Privacy policy

1. General

Atarika (atarika.co.il) ("the Company", "we") owns, develops and operates the Felora platform at felora.app (the "Service" or the "Site"). This privacy policy explains how we collect, use, store and protect your personal information.

This policy applies to all users of the Service, registered or not, and forms an integral part of the Terms of Use.

We are committed to protecting your privacy in accordance with the Israeli Protection of Privacy Law, 5741-1981 and Amendment 13, the Protection of Privacy Regulations (Data Security), 5777-2017, and the relevant principles of the GDPR.

2. Information we collect

2.1 Information you provide directly:

• Registration details: first name, last name, email address, password (encrypted)
• Business data: business name, business description, logo, brand colours, tone of voice, target audience, preferred language
• Content you upload: product photographs, logos, marketing materials
• Communications: support messages, feedback, submission requests

2.2 Information collected automatically:

• Access data: IP address, browser type, operating system, screen resolution
• Usage data: pages viewed, access times, session length, actions taken
• Device data: device type (desktop/mobile), device identifier
• Performance data: errors, response times, system logs

2.3 Payment information:

Credit card details are processed and stored solely by our payment processor (CardCom) under the PCI-DSS standard. Full card details are never stored on Felora's servers at any stage. To renew a monthly subscription automatically we store an encrypted token (AES-256-GCM) supplied by CardCom — that token cannot be used to charge by anyone else and does not expose the card details. We also store a transaction identifier, the amount and date of payment, and the receipt that was issued — Atarika issues it and emails it to you with every charge.

2.4 Information from third parties:

If you connect your account to social networks (Facebook, Instagram), we may receive basic information according to the permissions you grant, such as the page name, account identifier and access token.

3. Purposes for which we use the information

We use the information collected for the following purposes:

• Operating the Service: managing your account, verifying identity, generating content tailored to you
• Processing payments: taking payment, managing subscriptions, issuing receipts
• Technical support: answering enquiries, resolving problems, improving the user experience
• Improving the Service: analysing usage patterns, developing new features, optimisation
• Service communications: system notices, service updates, security alerts
• Security: detecting and preventing fraud, protecting the system and its users
• Legal compliance: meeting legal obligations, responding to judicial orders

We will not use your information for purposes inconsistent with those set out above unless we obtain your explicit consent.

4. Sharing information with third parties

We do not sell, rent or trade your personal information.

We may share information with the following parties, only to the extent required to operate the Service:

4.1 Service providers (data processors):

• CardCom — payment processing and credit card clearing. The receipts themselves are issued by Atarika and emailed to you
• Cloudinary — storage and processing of images and media files
• OpenAI — text processing and marketing content generation
• Google (Gemini) — image and visual content generation
• ElevenLabs — voiceover and audio file generation
• Upstash (Redis) — job queue management and caching
• Railway — hosting and server infrastructure
• Resend — sending email (verification, password reset, updates)
• MongoDB Atlas — database storage

All of our service providers are bound to protect the information under data processing agreements and accepted security standards.

4.2 Law enforcement:

We will disclose personal information if required to do so by law, a court order, or a binding request from a competent authority.

4.3 Business transfer:

In the event of a merger, acquisition or sale of assets, personal information may be transferred as part of the transaction, subject to advance notice to users.

5. Information security

We apply advanced security measures to protect your information:

• Encryption in transit: all communication is encrypted using TLS 1.3 (HTTPS)
• Password hashing: passwords are stored using bcrypt with a unique salt
• Role-based permissions: a multi-layered permissions system (RBAC)
• Token authentication: a JWT system with short-lived access tokens and refresh tokens
• API protection: rate limiting and input validation
• Monitoring: logging and tracking of unusual activity
• Backups: regular automatic database backups

Despite the security measures we take, no security method is entirely impenetrable. We cannot guarantee absolute security of the information.

6. Your rights

Under Amendment 13 to the Protection of Privacy Law and the principles of the GDPR, you have the following rights:

• Right of access: the right to request a copy of the personal information we hold about you
• Right of rectification: the right to require correction of incorrect or inaccurate information
• Right of erasure: the right to request deletion of your personal information (the "right to be forgotten"), subject to legal obligations
• Right to restrict processing: the right to request a restriction on processing your information in certain circumstances
• Right to portability: the right to receive your information in a structured, machine-readable format
• Right to object: the right to object to processing for direct marketing purposes

To exercise your rights, contact us at info@atarika.co.il. We will handle your request within 30 days at most.

If you believe your privacy has been infringed, you may lodge a complaint with the Israeli Privacy Protection Authority.

7. Cookies, local storage and analytics tools

Essential cookies: we use cookies and local storage that are essential to operating the Service, in order to:

• keep you signed in (authentication tokens)
• remember language and interface preferences
• remember the active workspace

Analytics and performance cookies: we use external measurement tools to understand how the Service is used, improve the user experience and measure performance. The tools we use may include:

• Google Analytics — statistical data about use of the site (pages viewed, visit length, traffic source)
• Meta Pixel (Facebook Pixel) — conversion measurement, matching and retargeting for Meta advertising
• additional third-party measurement and analytics tools as needed

The data collected by these tools is largely anonymous or identified at the device/browser level, and does not include sensitive personal information such as passwords or card details. These tools are subject to their own providers' privacy policies (Google, Meta).

Marketing and advertising cookies: we may use cookies for targeted advertising on social networks (such as Facebook and Instagram), to show users relevant marketing content and to evaluate the effectiveness of campaigns.

Managing cookies: you can block or delete cookies through your browser settings. Blocking essential cookies may impair the functioning of the Service. Blocking analytics and marketing cookies will not prevent you from using the Service, but will reduce our ability to improve it and tailor it to your needs.

8. Data retention and deletion

We retain your personal information for as long as your account is active or as required in order to provide the Service.

• Active account: information is retained for as long as the account is active
• After account deletion: personal information is deleted within 30 days
• Payment data: retained for 7 years as required by law (the Israeli Income Tax Ordinance)
• System logs: retained for 90 days for security purposes
• Backups: deleted within 90 days of deletion of the original data

9. Transfer of information outside Israel

Your information may be processed or stored on servers outside Israel (the United States, Europe) by our service providers. We ensure that these providers meet appropriate security standards and the accepted standards for international data transfer.

10. Children's privacy

The Service is not intended for people under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a minor, we will delete it immediately.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email and by a banner in the dashboard, 30 days before they take effect.

We recommend reviewing this policy from time to time. The date of the last update appears at the top of the page.

12. Contact

For questions, enquiries or requests regarding this privacy policy or the exercise of your rights:

• Email: info@atarika.co.il
• Through the contact form on the site

We will endeavour to respond to every enquiry within 5 business days.