13.2. Operational, service and security messages (essential to service provision)

Operational messages are sent to registered users’ email addresses or phone numbers according to functional and security needs, and include:

• Email verification, login links, password recovery and one-time verification codes (OTP).
• Immediate security alerts such as new-device login detection or critical account actions.
• Billing notices, invoices, receipts and updates about subscription validity or trial expiry.
• Operational messages and reminders concerning the end of Vanilla Shot, entry into freezing and scheduled account deletion.
• Material, binding updates to terms, the Privacy Policy or technical aspects of the Platform.

These messages are not advertising, are essential for service provision and performance of the agreement, and cannot be opted out of while the account is active.

Messages and reminders are provided only as a service; the Company may, but is not obliged to, send them. Users are responsible for monitoring subscription-expiry dates, Vanilla Shot expiry, freezing periods and deletion dates, which are independently visible in the dashboard. Failure to send, receive or view a message for any reason, including technological failure, spam filtering, provider blocking or an incorrect address, does not delay or prevent account freezing or permanent deletion under system rules.

13.3. Direct mail and marketing messages (explicit consent and Opt-in)

Marketing messages, commercial offers, content updates and newsletters are sent only to users who give prior explicit, active and informed consent (Opt-in), for example by selecting a dedicated checkbox not preselected at registration or within Platform interfaces.

The system records the consent time, IP address and registration characteristics in controlled security logs. Users who do not wish to receive marketing mail need not consent; withholding marketing consent does not affect eligibility to open an account and use Platform services.

13.4. Immediate removal, one-click unsubscribe and suppression list

Users may withdraw marketing consent at any time, free of charge, simply and quickly through any of the following:

• Email unsubscribe link: the dedicated link at the bottom of each marketing email leads to an immediate unsubscribe-confirmation page.
• One-Click Unsubscribe in the email client: messages include built-in support for RFC 8058, enabling quick removal directly through the inbox interface.
• Automatic Suppression List: on removal, the email address is immediately added to a dedicated system blocking list that entirely prevents future marketing mail to that address.
• Contacting support: a written request to the DPO or support by email at support@easylive.click or WhatsApp at 055-995-5679 for manual removal, handled without delay.

Unsubscribing from marketing does not affect receipt of operational messages essential to account management.

13.5. Browser push notifications (Web Push Notifications)

The Platform enables updates and push notifications through the web browser. They are activated only after express approval in the browser’s permission dialog. Users may independently stop them at any time by changing browser permissions or through dashboard interfaces.

13.6. Independent business-owner marketing and disclaimer

The Platform provides technological infrastructure to display cards, websites and catalogs and to transfer inquiries directly from visitors to business owners (Express Pipe). The Platform itself does not manage mailing lists of those end customers or send them advertising.

Each business owner using information received from customer inquiries bears sole, full and independent responsibility for compliance with the Spam Law, privacy laws and all law applicable to their marketing, including lawful consents and unsubscribe mechanisms. The Company is exempt from all responsibility for mailing activities performed by business owners.

14.1. Authority to update and adapt to developments

The Company reserves the full right to update, change, amend or replace this policy from time to time at its sole discretion. Such updates are needed to adapt the Platform to law and regulation, including the Protection of Privacy Law, 5741–1981, its regulations and authority guidance; technological and security developments; system-architecture changes; or the launch of new features, tools and services.

14.2. Binding version and last-update date

The binding, valid and controlling version at any time is the latest version published on this Platform page. The last-update date appears at the top of the Privacy Policy and constitutes the current version’s effective date. Users are advised to review the policy periodically to remain informed of changes.

14.3. Nonmaterial versus material changes

For notifying users, the Platform distinguishes two types of updates:

• Nonmaterial changes: wording corrections, linguistic proofreading, technical clarifications or changes not materially affecting users’ rights or changing collection or use of information take effect immediately on publication.
• Material changes: changes materially affecting data-subject rights, such as expanded personal-information purposes, materially changed collection categories, sharing with new third parties for independent purposes or changes to the Platform’s retention model, take effect after advance notice where possible, except when law or security needs require immediate effect.

14.4. Notification of material changes and advance notice

For a material change, the Company will, where possible, notify registered users through one or more of the following:

• A prominent notice within Platform interfaces or the dashboard, such as a dedicated banner or system message.
• An operational update email to the verified account email (a service message required for service provision, not advertising).

Where possible, the Company will endeavor to notify users of a material change about 14 days before it takes effect, to allow review and planning. No advance notice will be provided when an immediate change is required by law, a judicial instruction or urgent handling of a security incident. Failure to actually receive notice does not delay the change’s effect.

14.5. Continued use as consent and options on disagreement

Continued browsing, Platform use, account login or any action after policy changes take effect constitutes the user’s full, informed and irrevocable consent to the updated version.

Users who disagree may stop all use of Platform services at any time. They may download a complete copy of personal information through a dashboard data-export file and independently, immediately and securely permanently delete their account through system interfaces.

14.6. Previous-version archive and transparency

The Company retains records and previous versions of the Privacy Policy for monitoring, legal audit and compliance. Registered users wishing to view the version in effect at a particular past date may contact the DPO by email at support@easylive.click or WhatsApp at 055-995-5679 and receive a copy of the requested version.

15.1. Choice of law and application of Israeli law

This Privacy Policy, its interpretation, validity and performance, and any Platform action or use related to information processing, data security or privacy, are governed exclusively by the laws of Israel. Choice-of-law or conflict-of-laws rules that might refer to a foreign legal system do not apply.

15.2. Exclusive jurisdiction

Sole, exclusive and final jurisdiction in any dispute, proceeding, claim, application or demand between a user and the Company, Platform management or their representatives arising from this policy or connected in any way to privacy protection lies only with the competent courts in Tel Aviv–Jaffa. The parties waive in advance any objection based on lack of local jurisdiction or forum non conveniens.

15.3. Entire agreement, limitation of liability and limits on remedies

This Privacy Policy is an integral part of the Platform’s agreements and is read together with the general Terms of Use. The service terms’ limitations of liability, exclusions for indirect, consequential or special damage, aggregate compensation cap, exemptions for external-provider failures and force majeure, and indemnification duties apply fully, with necessary modifications, to any allegation, demand, claim or cause of action concerning privacy protection, information security or data processing.

15.4. Partial invalidity and severability

If a competent court determines by final judgment that a policy provision is invalid, unlawful or unenforceable, that finding does not affect the remaining provisions. The invalidated provision will be interpreted to achieve the Platform’s original intent as far as legally possible, and the remaining clauses continue fully in effect and binding.

15.5. No waiver, estoppel or delay

The Company’s failure to exercise a right, delay in enforcing a policy provision or granting a user an extension does not waive that right, create estoppel or prevent the Company from asserting its full rights and demanding strict enforcement at any future time.

15.6. Assignment, transfer of operations and restructuring

The Company may assign, transfer or pledge all rights and obligations under this policy, including database management, to a third party, affiliated company or purchaser in a merger, restructuring, acquisition of operations or transfer of Platform assets, provided the transferee assumes obligations toward data subjects under this policy and law. Users may not assign or transfer their rights or obligations without the Company’s prior express written consent.

15.7. Official communication channels and service of notices

Any official notice, request or objection regarding the Privacy Policy must be directed in writing to the DPO by email at support@easylive.click or WhatsApp at 055-995-5679, as set out in the Platform’s official contact channels. An inquiry is regarded as delivered to the Company only upon receipt of delivery confirmation or a written reply. A user filing a frivolous claim or vexatious demand against the Company bears its actual handling expenses, including attorneys’ fees.