Privacy policy
Last updated: September 2026
This document describes what information is collected when you use the site, what it's used for, who it's passed to, how long it's kept, and how to contact us to see it, correct it or ask for it to be deleted. It is written to describe what the system actually does — including the things it would be more comfortable not to spell out. It is a translation of the Hebrew policy on the Hebrew site.
Who we are
The site is operated by the business whose details appear in the terms of sale, which owns the information and manages the database for the purposes of Israel's Protection of Privacy Law, 5741-1981. For any privacy request, the address is at the bottom of this page.
What is collected
Account: the email address you sign in with, and the name you gave. Creating a design: the sizes you entered, the free text you wrote — a description, a personal story or the full design conversation — any lettering you asked for, and up to three inspiration images you uploaded. Order: name, email, phone, shipping address and country, and whether you asked to receive updates from us. Contact: name, email and the content of the message. In addition, the designs created for you are kept, together with operational metrics about the creation process, and your IP address — for rate limiting only, and briefly. Beyond that, a Meta pixel running on the site collects browsing data, and with every order we pass some of its details to Meta — all set out under "Cookies and measurement". We do not collect means of payment.
Giving information is voluntary, and not every field is required
No law requires you to give us anything. That said: without an email there is no account and no way to send you the design; without a name, phone and address we can't ship; and without a description there is nothing to create from. The updates checkbox is separate, is not a condition for ordering, and is never ticked in advance.
What the information is used for
To run the service: creating the design, saving it to your account and showing it whenever you come back. To fulfil the order: making the piece, shipping it, and answering any question about it. For operation and improvement: finding faults, measuring where people get stuck, and limiting abuse. If you indicated interest — also for updates and marketing information, which you can withdraw at any moment. For advertising measurement: to know which of our ads on Facebook and Instagram brought visitors and orders, and so that ads are shown to people likely to be interested in them. We don't sell information to anyone, and we don't pass it to third parties for their own purposes — except Meta, which also uses the information it receives under its own privacy policy, as set out under "Cookies and measurement".
AI — what is sent to the models
Designs are created with models from OpenAI and Anthropic, so the text you write and the inspiration images you upload are sent to them to produce the result. That includes a personal story, if you chose to tell one. They process it to return a design to us, and we don't give them your name, your address or the order details. Anything that shouldn't reach a model is best not written here or uploaded; you can describe things in general words, or upload your own drawing to a route that doesn't go through an image model.
Who the information is passed to
To the providers that run parts of the service for us, each for the purpose it was passed for: Supabase (database, sign-in and file storage), Cloudflare (serving the site), OpenAI and Anthropic (creating the design, as above), a graphics-processing server we own hosted in Germany (converting the image to a cutting file), Resend (sending emails — name and email address), Telegram (an immediate operational alert about a new order — name, email and phone) and Meta (advertising measurement on Facebook and Instagram — as set out under "Cookies and measurement"). For orders shipped outside Israel, the name, address and phone are also given to the postal service or carrier that delivers the parcel, and appear on the customs declaration. We will also disclose information if required by law or court order.
Transfers outside Israel
Some of the providers above run their servers outside Israel, mainly in the European Union and the United States. This means information you provide is also processed there, under those countries' laws. Using the site and providing the information constitute consent to this transfer. We are working to put data-processing agreements in place with the providers; until that is complete, it is accurate to say it isn't complete yet.
How long information is kept
Funnel data and design conversations are deleted automatically after 180 days. IP addresses kept for rate limiting are deleted within two days. The database backup is kept for 90 days on our server, and an additional encrypted copy for a week. Information passed to Meta is kept by Meta under its own privacy policy. Everything else — the account, designs, orders and messages — is currently kept without a time limit, so you can come back to your design and so we can serve an order that was placed. We are working on an automatic retention and deletion policy for each type of information, and it will be published here. Meanwhile, deletion requests are handled manually, as the next section explains.
