Privacy Policy

1. The principle: minimal data, no cookies

The Site sets no cookies and uses no third-party analytics or tracking. There is no user account and no personal profile. Every page, including each automation's full build, is open without an email. The ready-to-import blueprint file is sent by email on request (section 2); the weekly email is a separate, optional sign-up. We do not sell personal data and do not share it for advertising.

2. What is collected, why, and for how long

• Contact form — name, email address and the message, which you provide voluntarily. Basis: consent and answering your enquiry. The message is forwarded to us as a Telegram message and is not stored in the Site's database. We delete it once the enquiry is handled, unless we must keep it for a legal reason. There is no legal obligation to provide these details; without them we cannot reply.
• Weekly email (optional) — your email address, the time you gave consent and the page you signed up on; our provider also records the time and IP address of the confirmation click as proof of consent. Sign-up is double opt-in: after you submit the form we send a confirmation email, and only clicking its link adds the address to the list; an address that is never confirmed is not added and gets no further email. Basis: your explicit consent, given by ticking a box that is not pre-ticked. Use: one email a week, only when there is a new automation or guide. The provider records whether an email was opened and which links were clicked (standard campaign statistics). Retention: until you unsubscribe. Addresses that are never confirmed are deleted after 30 days. Unsubscribing takes effect immediately via the link; the address then stays on a suppression list only, so that you receive nothing further from us; ask and we delete that too. To unsubscribe: the "Unsubscribe" link in every email, or a message to us.
• Blueprint by email — the email address you enter in the form on an automation page, and which file you asked for. Basis: providing the service you requested (sending the file). Use: one delivery email with signed download links to the file and its sheet template, valid for 7 days; no marketing, no paid links and no further email. If you leave the weekly-email box unticked you are not added to any mailing list. Retention: the address is kept by Brevo on a deliveries-only list and deleted automatically 30 days after the last delivery (Brevo also keeps a technical sending log under its own policy). If you tick the box, you go through the double opt-in described above, and the download opens after the confirmation click. The form and the downloads are counted per day and file only, with no address and no identifier.
• Page views — the browser reports the page path once on load (and, on the first load, the referring site's name only, never the full address), and the server counts per day and page only. For visits that arrive through one of our YouTube links, the server also counts a coarse technical class of the request, to tell a real click from an automated link scanner: browser family and major version, operating system, whether it is a phone, the primary language, technical request headers and the referring site's name. The class is kept as a count per day only, for up to 30 days, never the full browser string. No IP address, no identifier, no cookie; a browser sending Do Not Track or Global Privacy Control is not counted at all. Basis: legitimate interest (knowing which pages are read, and filtering automated traffic).
• Clicks on affiliate links — counted per day, partner and referring page only. No personal identifier, IP address or browser identifier is kept. Basis: legitimate interest (knowing which pages are useful).
• Rate limiting and abuse prevention — rate-limit counters are keyed by a hashed key only: a one-way hash of the IP address with a salt that changes daily, held in temporary memory for minutes to an hour. The IP address itself is not stored and cannot be recovered from the key. Basis: legitimate interest (security).
• Clicks in the shop section — the referring page, link position and time of the click, and a derived (hashed) visitor identifier for a limited period so one visitor is not counted twice. Basis: legitimate interest.
• Server logs — the hosting provider (Vercel) automatically records technical request data (IP address, browser type, page, time) for security and operations, for a few days, under its own policy.

3. Who receives the data (processors)

• Vercel Inc. (USA) — hosting and running the Site. Data may be processed in the USA and the EU under the EU Standard Contractual Clauses.
• Supabase Inc. — the Site's database (aggregate click counts and catalog data; no personal data).
• Telegram FZ-LLC — delivery of contact-form messages to us.
• Brevo (Sendinblue SAS, France) — the weekly email list, the confirmation email, blueprint delivery emails and sending. Data is stored in the EU. Our processor Brevo (France) processes the data under its Data Processing Agreement including EU Standard Contractual Clauses.
• The providers our links point to (for example Make, AliExpress, hosting providers and banks) — after clicking a link you are on their site, and their privacy policy applies. Some set an attribution cookie to know you came from us; that happens on their site, not ours.

4. Transfers outside Israel and the EU

The little data collected is processed by the providers above, some of which operate in the USA. Transfers rely on recognised safeguards (Standard Contractual Clauses and Israel's data-transfer regulations). We transfer no personal data to anyone not on this list.

5. Your rights

Depending on the law that applies to you, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. The only personal data we keep over time is the email address of weekly-email subscribers, and — for 30 days only — the address of someone who asked for a file by email: withdraw consent at any time with the unsubscribe link in every email, and send access or deletion requests to the address below. We check every request and answer within 30 days.

Under Israel's Protection of Privacy Law you have the right to inspect data about you (section 13) and request correction or deletion (section 14); refusing to provide data has no consequence other than that we cannot reply or subscribe you.

Contact: oz@ostechventures.com. EU residents may complain to their national supervisory authority; Israeli residents to the Privacy Protection Authority. California residents: we do not "sell" or "share" personal information as defined by the CCPA/CPRA.

6. Children

The Site is for professionals and is not directed at children under 18. We do not knowingly collect data about minors.

7. Security

The Site is served over HTTPS only, with security headers, rate limiting and connection checks. Access to operational systems is protected by secret tokens that are never stored in code. No security is absolute, and we cannot guarantee immunity from every breach.

8. Changes

We will update this document when collection changes — for example if we add analytics. Such a change will appear here with a date, and where required we will ask for consent first. Update of 28 September 2026: the weekly email was added (sections 1, 2, 3 and 5). Update of 29 September 2026: retention periods, rights under the Protection of Privacy Law and Brevo's processing agreement (sections 2, 3 and 5). A second update the same day: blueprint files are sent by email, and delivery-only addresses are deleted after 30 days (sections 1, 2, 3 and 5).