Privacy Policy (Mabitim)

Version: privacy-en-v3 · Updated: 16.10.2026 · In force: from the day this page is published

The binding version of this document is the Hebrew one. The Russian and English texts are provided for your convenience.

1. Who operates the service and owns the database

Mabitim (mabitim.com) is a product of Israsky, owned by Ilia Shuliak. Registered dealer (עוסק מורשה) no. 324648047. Database owner within the meaning of the Protection of Privacy Law: Ilia Shuliak (Israsky). Address: 48 Mintz Street, Petah Tikva 4948141, Israel.

Privacy and data enquiries: privacy@mabitim.com · support: support@mabitim.com

2. What this policy covers

The policy covers two places where we process data, and they are separated technically as well:

1. the system itself (your account): everything to do with your subscription, your websites and the measurements;
2. the mabitim.com marketing site: the waiting list form, cookies and page content. The site's pages run on a separate server account with a separate system user, and that is a deliberate security measure: a hole in the marketing site does not reach customer data. The details you enter in the form are received and stored by the system itself (app.mabitim.com), not by the marketing site.

The policy also covers data received from your Google account, if you connected it yourself.

When this policy does not apply to you: if you send Mabitim personal data about your own customers, that processing is governed by the Data Processing Addendum (DPA) at mabitim.com/en/dpa, where you are the database owner and we are the processor. See also section 13.

3. What data we collect

3.1 Data you give us. Name, email address, your business website address, account settings (language, alert channels, quiet windows for Shabbat and holidays). At purchase: business name, country (it determines the VAT rate) and billing details. Card details never reach us and are not stored by us: the card fields are served by the payment processor, and all that stays with us is a payment token and the billing documents.

3.2 Phone number. Only if you chose to sign in with a WhatsApp code. The number is used to send the code and to sign you in, and for nothing else.

3.3 Data from your Google account. Only if you connected the account yourself, and read only. Full details in section 4.

3.4 Service usage data. Sign-in records, actions in your account, IP address and browser type, error logs, and metering of calls to external data sources (to calculate quotas and billing).

3.5 Website data and measurement results. The keywords and prompts you set, search rankings, technical crawl results, AI engine answers and the sources they cite. As a rule there is no personal data here: this is data about a website and about search results.

3.6 Conversations with the AI assistant. What you write to the assistant and what it answers. That text is sent to the model provider so that it can answer, which is why you should not put other people's personal data into it.

3.7 Your own API keys (BYOK). On the relevant plans you can enter your own API keys for model providers. Keys are stored encrypted under a separate secrets key of the service, are never displayed back on screen, are never written to logs, and are not accessible to an Israsky employee who signs into your account (section 5). You can delete them at any time.

3.8 Support requests and consents. The content of your requests, and records of the consents you gave: which text, which version, when, in which language and from which IP address.

3.9 Data about a person who is not our user. When an employee of your business requests a connection through a personal link from the owner of the access rights, we receive the email address the link was sent to (entered by your employee) and the fact that permission was granted. The access owner's email address is not obtained from Google: we do not request email or identity scopes at all.

3.10 On the marketing site (waiting list). Your email address, your website address, the language of the page and, if you clicked the button of a specific plan, the plan you came from; the invitation or referral code and the programme name, if you came through such a link; whether you ticked the marketing box, the time you signed up and the time you confirmed your address. The purpose: to send you an invitation when access opens, to know which plan interests you so that we can prepare the invitation, and, if you came through an invitation or referral link, to credit your sign-up to that invitation or programme. After you send the form, we send you one email to confirm your address, and every other email goes only to a confirmed address. If the address is not confirmed, we send nothing more to it unless you send the form again. Marketing messages are sent only if you ticked the separate box for them. Giving these details is optional, but without an email address we cannot send you an invitation. The data is stored with us, on a Hetzner server in Germany (European Union), and is not passed to anyone else.

Server logs. When you open the marketing site or send the form, the server records the IP address and the time of the request. The logs have a different purpose: running the site and protecting it from abuse, such as automated form submissions. We do not use them to contact you.

