Privacy Policy

This Privacy Policy explains what personal data Cerevision ("we", "us", based in Israel) collects, how we use and protect it, and the rights you have. It applies to our website, client dashboard, and store. We handle personal data in accordance with the Israeli Privacy Protection Law, 5741-1981, and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data We Collect

• Account data — name and email address when your client account is provisioned by Cerevision.
• Store & payment records — items purchased, amount, currency, date, and PayPal's transaction reference IDs. We do not collect or store your card number.
• Usage data — pages visited, actions taken in the dashboard, and AI assistant request counts (for rate-limiting).
• Contact & chat submissions — the name, email, and message content you send through our contact form or guest chat.
• Cookies — a necessary session cookie to keep you signed in, and optional analytics cookies if you consent.

2. How We Use Your Data

• To provide the services and products you requested and to deliver your purchases.
• To authenticate you and protect your account.
• To issue receipts and maintain accurate accounting and tax records.
• To communicate project updates and respond to your inquiries.
• To operate, secure, and improve the Platform (using aggregate, anonymised analytics only).

3. Legal Bases (Where GDPR Applies)

Where the GDPR applies, we process personal data on the following legal bases: performance of a contract (to deliver our services), your consent (for optional analytics cookies), our legitimate interests (to secure and improve the Platform), and compliance with legal obligations (such as tax and accounting).

4. Third-Party Service Providers

We do not sell your personal data. We share limited data with trusted providers who help us operate the Platform, each bound by their own privacy commitments:

• PayPal — payment processing.
• Anthropic — the large-language-model provider powering the AI assistant.
• Cloudflare — hosting and file storage (Cloudflare R2).
• Resend — transactional email delivery.

We may also disclose data where required by law, court order, or to protect our legal rights.

5. Payments & Card Data

All store and project payments are processed by PayPal. Your card or bank details are entered directly on PayPal's secure systems — Cerevision never sees, handles, or stores your full card number. We only keep a record of each transaction (amount, currency, date, and PayPal's reference IDs) so we can issue your receipt and for our accounting. PayPal's processing of your payment data is governed by PayPal's own privacy policy.

6. Cookies

We use one necessary cookie (your session token) to keep you signed in, and optional analytics cookies. You can choose "Necessary only" in the cookie banner to opt out of analytics at any time.

7. Data Security

We protect your data with industry-standard measures, including encrypted connections (HTTPS), hashed passwords, and signed session tokens. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to it.

8. Data Retention

We retain your data for as long as your client account is active or as needed to provide our services. Transaction and invoice records are kept for as long as required by tax and accounting law. Export files and chat attachments are automatically deleted after 7 days. After a project is archived, account data is deleted within 90 days unless a longer period is legally required.

9. Your Rights

You have the right to access, correct, or delete your personal data, to object to or restrict certain processing, and to request a copy of the data you provided in a portable format. To exercise any of these rights, email hello@cerevision.com and we will respond within 30 days.

10. International Transfers

Some of our service providers process data outside your country. Where data is transferred internationally, we rely on providers that offer appropriate safeguards for such transfers.

11. Children's Privacy

The Platform is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above.

13. Contact

For privacy-related questions or to exercise your rights: hello@cerevision.com.