Privacy Policy
Last Updated: July 2026
1. Introduction
AluFlow Ltd. (Company No. 517308623) (the "Company", "we") is the controller of the AluFlow platform's databases and is committed to protecting your privacy. This Privacy Policy serves as a notice under the Israeli Protection of Privacy Law, 5741-1981, and explains what information we collect, for what purposes, with whom it is shared, and what your rights are. For any privacy matter you can contact us at info@aluflow.co.il or +972-52-229-3319.
2. Information We Collect
We collect information you provide directly: name, email address, phone number, business name, and payment information (processed by Cardcom). Providing these details is not required by law, but it is required in order to open an account, provide the Service, and process payments — without it we cannot provide the Service. We automatically collect usage data, including IP address and online identifiers (which constitute personal data under the law), browser type, pages visited, and feature usage patterns. We collect project data you create: designs, BOQ calculations, customer information, and quotes, as well as site or customer-home photos you upload for visualizations — such photos may contain identifying details.
3. How We Use Your Information
We use your information to provide and improve the Service, process payments and manage subscriptions, send transactional emails (billing, security, team invitations), provide customer support, analyze usage patterns to improve features, power AI features (visualizations and the support assistant), comply with legal obligations, and — subject to your consent — for marketing, remarketing, and statistical analysis.
4. Information Sharing
We do not sell your personal information. We use sub-processors to provide the Service, by purpose: Payments — Cardcom (Israel); hosting and infrastructure — Hetzner (Germany) and Neon (managed database); email — Resend; SMS and phone verification — 019sms (Israel); error tracking — Sentry; AI providers — Anthropic, Google (Gemini), and OpenAI, including photos you upload for visualizations; analytics and advertising (subject to consent) — Google Analytics, Google Ads, Meta Pixel, and TikTok Pixel; analytics warehouse — Google BigQuery; internal operations — Discord (operational alerts) and GitHub (handling feedback and bug reports). We will also share information as required by law or court order.
5. AI Processing
To power AI features, project data and photos you upload are sent for processing to external AI providers (Anthropic, Google, OpenAI) acting as sub-processors on our behalf. Under these providers' API terms, the input is not used to train their models. We recommend not uploading photos that include people or sensitive details not needed for the visualization.
6. International Data Transfers
Information is stored on servers in Germany (Hetzner) and is also processed by service providers in the United States and other countries. These transfers are carried out in accordance with the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, including transfers to countries providing an adequate level of protection or subject to appropriate contractual commitments by the providers.
7. Data Security
We implement industry-standard security measures including HTTPS encryption for all communications, JWT-based authentication with secure token handling, bcrypt password hashing, rate limiting on sensitive endpoints, and database encryption at rest.
8. Data Retention
We retain information by category: account and project data — for the duration of your subscription, and for a further 30 days after account deletion for recovery purposes, then permanently deleted; payment records and invoices — 7 years in accordance with tax law requirements; system and security logs — for the limited period required for operations and security; anonymized usage data — indefinitely; processing by AI providers — per those providers' retention policies.
9. Your Rights
Under the Israeli Protection of Privacy Law you have the right to access (inspect) your personal data and the right to correct inaccurate or outdated information. In addition, you may delete your account and associated data, export your data in a portable format, and withdraw consent to marketing communications and non-essential cookies. To exercise your rights, contact us at info@aluflow.co.il and we will handle your request within a reasonable time and in accordance with the law.
10. Cookies and Tracking
We use essential cookies for authentication and session management — these are always active. Subject to your consent in the cookie banner, we also activate: Google Analytics for usage analysis, and advertising/conversion pixels of Meta (Facebook/Instagram), TikTok, and Google Ads. These measurement and advertising tools are off by default and are activated only after your approval. You may withdraw consent at any time by clearing the site data in your browser or by contacting us.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of the Service after changes constitutes acceptance.
12. Contact Us
For privacy-related questions or to exercise your rights, contact the Company's privacy contact at info@aluflow.co.il or call +972-52-229-3319.
13. The AluFlow iOS App
The AluFlow iOS app (available on the App Store) is a dedicated native client for this same Service. This section describes what is specific to the mobile app; the general provisions above (Sections 1 to 12) apply to it as well, except where noted below. Data the app collects: your name, email address, phone number, and account identifier (provided when you sign in or set up your account), a device identifier used solely to deliver push notifications, and - only when you choose to capture or upload a photo (for example a site photo, a customer's home, or an AR snapshot) - photos or videos. All of this data is linked to your account and is collected solely to operate the app; the app never uses it for advertising or tracking. The app does not include any advertising trackers or analytics pixels. Google Analytics, Meta Pixel, Google Ads, and TikTok Pixel, described in Section 10 above, run on the aluflow.co.il website only and are not embedded in the iOS app. Camera and ARKit: when you use the augmented-reality preview, camera images and scene data are processed entirely on your device to position and render the pergola design; they are not uploaded to our servers or shared with any third party. The app does not collect your location. Crash and performance diagnostics: if the app crashes or experiences a performance issue, technical diagnostic data (crash logs, performance metrics, and general device diagnostics) is sent to our error-monitoring provider, Sentry. This diagnostic data is not linked to your identity. Account and data deletion: you can permanently delete your account and all associated data at any time directly in the app, under Settings, using the Delete Account option - a first confirmation, followed by typing the word DELETE to complete the request - or from the website, under Account Settings, using the Delete Account option. Deletion is processed immediately on our servers and is subject to the same 30-day recovery window described in Section 8 above. You may also contact us at info@aluflow.co.il to request deletion.