Privacy
What we do with your data.
The short version: we use what you send us only to reply to you and, if work follows, to run the engagement. Analytics run only if you say yes. No unsolicited mail, no selling, no dark patterns.
Who is responsible
The controller of personal data collected through this site is Opyflow Ltd., company no. 516751039, registered office 115 Keshet Street, Rosh HaAyin, Israel (“Opyflow”, “we”). Questions about this notice go to info@opyflow.com. We are a small firm and do not currently meet the thresholds that require a privacy protection officer or database registration under Israeli law; if that changes, this notice will say so.
What we collect, and why
When you contact us (by email, through the contact page, by phone or on WhatsApp), we receive what you choose to give us: typically your name, work email, company, role and the message itself. We use it for one purpose: to answer you and, if a working relationship follows, to run that engagement. Giving us this information is voluntary. If you don't, the only consequence is that we can't reply. A small script on our web server passes contact-page messages straight to our Microsoft 365 mailbox (info@opyflow.com) as an email; the web server keeps no copy of the message. If we hold your details from another source (an introduction or a professional network), we tell you where we got them the first time we contact you, and this notice applies.
When you subscribe to field notes (our email articles, from the field notes page), we receive the email address you give us, the name if you choose to give one, and whether you asked for every note or a monthly digest. We record the date you asked, the date you confirmed and the IP address the request came from, because Israeli law requires us to be able to show that you asked. We use all of it for one purpose: sending you the notes. We do not use it to profile you, and we do not add it to any other list.
Confirming the subscription. Your details are not stored on our web server while you decide. They travel inside a signed link in the confirmation email and become a subscription only when you open that link and press the button. Confirmation links last seven days. If you never press it, nothing is kept and nothing further is sent: there is no list for you to be removed from. Once confirmed, the address lives in our Microsoft 365 mailbox (info@opyflow.com) and nowhere else. Other than replies to you, the only email we send is field notes, and only to an address that asked for them and then confirmed from its own inbox; we never add an address because it reached us some other way, such as through the contact form, an introduction or a business card.
Site usage. If, and only if, you accept analytics in the banner, Google Analytics 4 sets a cookie with a random identifier and records pages viewed, approximate region and device type, so we can see which pages are useful. Google does not store your IP address; we see only aggregated reports. Decline, and no analytics script loads at all.
Technical logs. Our hosting provider keeps short-lived server logs (IP address, time, page requested) to run and secure the site. We do not use them to identify you.
We do not collect sensitive personal data through this site, we do not profile you, and no decision about you is made automatically.
Legal basis
Under Israeli law, we process what you send us on the basis of your informed consent, given when you contact us after reading this notice. For visitors from the EEA and UK, the legal bases are these. Replying to your enquiry and preparing a proposal: performance of steps you asked for before a contract, and our legitimate interest in responding to people who contact us. Field notes: your consent, which section 30A of Israel's Communications Law requires for commercial email, given by ticking the box and then confirming from your own inbox; you can withdraw it at any time from the unsubscribe link on every message, and withdrawing does not affect what was sent before. Analytics: your consent, which you can withdraw at any time (below). Security logs: our legitimate interest in keeping the site running and secure.
Who receives it
We do not sell personal data and we do not share it for marketing. A small number of service providers process data on our behalf, under contract, for the purposes above: our hosting provider, Bluehost (Newfold Digital Inc., United States), which serves the site and relays contact-form messages; Microsoft (Microsoft Ireland Operations Ltd., Microsoft 365), which receives and stores our email and documents; Cloudflare (Cloudflare, Inc., United States), which checks that contact and subscription forms are sent by a person, not a bot; and Google Analytics 4 (Google Ireland Ltd.), only if you consented to analytics. If you write to us on WhatsApp, the message is also handled under WhatsApp's own terms. LinkedIn receives nothing from this site unless you click through to LinkedIn. We disclose personal data to authorities only where the law requires it.
International transfers
Opyflow is based in Israel, which the European Commission recognises as providing adequate data protection. Some providers above process data in the United States or the EU; where that happens we rely on the provider's certification under the EU–US Data Privacy Framework or on the EU standard contractual clauses (with the UK addendum where relevant). Our processing of data from the EEA and UK is occasional and small-scale, so we have not appointed a local representative.
How long we keep it
Field notes subscriptions: until you unsubscribe, and we keep the record that you asked and confirmed for a further 24 months after that, because that record is our evidence of consent and our proof that we stopped when asked. Enquiries that don't lead to work: up to 24 months from the last contact, then deleted. Engagement records: for the life of the engagement and the period our contracts and Israeli tax and limitation rules require, typically 7 years. Analytics: 14 months, aggregated. Server logs: 30 days.
Your rights
Under Israel's Protection of Privacy Law you may ask what personal data we hold about you, have it corrected, and have it deleted where it is inaccurate, out of date, or held for direct marketing. If you are in the EEA or UK you also have the GDPR rights to have your data erased where there is no longer a reason to keep it, to restrict or object to processing, to data portability, and to withdraw consent without affecting what was done before. To use any of these, email info@opyflow.com; we answer within 30 days (the law lets us extend this for complex requests, and we will tell you if we need to). To stop the field notes you do not need to write to anyone: every message carries an unsubscribe link, one press removes you, and we send nothing after that. You may also complain to the Israeli Privacy Protection Authority or, in the EEA or UK, to your local data protection authority.
Cookies and consent
This site sets no cookies of its own until you choose. Your analytics choice is stored in your browser (a single local setting, no identifier) so we don't ask again; it is kept until you clear your browser storage or change it here. Analytics, when accepted, use Google's cookies for up to 14 months. Change your mind here:
Security
The site is served over HTTPS with security headers, and access to enquiries is limited to the people who need to answer them. No system is perfectly secure; if we learn of a breach affecting your data we will tell you where the law requires it or where we think you need to know, and notify the authorities where required.
Children
This site is for businesses. We do not knowingly collect data from anyone under 18.
Changes
We update this notice when our practices change, show the date at the top and flag material changes there.