Privacy Policy

My Special Offer is a SaaS service operated by Niv Einy (sole proprietor, business registration in progress in Israel). Physical mailing address will be published once the business registration is complete. Contact: hello@alma-ads.co.il. The Controller of your data, when you use the service as a business, is your business (you are the Controller and we are the Processor acting on your instructions). For site visitors and individual users, My Special Offer acts as Controller.

When you register and use the service we collect: • Account data — email, hashed password, business name, preferred language • Content you create — voice recordings, transcripts, proposal text, logo, digital signatures • Technical data — IP address, User-Agent, operating system • Usage — which pages you visit, session duration, in-app events (only if you opted into analytics) • Payment — processed by an external Merchant of Record (see sub-processors). We never store card details ourselves We do not collect sensitive data (health, religion, sexual orientation) and we are not intended for minors under 16.

The core purposes: • Service delivery — turning your recordings into proposals, sending them to clients, keeping them in your account • Billing — processing payments, tracking your plan quota • Support — responding to your requests • Legal compliance — retaining signed proposals for 7 years as required by eIDAS / ESIGN / Israeli Electronic Signature Law 2001 • Product improvement — if you opted into analytics, anonymous usage data helps us find weak spots and strengthen them

We process your data on the following bases: • Performance of contract — when processing is necessary to deliver the service you requested (proposals, account, sending) • Legitimate interest — for security, fraud prevention, product improvement • Consent — for analytics and marketing cookies; you can withdraw consent any time by clicking "Cookie settings" in the footer of any page • Legal obligation — retention of signed documents, breach notification, responses to lawful requests

As a data subject you have the following rights: • Right of access — obtain a copy of your personal data • Right of rectification — correct inaccurate data • Right of erasure (right to be forgotten) — request deletion, subject to legal retention obligations • Right to restriction of processing • Right to data portability — receive your data in structured, importable format • Right to object — object to processing based on legitimate interest To exercise: email hello@alma-ads.co.il. We will respond within 30 days (as required by GDPR Art. 15). For complex requests we may extend by 60 days and will notify you.

• Account data — until you delete your account, plus 30 days in backups • Unsigned proposals — up to 2 years from creation, or until you delete them • Signed proposals — 7 years from the signing date, as required by the Israeli Electronic Signature Law 2001, eIDAS and ESIGN. Signed proposals cannot be deleted during this period • Recording transcripts — 90 days from extraction, then automatically deleted (daily cron). Anonymized statistical data is kept for model quality monitoring • Raw recordings (audio files) — 24 hours from upload; deleted automatically after extraction • Technical logs (IP, User-Agent) — 90 days • Billing and tax data — 7 years, as required by Israeli tax law

Some of our providers operate outside the EEA (for example Resend and Google Gemini in the US). These transfers rely on the European Commission's Standard Contractual Clauses (SCCs), module 2 (Controller-to-Processor). A copy of the SCCs is available on request at hello@alma-ads.co.il. Your data is stored by default in Supabase (EU-West, Ireland). It is not transferred to countries without an Adequacy Decision unless covered by SCCs.

We rely on the following providers to operate the service. Each has an appropriate Data Processing Agreement (DPA) in place per GDPR Article 28:

We use three categories of cookies: • Essential — required for site operation (login, language memory, CSRF protection). Cannot be turned off. • Analytics — helps us understand how the site is used. Anonymous. Loaded only if you consent. • Marketing — used for personalized advertising. Off by default. Your preferences are stored locally in your browser (localStorage key mso_cookie_consent). You can change them any time by clicking "Cookie settings" in the footer of any page.

In case of a security incident affecting your personal data, we are required to notify the relevant supervisory authority within 72 hours, and affected users without undue delay, as required by GDPR Art. 33-34 and the Israeli Privacy Law. We maintain an Incident Response Plan detailing detection, containment, assessment, notification and recovery steps. The internal document is kept under docs/incident-response-plan.md and reviewed quarterly.

If you are a California resident, you have the following rights under the California Consumer Privacy Act: • Right to know what personal data is collected about you • Right to delete your data • Right to opt-out of sale — "Do Not Sell My Personal Information" • Right to non-discrimination for exercising your rights We do not sell personal data to third parties. To opt out or request deletion, email hello@alma-ads.co.il with subject "CCPA Request". We will respond within 45 days.

For Israeli residents: We operate in compliance with the Protection of Privacy Law, 5741-1981, and the Privacy Protection (Information Security) Regulations, 5777-2017. The My Special Offer database will be registered with the Israeli Registrar of Databases before exiting Beta. Your rights under Israeli law: • Right of access — Section 13 of the Law • Right of correction — Section 14 • Right to request deletion — subject to legal retention duties To exercise these rights: email hello@alma-ads.co.il. We respond within 30 days as required by law.

The service is intended for adults only. We do not allow registration from users under the age of 16, in line with the GDPR digital consent threshold. If we discover a user is a minor, the account will be deleted without warning. Parents/guardians of a minor whose data reached us by mistake are welcome to email hello@alma-ads.co.il for immediate deletion.

We may update this policy from time to time. Material changes will be communicated: • By email to registered users — 30 days before the change takes effect • By banner at the top of the site for unregistered visitors The last-updated date appears at the top of this document. Earlier versions are available on request.

For any privacy-related question: • Email — hello@alma-ads.co.il • DPO — to be appointed when Beta opens publicly You can also contact the Israeli Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority) or the relevant authority in the European Union.