Privacy Policy

1Who is responsible

[your full legal name], a sole trader registered in Israel, at [your registered business address], is the controller of the personal data described here. Contact us at hello@made613.com about anything in this document, including to exercise the rights set out below.

2What we collect

Account data, when you register:

• your email address;
• a password, stored only as a hash by our authentication provider — we never see the password itself;
• the dates your account was created and last signed in.

Usage data, when you use the site: which templates you viewed, previewed, copied a prompt from or downloaded, and the plan-related actions you took. This is stored against your account where you are signed in, and anonymously where you are not.

Payment data: handled entirely by our merchant of record, Paddle.com Market Ltd. They collect your name, billing address, tax location and payment details. We receive only the subscription or purchase status, the plan, the billing period and their internal identifiers. We never see or store your card number.

Technical data: our hosting provider records standard server logs, including IP address and user agent, for security and debugging.

We do not collect special category data, we do not build advertising profiles, and we do not buy data about you from anyone.

3Why we process it, and on what basis

Where the GDPR or UK GDPR applies, our legal bases are:

• Performance of a contract — to create your account, give you the access you paid for, and provide support.
• Legitimate interests — to keep the service secure, to prevent abuse of premium content, and to understand which templates are used so we know what to build next. We have balanced these against your rights and use the minimum data that answers the question.
• Legal obligation — to keep records required for tax and accounting.

Where you are in Israel, we process your data in accordance with the Protection of Privacy Law, 5741-1981.

4Who processes it for us

We use a small number of processors, each under a data processing agreement:

• Supabase — database, authentication and file storage.
• Paddle.com Market Ltd — payments, tax and receipts. They are an independent controller for the payment data they collect, not our processor.
• Our hosting provider — serving the site and its logs.

We do not use third-party advertising or tracking services. Analytics are our own and are stored in our own database.

5International transfers

Our processors may store and process data outside your country, including in the European Union and the United States. Where data leaves the European Economic Area or the United Kingdom, the transfer is covered by Standard Contractual Clauses or an adequacy decision.

6How long we keep it

Account data: for as long as your account exists, and for 30 days after you delete it so that an accidental deletion can be undone.

Usage data: for 24 months, after which it is deleted or aggregated so that it no longer identifies you.

Records needed for tax and accounting: for as long as the law requires, typically seven years.

Server logs: for 30 days.

7Cookies

We set cookies that are strictly necessary for the service: a session cookie that keeps you signed in, and a security cookie that protects forms against cross-site request forgery. That is all. We do not set advertising or cross-site tracking cookies, which is why you are not asked to consent to any.

Checkout pages hosted by Paddle.com Market Ltd may set their own cookies, governed by their privacy policy.

8Your rights

Subject to the conditions in applicable law, you have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted — you can delete your account yourself, and we will remove the rest;
• receive your data in a portable format;
• object to, or ask us to restrict, processing based on legitimate interests;
• complain to a supervisory authority — in Israel, the Privacy Protection Authority; in the EU or UK, your national data protection authority.

Write to hello@made613.com and we will respond within 30 days. We do not charge for this, and we will not make you justify the request.

9Security

Access to data is controlled at the database level by row-level security policies, so a user account can read only its own records regardless of what the application asks for. Premium prompts are never sent to a browser that has not been authorised for them by the server. Downloads are issued as short-lived signed links rather than public URLs.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.

10Children

Made613 is not intended for people under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, write to hello@made613.com and we will delete it.

11Changes

If we change this policy in a way that materially affects you, we will email you before the change takes effect. The date at the top always shows the current version.