4. Google data: exactly what we receive and what we do with it

We request two scopes, both read only:

Why a narrower scope is not enough. For these two APIs Google offers no narrower read access: webmasters.readonly and analytics.readonly are already the most restricted options that return performance data. Scopes that allow changes (webmasters, analytics.edit) we do not request: the product only reads and changes nothing on the customer's side.

What we do not do: we change nothing on your website, property or Google account (these scopes do not allow it in the first place); we do not read mail, files or any other Google service; we do not sell data; we do not use it for advertising or advertising profiling; we do not use it to train artificial intelligence models.

Google's Limited Use requirement:

Mabitim's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we store and protect data

• All traffic is protected by TLS.
• Access and refresh tokens received from Google, and your API keys, are stored encrypted under an encryption key separate from the rest of the system, and never appear in logs or error messages.
• Customer separation: every query in the system is scoped to its own customer by default, and that scoping is checked automatically on every code change. If the scope was not applied, the operation fails instead of returning data.
• Access to data is restricted by role; sensitive actions are written to the audit log and the security event log.
• Access by people on our side. An Israsky employee can sign into your account and see it from the inside only in three cases: when you contacted support and it is needed to handle your request, when there is a security need (investigating a failure or a suspected unauthorised access), or when the law requires it. Such a sign-in is shown in the interface with a banner reading "you are working on behalf of…" and is written to the log, and your API keys are not accessible under it in any form, not even for a validity check. Connecting or disconnecting providers is also impossible under such a sign-in.
• Backups are encrypted; system secrets live only on the server and never in source code.
• Where the data physically sits: on the service's servers at Hetzner Online GmbH, data centre FSN1-DC13 in Falkenstein, Germany (European Union). A data processing agreement with Hetzner is in place, and Hetzner undergoes an annual TUV Rheinland audit.

6. Who we share data with

We do not sell data and do not rent it out. Data goes only to the providers needed to run the service, and only to the extent needed:

Exactly what reaches the AI providers. Two different things: (a) for visibility measurement we send public questions about your field, the kind anyone could ask; (b) for a report you requested with a button we send aggregated metrics about your website, including aggregates from Search Console and Analytics (for example total impressions and clicks for a period, or top queries). We never send access tokens and never send data identifying individuals.

Model training. Data is sent to model providers in a mode that excludes training models on it, under the API terms of those providers.

And one more thing worth knowing. Visibility measurement in ChatGPT and Gemini is carried out through a licensed data provider, from the real user interfaces of those services, and the enterprise "no training" mode does not apply to such queries. That is why those queries carry no personal data of yours and none of your customers' data, only the wording of questions about your field and your business.

The list is closed and kept current. The table above is the complete list. A new provider is added to it before it receives any data for the first time. Who is not on the list: outgoing email is sent from our own servers rather than through an external mailing provider, so email addresses are not passed to any mailing service.

7. Transfers outside Israel

Some providers operate outside Israel, so part of the data is processed abroad: Germany, Estonia and Ireland in the European Union, the United States, and the United Arab Emirates (Telegram, only if you connected the channel). Each provider's country is stated in the table in section 6. Transfers to the European Union are made under Regulation 2(8) of the Israeli Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001, and transfers to the United States and other jurisdictions are made on the basis of your explicit consent under Regulation 2(1) and provider data-protection undertakings under Regulation 2(4).

We choose providers that publish data processing terms, and prefer those for whom a document can be shown rather than a promise alone. No representative in the European Union has been appointed.

8. Consents: how we ask and how you withdraw

• Next to every form that collects data there is a short line: whether filling it in is required, why the data is needed, and who receives it and in which country. Everything else, including the database owner, the retention periods and your rights, is set out on this page.
• Consent to marketing messages is a separate checkbox, never merged with consent to processing. Neither is ticked by default. Refusing marketing does not prevent you from using the service.
• Service messages are not marketing: alerts, the periodic digest, invoices and support replies are part of the service and do not depend on marketing consent.
• Every consent is recorded in a log together with the version of the text you agreed to. A refusal is recorded too: "no record" and "said no" are different things.
• You can withdraw consent at any time: from your account, through the unsubscribe link at the bottom of every marketing email, or by writing to privacy@mabitim.com. The withdrawal is recorded and does not erase the consent history.