Your rights and how to use them
Under the Protection of Privacy Law you have the right to see the information kept about you, to ask for incorrect or incomplete information to be corrected, and to ask for information to be deleted. To use any of these rights, write to us from the address you gave and describe the request. We'll answer in writing, handle the request within a reasonable time, and if we refuse a request we'll explain why. Please note: information we are required to keep by law — for example, a record of a completed transaction — will be kept after a deletion request, and everything else will be deleted. There is currently no automatic deletion route on the site and handling is manual; it works, and it's also something we're improving.
AI agents acting on your behalf
You can let an AI agent — an automated assistant running at another provider — send us a design image on your behalf, through a dedicated interface. In that case we keep the image the agent sent; the cutting files and report derived from it, and the answer the agent received; the piece's dimensions and what the agent gave to calculate them (wrist circumference or ring size); what the agent said about itself, if it did (platform name, integration name and version numbers); and the number of views of the approval link — not your name, not what you told the agent, not your instructions to it and not the conversation with it. The conversion is also recorded in the site's run log, like every creation on the site, including intermediate images and technical data derived from the drawing. The IP address the agent contacted us from is recorded for rate limiting and deleted within two days; and if the agent sent a key for recognising a repeated request, a hash of the key is kept together with the address, salted with our secret, so that a repeated request from the same agent is recognised as such — as long as the job record exists. The agent can work on a job for 7 days after opening it; further submissions don't extend that. A job you declined closes 24 hours after the decline, unless the agent has meanwhile sent a corrected version that passed the check — and in any case not after those 7 days. A job that closed without approval is kept, with all its files and conversion records, for another 180 days, to analyse and improve the service — and then deleted. If the agent cancels the job, the files and conversion records are deleted right away (an image still being processed at that moment — within about ten minutes), and a record of the job without files (the dimensions, what the agent said about itself and the hash) remains for another 30 days, for counting only, and is then deleted too. If you approved, the design is copied to your account and kept there like any design; the job record (which notes that your account approved), its files and its conversion records are kept for up to 180 days from the approval, and then deleted. Before a job is deleted, and also when the agent cancels it, a statistical summary of it is kept without a time limit: the type of piece and dimensions, what the agent said about itself, which submissions there were and when and which errors were returned on each, processing times, the number of views of the approval link, if cancelled — when and at what stage, and if approved — which design was created from it. The summary does not include images, an IP address or the account that approved. The agent gets no access to your account, doesn't see your details and can't order on your behalf.
Cookies and measurement
The site has two kinds of cookies. The first — essential cookies, which keep you signed in and keep a design that's in progress. The second — advertising-measurement cookies from Meta, the company that runs Facebook and Instagram, written by its code running on the site (a "pixel"). The pixel reports to Meta page views on the site and steps in the design journey — starting a design, seeing the first design, going to checkout and placing an order, including its amount — together with what the browser gives any site on its own, such as the IP address and the type of device and browser. Meta may link this information to your Facebook or Instagram account, if you have one. When an order is placed, we also pass to Meta directly from our server the order number and amount, the IP address, the browser type and the identifiers the pixel stored in its cookies, and the email address and phone number — hashed rather than in plain text, which Meta uses to check whether they belong to one of its users. We don't pass your name, address, description or design to Meta. The pixel doesn't run on design share links, on the approval page for an agent's job, on the unsubscribe page or on the sign-in screens, and doesn't run on a page whose address carries a personal identifier. Meta also uses the information under its own privacy policy (https://www.facebook.com/privacy/policy/), including to improve its advertising services. You can block the pixel with an ad blocker or in your browser settings, and manage Meta's use of such information in the privacy settings of your account there. The usage data we ourselves keep doesn't include an IP address and isn't linked to identity.
Security
Information is protected by encryption in transit, restricted access permissions in the database, and a daily encrypted backup. No system is completely immune, and if a security incident affecting your information occurs, we will let you know.
Minors
The service is intended for adults. Under 18 — use of the site and providing details only with the permission of a parent or guardian.
Changes to this policy
We will update this document when what the system does changes — in particular if a recipient, purpose or retention period is added. An updated version will be published on this page with the date of the update.
Contact: info@aperta-designs.com