Privacy Policy — LiveJLM

What we collect, and where

Most of the Site needs nothing from you. Giving a personal detail is never a legal duty; every form says what the detail is for and what we cannot do without it. The collection points are:

• Contact form — name, email, phone if you gave it, and your message, to reply.
• Email updates — your address and language, to send the update. Unsubscribe from any email; an unsubscribed address is kept as unsubscribed so it is not re-added by mistake.
• Trip planner — your name, a phone number and the trip you asked for, to build and send the itinerary.
• Submitting an event, place or tour — the listing details and the sender's contact: for an event sent without signing in, a name and an email or phone; when signed in, the Google account you used. They are used to check the listing and ask you a question if needed, a note with them goes to the team on Telegram, and they are never shown on the site. A submission that is not published is deleted 30 days after it was sent; on a published event, the sender's details are deleted 90 days after the event.
• Kafe Shabbat photos — the photo, the place, and if you asked for credit, a name or Instagram handle shown next to it.
• Questions to Maayan — the question text is stored and processed to answer and improve the service, and a message with the question and the answer goes to the team on Telegram. Please keep personal details out of it.
• Loyalty card — the card is identified by a random id only; stamps and redemptions at the business are recorded against it. No name, phone or payment details. The business sees each card's stamp history (dates, number of visits and rewards), with no name or identifying detail.
• Staff clock and staff tasks — for a business that uses them we keep the employee's name, clock-in and clock-out times, touches of station tags (which station and when, no location) and photos the employee takes for a task. They are shown to the business owner and to the employee the task is with only; task photos, the employee's note and the automatic opinion delete themselves within 90 days of being taken. When the owner asked for an automatic check, the photos are sent with the task's title, details and check instruction, as the owner wrote them, to Anthropic's AI service (United States), without the photo's location and device data and without the employee's name; the result is an opinion only, and the decision is the owner's.
• Business self-service — business details and the contact person who entered them.
• Hotel guest requests — a guest sends reception a request from a hotel's guest page (towels, a question): the kind of request, the room number and any note. It goes to that hotel's reception, on its reception screen and as a Telegram alert, only to handle it, and is deleted after 30 days. A hash of the IP address is kept for rate limiting and cleared after a day.
• Telegram and WhatsApp bots — if you message us there, your chat id or phone number and the messages, to reply.
• Email — if you write to one of our addresses, your address and your message, to reply; kept as long as the exchange needs and deleted on request.
• Automatic data — IP address, browser type, cookies and aggregated usage statistics; and when you click a link that leaves the Site, the fact of the click and its destination, with no name or contact detail. To tell a person's click from a crawler's we keep a daily code beside the click, computed from the IP address, the browser type and a random key that changes every day, so clicks cannot be linked from one day to the next. The IP address itself is not stored. Each day's key is deleted on the following day, when that day's first click arrives, and from then on the address cannot be recovered from the code.

Measurement, AI processing and providers

We use Google Analytics 4 for usage statistics and Microsoft Clarity for heatmaps and session recordings; Clarity runs without cookies, masks text, and Microsoft deletes recordings after 30 days. Clarity is not loaded at all for visitors from the EEA, the UK or Switzerland. Questions to Maayan, submitted event texts and business details are processed by Anthropic through a commercial interface that does not train on the content.

Data is hosted outside Israel. Transfers rest on a data processing agreement with each provider, and for the database on an EU member state; using the Site also constitutes consent to these transfers:

• Supabase — database and files, EU (Frankfurt, Germany).
• Vercel — hosting, United States.
• Resend — email delivery, United States.
• Google — Analytics and Google sign-in.
• Anthropic — AI processing, United States.
• Microsoft — Clarity, on Azure.
• Twilio — the WhatsApp bot, United States.
• Telegram — team alerts, the Telegram bot and hotel reception alerts.

On some pages your browser contacts an outside service directly, which then receives your IP address and browser details: YouTube (Google) for embedded videos and their preview images, OpenStreetMap and OpenFreeMap for map images (and unpkg for the map library on the Duda map), and Shawish (shawish.co.il) for the chat window on business pages that use it, once you open it.

In the "address or place" box on the Duda pages, an address you type that is not in our own lists is sent by our server, as typed, to OpenStreetMap's geocoding service (OpenStreetMap Foundation; servers in the UK and the Netherlands) to place it on the map, without your IP address or any identifying detail. We do not keep the address; the result is cached on our side for up to a day, unlinked to you. Your device's location, if you allow it in the browser, is used in the browser only, to order places by distance, and is not sent to us.

Cookies and consent

Besides Google Analytics cookies, the Site sets a session cookie whose only value is "1" (to tell a person's click from a crawler's), and local browser storage for preferences such as favorites. On hotel guest pages, local storage also keeps a random device id, to count distinct devices in the hotel's usage report (linked to nothing else, and not stored for visitors from the EEA, the UK or Switzerland without consent), and the room number you entered in a request. A region cookie, set for every visitor, records only whether the visit is from the EEA, the UK or Switzerland. If it is, Google Analytics runs without cookies until you accept them in the consent bar; your choice is kept in a cookie. You can block or delete cookies in your browser; some features may then not work.

Sharing and retention

We do not sell your personal data. It is shared only with the providers above to operate the Site, with an event organizer or business solely to verify a detail you gave about them, with the hotel you are staying at for a request you sent it, when required by law, or for legal defense in a dispute. Visitor logs (IP address and browser type on clicks and requests) are deleted after 13 months, and so is the daily code on click records; hotel guest requests are deleted after 30 days, and the IP hash beside them after a day; form submissions are kept as long as they are needed for their purpose and deleted on request. Once you reach an external site through one of our links, its privacy policy applies rather than ours.