Template — not yet reviewed. This is a generic template for a small SaaS operated by a sole trader in Israel. It must be completed and reviewed by a qualified lawyer before it is relied on. Bracketed items are placeholders.

Privacy Policy

Last updated: [date]

1. Controller

SteadySite is operated by [Full legal name], an individual registered as a sole trader (osek) in Israel, business no. [_____], [postal address]. Contact for privacy questions: [support@steadysite.dev — set up once the domain is registered].

2. What we collect

Account data: your email address, optional alert email, brand name, colour and logo URL, time zone.
Monitoring data: the URLs you add and results of checks (status, response time, errors), incidents, SSL and domain expiry data, and a log of alerts sent.
Billing data: plan and subscription identifiers received from our merchant of record. We do not receive or store card details.
Security data: a session cookie to keep you signed in; hashed IP address and hashed email used for sign-in rate limiting, deleted within 24 hours; standard request logs kept by our hosting provider.

3. Why we use it

To provide the Service (perform checks, send alerts, show status pages and reports), to secure it (rate limiting, abuse prevention), to bill you, and to contact you about your account. [Legal bases — e.g. contract performance and legitimate interests — to be confirmed by counsel.] We do not sell personal data and do not use advertising trackers.

4. Processors

We use: Cloudflare, Inc. (hosting, database, network); [Resend / email provider] (sending sign-in links and alerts); [Lemon Squeezy / Paddle] (payments, as merchant of record). These providers may process data outside Israel, including in the United States. [Transfer safeguards to be confirmed by counsel.]

5. Cookies

We use one strictly necessary session cookie. No analytics or advertising cookies.

6. Retention

Account and monitoring data are kept while your account is active. Detailed records of failed checks and hourly summaries are kept for up to about 13 months. When you delete your account, its data is deleted from our live database immediately; [backup retention period] may apply. Our merchant of record retains invoice records as required by law.

7. Your rights

You can access and correct most data in the app and delete your account at any time in Settings. You may also contact us to request access, correction or deletion. Depending on where you live (for example under Israel’s Protection of Privacy Law or the EU/UK GDPR) you may have additional rights, including complaining to a supervisory authority. [To be reviewed by counsel.]

8. Security

Sign-in links are single-use and expire after 15 minutes; tokens and sessions are stored only as hashes; traffic is encrypted with HTTPS.

9. Children

The Service is intended for businesses and is not directed at children.

10. Changes

We will post updates here and notify you of material changes.