Data Processing Addendum (DPA) for Mabitim customers

Version: dpa-en-v1 · Updated: 01.09.2026 · In force: from the day this page is published

The binding version of this document is the Hebrew one. The Russian and English texts are provided for your convenience. If they differ from the Hebrew text, the Hebrew text prevails.

1. What this document is and who it is for

This addendum applies to you if you send Mabitim personal data about other people: your customers, visitors to your website or your employees. It sets out how we process that data, how we protect it, who receives it and what happens to it in the end.

The addendum is part of the subscription agreement (mabitim.com/en/terms) and is accepted at registration together with the terms and the privacy policy. On any question concerning data, if this addendum and the terms of service differ, this addendum prevails.

The parties are the same as in the subscription agreement: you (the registered business) and us, Israsky, owned by Ilia Shuliak, Petah Tikva, Israel, registered dealer (עוסק מורשה) no. 324648047. Full details are in section 1 of the terms of service.

2. Terms in plain words

3. Roles: who is the database owner and who is the processor

The last row does not contradict the first two: for data about your customers we are the processor, and for your account data with us we are the database owner, like any service provider keeping a customer list.

4. We process data only on your instructions and only for the service

Your instructions are what you set in your account and in the agreement: the websites you connected, the keywords and prompts you entered, the sources you authorised and the reports you requested.

The purposes, and this is a closed list:

1. Measurement and collection: search rankings, AI engine answers and mentions in them, the Search Console and Analytics data you connected, and technical crawling of your website;
2. reports and recommendations, including reports whose text is drafted by a language model;
3. alerts, the periodic digest and service messages in the channels you chose;
4. support: handling your requests;
5. billing and subscription management, including issuing tax documents.

What we do not do with your data:

• we do not sell it and do not rent it out;
• we do not use it for advertising or advertising profiles;
• we do not train models on it, neither ours nor anyone else's. All three model providers we work with commit to this in their API terms, and we have checked that against their own documents. Alongside that: visibility measurement in ChatGPT and Gemini is carried out through a licensed data provider, from the real interfaces of those services, where the enterprise "no training" mode does not apply, so those queries carry only questions about your field and your business, with no personal data. The details are in the privacy policy, section 6.
• we do not use it for our own purposes, except aggregated, anonymised data that cannot be linked to you or your website, in order to improve the service.

If an instruction of yours looks to us to be contrary to law, we will say so rather than quietly carry it out.

5. Confidentiality and access

• Access to data is granted by role, and only to those who need it for their work: support, system administration, billing. What each role may and may not see is defined in advance.
• Everyone at our end who comes into contact with the data is bound to confidentiality, including after their work ends.
• A member of our staff may sign into your account in three situations only: to handle a request from you, to investigate a security incident, or where the law requires it. Such a sign-in is shown in the interface with a banner reading "you are working on behalf of…" and is written to the log.
• Your API keys and connections are not accessible during such a sign-in, not even for a validity check, and providers cannot be connected or disconnected under it.
• Sensitive actions are written to the audit log and to the security event log; the retention periods for the logs are in the privacy policy.

6. Security level and the measures actually in place

Under the Protection of Privacy Regulations (Data Security), 2017, our database is classified at the basic security level: the number of data subjects and the number of people with access rights are below the thresholds, we do not trade in data, and processing of especially sensitive data is not our main activity.

The measures actually in place go beyond what the basic level requires:

7. Security incident: when and how we notify you

• If an incident affecting your data occurs, we will notify you without delay and no later than 72 hours after we discover it.
• The notice will state what happened and when, which categories of data are involved, what we have already done, how we assess the risk and what we recommend you do.
• If we do not yet have the full picture, we will report what is known and complete it later. We do not wait for the investigation to finish before notifying.
• Reporting to the Privacy Protection Authority and to data subjects is your obligation as the database owner, and we will provide the information and documents you need in order to meet it.
• At our end the incident is recorded and handled under our internal security procedure.

8. Your right to information and to audit

• You may ask us for information about how processing is carried out and about the security measures. Write to privacy@mabitim.com or through support, and we reply with a written report.
• You may request a deeper review, including one by your own auditor. Such a review takes place by prior arrangement, at a reasonable time, once every 12 months and at your expense, subject to the auditor's confidentiality undertaking. If the review finds a material deficiency on our side, we fix it at our own expense.
• A review does not give access to other customers' data or to trade secrets unrelated to the processing of your data.

