Privacy Policy

This policy explains what personal information is collected on the website of שדרות ושער הנגב ("we"), what it is used for, where it is stored, with whom it may be shared, and what your rights are regarding it under the Protection of Privacy Law, 5741-1981, and the regulations made under it. The policy is written in the plural and is addressed to all genders.

You are not legally required to give us personal information. However, without certain details we will not be able, for example, to register you for an event or to verify a donation you reported.

Donations

• For every donation we store the amount, the payment method you chose and the purpose of the donation (a general donation, a donation category or a specific event).
• With a credit card or PayPal donation you may give a name and an email address, and in some categories also a dedication text — all of these are optional.
• When you report "I donated" for a bank transfer or a Bit payment, we collect your full name, phone number and/or email address (at least one of the two) and optional notes, so that we can identify the payment and verify that it was received.
• Credit card details are not typed on our website, do not pass through our servers and are not stored by us. The payment takes place on the secure page of the payment processing company. Bank transfers, Bit payments and PayPal payments also take place outside the website — at the bank, in the Bit app or on the PayPal website — and we do not receive your account or card details through the website.
• The website's administrators can also manually record a donation received in another way (for example by phone or in cash), including the donor's name and contact details.

Event registration (RSVP)

The event registration form collects your full name, phone number, the number of participants, and notes or special requests (optional). The information is stored in the website's database, and the website's administrators can view it, edit it and export it to an Excel file in order to organize the event.

Contact form

The name, email address and message you write in the contact form are sent to us by email, and are not stored in the website's database.

Newsletter

The email address entered in the newsletter sign-up form at the bottom of the page is stored on the Chabad House's mailing list and is used to send updates about events and lessons. Every email contains a link for removal from the list; anyone who has removed themselves will not receive further emails. Chabad House staff can also add other contacts to the mailing list (name, email address, phone number and gender, all optional), view, edit and delete them, and send them emails. The emails are sent through the Resend mailing service, which receives the recipient's address and the content of the email for delivery purposes only.

The WhatsApp management assistant

• The Chabad House's administrators can also manage the website's content in a WhatsApp conversation with the management assistant, from phone numbers approved for this in advance in the admin panel. For each approved number we store the phone number, a display name and the time of last use, and if a PIN code was set — only a one-way encrypted version of it.
• The most recent messages in the conversation (up to 20) are stored so that the assistant understands the context. A conversation with no activity for an hour is no longer used, and is deleted in the next periodic clean-up. An image sent to the assistant is stored in the website's storage service (see section 5), and will be shown on the website if approved for use on it.
• The identifier of each incoming message (without its content) is stored for about a week, so that a message is not handled twice.
• Messages from a number that is not approved are not handled: they receive at most one fixed reply per day, and for this purpose a one-way encrypted identifier of the number — not the number itself and not the content of the message — is stored for up to two days.
• In the server logs, phone numbers appear partly hidden, and the content of messages is not recorded in them.

Technical information

Your IP address is used temporarily, in the server's memory only, to limit the number of requests and to prevent misuse of the forms. Our hosting providers may keep standard access logs (such as the IP address, the time of the request and the type of browser). The website does not use traffic analysis (analytics) tools, pixels or advertising cookies.

• The website does not store cookies for ordinary visitors.
• For the website's administrators only, after logging in, an essential login cookie (httpOnly) is stored, whose purpose is to identify them as authorized to perform management actions.
• The accessibility settings you choose in the accessibility toolbar (text size, contrast, stopping animations and the like) are stored only in your browser's local storage (localStorage), so that they are kept for your next visit. They are not sent to us, and they can be deleted with the "reset settings" button in the toolbar or by clearing your browsing data.
• So that the chat's opening bubble ("I'm here to help") is shown only once per visit, a marker is stored in the browser's temporary storage (sessionStorage), which is deleted when the tab is closed. The marker is not sent to us.
• The lesson video on the home page is embedded from YouTube. When the video loads, YouTube (Google) may store cookies and collect information in accordance with its privacy policy.

