Privacy Policy

1. Who we are

This policy explains what information CeraHex ("we") collects, why, who it is shared with and what your rights are. It covers cerahex.com and the client portal at portal.cerahex.com.

Responsible for the information: CeraHex (Osek Patur, VAT-exempt). Questions: [email protected].

2. What we collect

• Contact form: name, email, phone (optional), business name (optional), topic, message, and the plan you picked, if any.
• Launch sign-up: your email address.
• Job applications: name, email, phone, role, links, what you wrote about yourself, and your CV (PDF) if attached.
• Client portal: name, email, mobile number, password (stored only as a one-way hash, never as text), and a log of sign-ins and changes with the time and IP address. The portal also shows your services, invoices, support requests and quotes.
• Your agreement: when you accepted this policy and the terms, and which version.
• Instagram direct messages, WhatsApp messages (including the number you wrote from) and the site chat: the messages you wrote and our replies. If you agreed in the chat to share a phone number or email, those too, and the fact that you agreed.
• Payments: payment details (such as a credit card) are entered directly on Grow's secure payment page. We never see or store the full card number, only the amount, the date and whether the payment went through.

You are not required by law to give us any information; giving it is up to you and your consent. Fields marked as required on a form are needed to handle your request, sign-up, application or service, and without them we can't. Fields marked optional are your choice, and leaving them empty doesn't change how we handle anything.

Visit statistics: we count page views without cookies and without storing IP addresses. A visitor is counted by a one-way code that changes every day, so nobody can be followed from one day to the next.

3. Cookies and browser storage

We use no advertising or tracking cookies. Only what the site needs to work:

• A sign-in cookie in the client portal and the dashboard, to keep you signed in.
• Your light or dark theme, kept only in your browser.
• Cloudflare's security check (Turnstile) on forms, which checks that you're a person and not a bot.

4. How we use it

• To get back to you and handle your request, including a quote.
• To send one email when we launch, if you signed up for it.
• To send you information and offers about our products (such as trial access and a reminder about it), only if you asked for them or agreed. Each such message is marked as an advertisement, and you can unsubscribe at any time, free, with the link in the email, or by replying "STOP" on WhatsApp or Instagram.
• To review job applications.
• To serve clients: secure portal sign-in (a code by SMS or email), payments, invoices, support requests and updates.
• To answer your messages. An automated (AI) assistant of CeraHex answers the chats, and a person from our team steps in when needed.
• To improve our services: CeraHex keeps the chats on its own servers and learns from them how to answer better. They are not sold or passed to others for this.
• To keep the site secure and stop spam and abuse.
• To meet legal duties, such as keeping accounting records.

We don't sell personal information or pass it to others for marketing.

5. Who we share it with

Only providers that help us run the service, and only what they need for it:

• Cloudflare: delivering traffic to the site, attack protection and the security check on forms.
• Resend: sending email (replies, sign-in codes, updates).
• 019 Mobile: sending sign-in codes and messages by SMS.
• Meta (Instagram and WhatsApp): delivering the messages you send us there and our replies.
• Grow (Meshulam): processing payments and recurring charges.
• Morning (Green Invoice): issuing invoices and receipts, with your name, business details, email and the amount.
• Hosting: our own servers and cloud servers in the European Union (DigitalOcean, Frankfurt).

We also disclose information to an authority when the law requires it, or when needed to protect our rights or others'.

6. Studio members' data in CeraFit

A studio that uses CeraFit keeps information about its members in it, such as name, phone, email, membership, payments and class attendance. The studio owns that information and is responsible for it. We hold and process it only for the studio and on its instructions, to run the system, and don't use it for any purpose of our own.

Members who want to see, correct or delete their information contact their studio, and we help the studio handle the request. When the studio's subscription ends, the information is handed to it and deleted under the Subscription Terms.

7. Transfers outside Israel

Some providers store or process information outside Israel, in the European Union and the United States. We choose providers committed to an adequate level of data protection, as required by Israel's Privacy Protection Regulations on transfers abroad.

8. How long we keep it

• Enquiries: up to 24 months after the last contact, unless you become a client.
• Launch sign-up: until we send the launch email, or until you ask us to delete it.
• Job applications and CVs: up to 12 months.
• Direct-message and chat conversations: up to 24 months after the last message, unless you become a client.
• Portal accounts: while you are a client, then as long as the law requires (for example 7 years for invoices).

9. Security

Information travels encrypted (HTTPS). Passwords are stored only as hashes, portal sign-in has two steps, access is limited to the staff who need it and there are regular backups. No system is 100% secure; if a security incident affects you, we will tell you and the authorities as the law requires.

10. Your rights

Under Israel's Privacy Protection Law, 1981, you can ask to see the information about you, correct it or delete it, withdraw your consent, or stop receiving messages from us. Write to [email protected] and we will answer within 30 days. You can also contact the Privacy Protection Authority.

11. Minors

The service is for businesses and people aged 18 and over. If we learn we received a minor's information without a parent's consent, we will delete it.

12. Changes

If we change this policy, we update the date above. For a material change we post a notice on the site, and clients also get a message in the portal or by email.

13. Contact

Privacy questions: [email protected].