9. How to revoke Google access

• In your account: "Settings" → "Connections" → "Disconnect". We revoke the permission at Google, delete the tokens and stop collecting data from that source. Data already collected stays in your account but stops updating.
• Directly at Google: on your account's permissions page, myaccount.google.com/permissions.
• If the access owner connected the account through a personal link, they receive a permanent status link: what was granted, to whom and when, with a revoke button. They can also simply write to privacy@mabitim.com.
• If revocation at Google fails for a technical reason, we will say so plainly and point you to Google's permissions page rather than stay silent.

10. Retention periods

If you register for the service, your waiting list details stop being an enquiry and become part of your account, and the period in the first row then applies to them.

11. Cookies and site analytics

• Before you give consent, the marketing site uses only strictly necessary storage (saving your cookie choice and display theme preference), and analytics scripts or advertising pixels are not loaded at all.
• Analytics and marketing tools on the marketing site (Google Tag Manager, Google Analytics 4, Google Ads and Meta Pixel) run only after your explicit consent in the choice banner (Consent Mode v2). You may refuse, and the "Decline" button is visually equal to the "Accept" button.
• You can change or withdraw your choice at any time via the "Cookie settings" link in the footer of every page. When you withdraw consent, analytics and marketing cookies are cleared from your browser.
• Inside the system itself only essential cookies are used. The personal connection page (/connect/…) carries no analytics, no pixels and no non-essential cookies at all.

12. Your rights

The applicable law is Israeli law, first of all the Protection of Privacy Law with Amendment 13. Under it you have the right to know what data is held about you, to inspect it and to demand correction of inaccurate data (sections 13 and 14 of the Law), as well as to demand deletion, to withdraw a consent you gave and to opt out of marketing messages.

• Export: you can download all your data from your account at any time, as JSON and CSV files.
• Deletion: you can delete your account from within the system; what the law obliges us to keep (billing documents) remains under section 10.
• Contact: privacy@mabitim.com. We will reply within the period set by law.
• If our answer does not satisfy you, you may contact the Israeli Privacy Protection Authority (רשות להגנת הפרטיות).

Visitors from the European Union: to the extent that the GDPR applies to your case, its rights are also available to you: access, rectification, erasure, restriction of processing, data portability and objection to processing, as well as a complaint to the supervisory authority in your country. Write to the same address. No representative in the European Union has been appointed.

13. If your data reached us through a business that uses Mabitim

You may be a customer of a business that uses Mabitim, and your data may have reached us through that business. In that case the database owner is that business, not us: we process the data on its instructions, under the data processing addendum.

A request to inspect, correct or delete therefore has to be addressed to them. If you approach us, we will not decide on their behalf: we will refer you to them and tell them about your approach.

14. Changes to this policy

We will notify you of a material change by email or in your account and ask for your consent again. Every version carries a number (privacy-en-v3 and onwards), earlier versions are kept by us, as is the record of which version you agreed to. Editorial changes that do not affect rights take effect when published.

15. The rules this policy rests on

• Protection of Privacy Law, 1981, including Amendment 13 (in force since 14.08.2025): the duties of a database owner and a holder, notice at the point of collection, and data subject rights.
• Protection of Privacy Regulations (Data Security), 2017, including regulation 15, and Database Registrar Guideline 2/2011: security level, access management, logging and the engagement with a processor. The details are in the data processing addendum.
• Amendment 40 to the Communications Law (Telecommunications and Broadcasting), 1982: separate explicit consent for marketing messages and one click unsubscribe.
• Google API Services User Data Policy, including the Limited Use requirements: section 4.
• Israeli tax law, הוראות ניהול פנקסי חשבונות: billing and tax documents are kept for 7 years.

16. Contact

privacy@mabitim.com · support: support@mabitim.com 48 Mintz Street, Petah Tikva 4948141, Israel. Response hours: Sunday to Thursday, 9:00 to 21:00. Friday, Saturday, Israeli holidays and holiday eves are closed.