• Receiving donations, verifying donations you reported, and contacting you about them.
• Managing registration for events and preparing for them.
• Answering enquiries sent to us.
• Sending email updates to those who signed up to the mailing list.
• Securing the website and preventing misuse.

We do not sell, rent or transfer personal information for marketing purposes, and we do not use it for mailings without your consent.

• The details of donations and event registrations, as well as the WhatsApp management assistant's data described in section 2, are stored in a PostgreSQL database hosted on the Neon cloud service.
• Images uploaded by the website's administrators (event images, the gallery and the like) are stored in the Cloudflare R2 storage service and are shown publicly on the website. Visitors do not upload files to the website.

The servers of these providers may be located outside Israel.

• Neon and Cloudflare — hosting of the database and the images, as described above.
• Resend — the website's email sending service. Messages from the contact form are sent to us through it, as is a notice of every "I donated" report (including the name, contact details, amount and notes you gave). Registering for an event does not send an email.
• The payment processing company — when credit card payment is available on the website, it is carried out through an external payment processing company. The card details are given directly to the payment processing company, subject to its privacy policy. To open the payment page we pass it the amount and description of the donation, and the name and email address if you gave them.
• PayPal and Bit — if you choose to donate through them, the payment takes place on their platform and is subject to their privacy policy.
• Google Gemini — the website's administrators can use artificial intelligence (Google's Gemini) to draft texts and create images for events and community news, so texts and images on the website may be based on AI-generated content edited by us. The digital assistant (the chat) also works through Gemini: the questions you write in it are sent to Google to draft an answer, and are not stored by us. Before sending, email addresses and phone numbers are removed from the message, and a message containing a credit card number or an identity number is not sent at all — and in any case personal details should not be shared in the chat. When a website administrator uses the management assistant and asks for information about an event's registrants, the registrants' names, the number of participants and the notes they wrote (without phone numbers) are sent to Google. Donors' details are not sent to the service — the assistant receives only summaries of amounts. Conversations with the management assistant — on the website or on WhatsApp — are also sent to Gemini to draft an answer and suggested changes, and the website asks Google not to store them. The WhatsApp assistant's PIN code is never sent to Gemini.
• Meta (WhatsApp Business Platform) — the messages and images that the website's administrators send to the management assistant on WhatsApp, and the assistant's replies to them, pass through Meta's WhatsApp Business platform, subject to the terms and privacy policies of Meta and WhatsApp.
• YouTube, WhatsApp and Google Maps — the lesson video is embedded from YouTube; the share button on events opens WhatsApp with a ready-made text, and the directions button opens Google Maps. The website itself does not send them your details, but their use is subject to their privacy policies.

Other than the above, we will give personal information to another party only if required to do so by law.

Access to the personal information collected on the website is limited to the website's administrators, who log in with a password. Credit card details are not stored by us at all. We take reasonable measures to protect the information, but no security measure guarantees absolute protection.

The information is kept for as long as it is needed for the purposes for which it was collected — for example, donation details are also kept for bookkeeping and to comply with legal requirements. Apart from the WhatsApp management assistant's data, which is deleted automatically as described in section 2, there is currently no automatic deletion of information; you can ask us to delete information, as set out in the next section.

Under the Protection of Privacy Law, 5741-1981, you are entitled to inspect the information kept about you in our database (section 13 of the Law). If you find that the information is not correct, complete, clear or up to date, you are entitled to ask for it to be corrected or deleted (section 14 of the Law). If we do not respond to the request, you may contact the Privacy Protection Authority.

To exercise these rights, contact us using the contact details in section 11. We may ask to verify your identity before we give or change information.

We will update this policy when new capabilities are added to the website or when the way information is handled changes. The date of the last update appears at the top of the page.

For any question or request on a privacy matter, you can contact us:

• Email: chabad_sderot@walla.com
• Phone: 08-6613770
• Address: רח’ חטיבת גבעתי 11 שדרות