Privacy policy

1. Categories of personal data

"Personal data" means any information identifying you directly or indirectly, including an IP address or cookie identifier. We collect and process personal data about three groups:

User data. Account contacts, account administrators on the customer's behalf, and authorised platform users, as well as individual or freelance customers who create and distribute documents and forms.

Signer data. Personal data transferred to or processed on the platform concerning the people with whom customers share forms. We process this data as a data processor for and on the instructions of the customer, who is the data controller. Questions about signer data should be directed to the account administrator at the organisation that sent the form.

Visitor data. Information about site visitors, event participants and prospects interacting with our marketing materials, emails or media channels.

2. What we actually collect

Registration details. Full name, email address, username and data needed to create an account. Signers can access forms anonymously, apart from technical session identifiers.

Payment data. For paying subscribers we receive data from payment providers, for example the last four digits of a card or an authorisation token. We do not store full card numbers.

API data. If you connect the account to a third-party service, we collect the data permitted under that integration.

Event and document data. Timestamps, actions performed on forms, view, entry, signature, and any personal data contained in the processed forms and documents.

AI data. Inputs and outputs relating to interaction with the platform's AI engines, including field-detection results on uploaded documents.

Technical data. IP addresses, approximate location, browser type, operating system, logs, cookies and pixels.

Enquiries and support. Messages sent through the contact form, correspondence and screenshots.

3. Purposes and legal bases

Providing the services and operating the account, access management, preferences, platform security and fraud prevention. Basis: contract and legitimate interest.

Payment processing, billing, subscription management and prevention of malicious activity. Basis: contract.

Operating AI engines and improving the product, using anonymous or aggregated data to improve algorithms, find bugs and test systems. We do not train models on identifiable customer content. Basis: legitimate interest.

Support, responding to enquiries and providing technical assistance. Basis: contract.

Communication, essential service messages are always sent; marketing updates are subject to consent, with opt-out available at any time.

4. Sharing with third parties

We do not sell personal data. Data is shared only in the following circumstances:

Technology providers, cloud and storage providers, authentication systems, log monitoring, AI providers, analytics tools and mail services. These providers are contractually bound to use the data solely to provide services to us.

Customer-chosen integrations, where a user connects the platform to an external service, relevant data is transferred to that provider according to the nature of the integration.

Legal requirements, under a court order, regulatory demand or lawful request from a competent authority.

Corporate changes, in a merger, asset sale or reorganisation, data transfers to the acquirer provided it assumes the terms of this policy.

5. Security and retention

Security measures. We apply encryption in transit and at rest (TLS 1.3 and AES-256), firewalls, need-to-know access controls and two-factor authentication. Engineering staff access customer data only to resolve a specific fault and with the customer's approval.

Audit trail. Every view, entry and signature is recorded with a timestamp and IP address. The log is not editable, is kept in the system next to the signed document, and is available on request.

Retention. We retain personal data as long as needed to maintain the business relationship, provide the services, meet legal obligations or defend claims. On termination, account data is retained for up to 90 days and then permanently deleted.

6. Where data is stored

The database and the app run on servers located in Israel; documents are stored encrypted on Cloudflare R2, under secure logical separation.

Ancillary operational services, mail delivery, monitoring and support, may be provided by vendors outside Israel. For such transfers we apply accepted legal mechanisms, including Standard Contractual Clauses, to ensure an adequate level of protection.

7. Your rights

Under the Israeli Protection of Privacy Law, 5741-1981, and any regulation applicable to you including the GDPR, you have the following rights:

Access, to check whether we hold personal data about you and receive a copy.

Rectification, to require correction of inaccurate, incomplete or outdated data.

Erasure, to require deletion of personal data where it is no longer needed for the purpose it was collected.

Restriction or objection, to request restriction of processing or object to processing based on legitimate interest.

Portability, to receive your data in a structured, commonly used, machine-readable format.

To exercise these rights: info@zeeform.co.il. We may request reasonable identification before responding. Where a request concerns data for which we act as a processor on behalf of a business customer, we will refer it to the account administrator at that organisation.

8. Cookies

The site and platform use cookies, pixels and similar technologies for operation, security, user authentication and statistical analysis.

Cookie types: strictly necessary, functionality, security, and performance and analytics.

You can change browser settings at any time to block or delete cookies, though some platform features may not work properly without them.

9. Contact

For any question or request regarding this policy or our security practices: info@zeeform.co.il