Privacy policy

This policy explains what personal information Acto collects, why, who it is shared with, and your rights. It is written for an international audience and also reflects Israeli privacy law, including Amendment 13.

The controller of personal data for Acto is Yaakov Aharon Walles, an exempt dealer (Israel), licensed dealer no. 204108542. Acto is offered from Israel to users in Israel and worldwide. Privacy requests: office@haindex.co.il. The service is operated from Israel and offered worldwide.

1. Information we collect

• Account details from Google: name, email, and user ID.
• Business name and display name you enter.
• Content you put in the product: inbox items, tasks, dates, notes, share tokens.
• Contacts you save (name, type, phone, email).
• Minimal technical data for security: session cookies, and IP / usage logs held by hosting providers.
• Language and timezone preferences, plus a locale cookie.
• Subscription status and Lemon Squeezy customer/subscription IDs when you pay. Full payment card details are stored by Lemon Squeezy, not by us. Lemon Squeezy is merchant of record for the payment transaction.
• When the partner program is enabled: an affiliate ID cookie (`acto_aff`) only after you accept marketing cookies, and/or Lemon Squeezy affiliate tracking.
• When regional pricing (PPP) is enabled: IP address or country to show checkout pricing/discounts (ParityDeals), per service configuration.

2. Why we use it

• Creating an account and signing in.
• Providing the service: tasks, contacts, and share links.
• Assigning a founder slot based on actual use.
• Billing, receipts, and tax (via Lemon Squeezy).
• Security, abuse prevention, support, and legal duties.

We do not sell personal information or use it for third-party ads. There is no automated marketing email as of the date of this policy.

3. Legal bases (including GDPR where it applies)

We process account and content data to provide the service you request (contract). Billing is required to perform a paid subscription. Security logs are processed as a legitimate interest in keeping the service safe. You can also withdraw Google access at any time.

4. Contacts you store

If you save someone else’s name, phone, or email, you are responsible for having a lawful basis to do so. We only process those details to show them in your account and to help you share a task link.

5. Public share links

You can create a public link (`/t/...`). While the task is open, anyone with the link can see the title, due date, status, and note, and mark it done. After it is done or cancelled they only see the status. You send the link - Acto does not.

6. Processors

• Google - sign-in (OAuth).
• Supabase - auth, database, and storage.
• Vercel - hosting the site.
• Lemon Squeezy - payments, invoices, tax, and affiliate tracking as merchant of record when you pay. Lemon privacy policy: lemonsqueezy.com/privacy.
• ParityDeals (optional) - location-based checkout pricing when enabled.

These providers may process data outside Israel and the EEA. Transfers are made to operate the service, under their security and contract terms. If you are in the EEA/UK you may have additional rights (access, rectification, erasure, restriction, portability, and objection). Send requests to office@haindex.co.il. We aim to reply within 30 days. You may also lodge a complaint with your local supervisory authority.

7. Cookies & consent

Essential (always on): sign-in session, locale cookie (`NEXT_LOCALE`), timezone, and `acto_consent` (stores your choice).

Analytics (optional): loaded only after consent - for example Google Analytics when enabled.

Marketing (optional): loaded only after consent - for example partner referrals (`acto_aff`), Lemon affiliate, ParityDeals regional pricing, or a Meta/Facebook pixel when added.

On your first visit we show a consent banner. You can change your choice anytime via Cookie settings in the site footer.

8. Retention

Account and workspace content are kept while the account is active. After deletion we remove related content except what we must keep by law (for example a short billing record).

9. Security

Workspace data is limited to the signed-in account, with HTTPS and row level security. No security is perfect. We will handle and report incidents as required by law.

10. Children

The service is for adults running a business. Do not use it if you are under 18.

11. Changes

Material changes will be dated at the top of this page.