9. Subprocessors

• We engage subprocessors in order to deliver the service. The full list is in Appendix A at the end of this document, with each one's purpose, country and link to its terms.
• Every subprocessor is bound to a level of protection no lower than the one set out in this addendum, and to processing for the service only. We are liable to you for a subprocessor's acts as if they were our own.
• A new provider is added to the list before it receives any data for the first time, not afterwards.
• We will announce the addition of a subprocessor by email and on the list page 30 days in advance. If the addition does not suit you, you may cancel your subscription before it takes effect, with no cancellation fee. We cannot grant a veto over an individual provider: there is one service for all customers.
• The list page always shows the date it was last updated.

10. Your own keys (BYOK): here the provider is your processor, not ours

On the Pro and Managed plans you can enter your own API keys for AI providers. That changes the roles, which is why it is set out separately:

1. Complying with the provider's terms is your responsibility when the work runs on your key.
2. Usage on your key is your money. The provider bills you directly; our meter counts that usage for transparency only.
3. If your key stops working, we check it daily, tell you, and keep running on our own key up to a monthly cap set in your account; above that cap the operations that need a key stop, with a clear message. The details are in section 16 of the terms of service.
4. Storing your key: encrypted under a separate encryption key, never written to logs, never displayed on any screen and not accessible during a support sign-in.

11. Transfers outside Israel

Some subprocessors operate outside Israel, so part of the data is processed abroad. Each provider's country is given in a separate column in Appendix A: Germany and Estonia in the European Union, the United States, the United Arab Emirates (Telegram, only if you connected the channel) and Israel.

When choosing providers we prefer those that publish data processing terms, and the link to those terms is given in the appendix. We have no representative in the European Union.

12. How long data is kept and what happens at the end

• The full retention table is in the privacy policy at mabitim.com/en/privacy, and it is the single source for all retention periods. We do not repeat it here so that two versions cannot exist.
• At any time you can export your data from your account: an archive in JSON and CSV.
• When the subscription ends: permissions at the connected providers are revoked at the provider itself and the tokens are deleted; account data and content are deleted 90 days after cancellation; billing records and tax documents are kept as the law requires; internal usage records are anonymised, meaning the amounts remain with no link to you.
• Revoking a permission at the provider is mandatory, not optional. If revocation fails for a technical reason, it stays with us as an open recorded event, attempts continue, and we do not keep quiet about it.
• You can ask for earlier deletion by writing to privacy@mabitim.com, except for what the law obliges us to keep.

13. Helping you with data subject rights

• If a data subject asks you to give access, correct or delete their data, we will help: export, correction and deletion are done from your account, and in a complex case we will help by hand.
• If a data subject approaches us directly, we will not handle the request on your behalf and will not disclose data on our own initiative: we will refer them to you and tell you about the approach.
• If a competent authority demands your data from us, we will notify you of the demand before disclosing, unless the law forbids us to notify.

14. Term, changes and how this fits the other documents

• The addendum is in force for as long as we process data for you, and continues to apply to whatever remains with us until it is deleted.
• A material change to the addendum is made the same way as a change to the terms of service: advance notice and a fresh request for consent, stating the version of the text (dpa-en-v1 and onwards). Updating Appendix A is not a material change to the addendum and is done under section 9.
• On any question concerning data, this addendum prevails over the terms of service. On every other question, including payment, quotas and limits of liability, the terms of service prevail.

15. The rules this document rests on

• Regulation 15 of the Protection of Privacy Regulations (Data Security), 2017: a written engagement with a data holder must define the purposes, the categories of data, the permitted operations, the term, how data is returned or destroyed at the end, and the security measures. Sections 3, 4, 6, 12 and 14 answer this.
• Database Registrar Guideline 2/2011 (outsourcing the processing of personal data): the database owner's responsibility in choosing a processor, defining permissions, confidentiality, supervision and audit. Sections 5, 8 and 9 answer this.
• Protection of Privacy Law, 1981, including Amendment 13 (in force since 14.08.2025): the obligations of the database owner and the holder, data subject rights, and incident notification.
• Protection of Privacy Regulations (Data Security), 2017, as regards the security level, access management, logging and security incidents.

Appendix A: list of subprocessors

Last updated: 01.09.2026. The list is updated before a new provider receives any data for the first time (section 9).

Who is not on the list: outgoing email is sent from our own servers rather than through an external mailing provider, so your people's addresses are not passed to any mailing service. A new provider, including a mailing service, a CDN or an analytics tool, will be added to this list before it receives any data.