Privacy Policy

1. Voluntary Provision of Data (Section 11 Disclosure)

Under Israeli law, you are not legally obligated to provide us with personal information. The provision of your data depends entirely on your free will and consent. However, please note that without providing the necessary information (such as your address, payment details, and contact information), we will be technically unable to register your account, process your orders, or execute delivery.

2. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, phone number, and physical delivery address.
• Transaction Data: Order history, purchased items, and Merchant interactions. (Note: Goatic does not directly collect or store raw credit card numbers. All payments are processed via secure, PCI-compliant third-party gateways).
• Technical & Usage Data: IP addresses, device types, browser information, location data (if permitted by your device for delivery tracking), and interaction metrics via cookies and analytics tools.

3. Purpose of Data Processing

We utilize your personal database strictly for the following purposes:

• Fulfilling and delivering your orders.
• Managing customer service inquiries and mediating disputes.
• Processing payments and preventing fraudulent transactions.
• Complying with Israeli tax and corporate legal obligations.
• Analyzing platform usage to improve our marketplace technology.

4. Data Sharing & Third Parties

Goatic is a marketplace. To fulfill your order, we must share specific data with Merchants and logistics personnel. We also use vetted third-party processors who handle data on our behalf under contractual safeguards:

• With Merchants: We share your first name, initial of your last name, and the contents of your order with the relevant independent Merchant strictly for order preparation. Merchants do not receive your payment information.
• With Delivery Partners: Independent delivery drivers registered on Goatic receive your full name, phone number, and delivery address to complete physical fulfillment.
• Supabase (database, authentication, file storage) — account data, order records, and uploaded images.
• PayMe — Israeli marketplace split payments and seller onboarding (Israel; PCI-compliant, we do not store raw card numbers).
• TextMe — SMS one-time codes and order-related text messages (Israel).
• WhatsApp (Meta) — customer contact when you reach us via WhatsApp, and store settlement notices where applicable.
• Mapbox — map display, store locator, and delivery-route visualization.
• Resend — transactional email delivery (order confirmations, support).
• Sentry — client-side error and performance monitoring, loaded only after you choose "Accept All" in our cookie banner.
• Google Analytics — aggregated usage metrics, loaded only after you choose "Accept All" in our cookie banner.
• Accessibility widgets (UserWay or Enable.co.il) — optional third-party accessibility overlays when configured on the Platform.
• Legal Authorities: We will disclose data if compelled by a binding court order from Israeli judicial authorities or the Israel Police.

We do not sell, rent, or trade your personal data to external data brokers.

5. Direct Mailing & Marketing (Communications Law)

In accordance with Section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982, we will only send you promotional materials, newsletters, or marketing SMS messages if you have explicitly granted us separate, affirmative consent to do so. You maintain the absolute right to revoke this consent at any time by clicking the "Unsubscribe" link in our emails, replying "Stop" to SMS messages, or adjusting your account settings.

6. Your Rights Regarding Your Data

Under Section 13 of the Protection of Privacy Law, you have the right to inspect any personal information held about you in our database. If you find that the information is incorrect, incomplete, unclear, or outdated, you have the right to request that we correct or delete it under Section 14.

To exercise these rights, please submit a formal request to: contact.goatic@gmail.com. We will process your request within the timeframe mandated by Israeli law.

7. Data Security

We implement strict organizational and technical security measures in compliance with the Privacy Protection Regulations (Data Security), 5777-2017. This includes encryption of data in transit, access control mechanisms for our employees, and continuous monitoring of our database infrastructure. Despite these measures, no digital platform is perfectly secure, and we cannot guarantee absolute immunity from unauthorized intrusions.

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Account & profile data: for the life of your account, plus up to 24 months after closure unless a longer period is required by law.
• Order & transaction records: 7 years from the transaction date (Israeli tax and bookkeeping obligations).
• Support tickets & chat logs: up to 3 years after the ticket is closed.
• Server & security logs: up to 90 days unless needed for fraud investigation.
• Marketing consent records: until you withdraw consent, plus a reasonable audit period.

9. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to operate the marketplace. You can manage non-essential cookies via the cookie banner or the Cookie Settings link in the site footer. Essential technologies are required for login, checkout, and security.

• Supabase auth session cookies (essential) — keeps you signed in.
• goatic-cookie-consent (localStorage, essential) — stores your cookie preference choice.
• Guest cart persistence (localStorage, essential after any consent choice) — saves cart items between visits.
• Google Analytics (_ga, _gid) (analytics, optional) — loaded only if you choose "Accept All".
• Sentry (analytics/diagnostics, optional) — client error monitoring, loaded only if you choose "Accept All".
• PayMe (essential during payment) — fraud prevention and checkout session tokens on their domains when you pay.

You can instruct your browser to refuse cookies; doing so may prevent checkout, login, or cart persistence from working correctly.

10. Changes to This Policy

We reserve the right to update this Privacy Policy. Any material changes regarding how we process your data will be communicated to you via the email address associated with your account or through a prominent notice on the Platform.

11. Cross-Border Data Transfers

Goatic is operated from Israel. To provide the marketplace, your personal data may be processed, stored, or transmitted outside of Israel by vetted third-party processors acting on our behalf. These include, among others:

• Supabase — database hosting, authentication, and file storage (infrastructure may be located outside Israel depending on region configuration).
• Resend — transactional email delivery.
• Google Cloud — analytics and cloud infrastructure services (including Google Analytics, when enabled with your consent).
• Mapbox — map and routing services (United States).
• Sentry — error monitoring (United States), when enabled with your consent.
• Meta (WhatsApp) — messaging infrastructure for customer contact and business notices.

Where required by applicable law, we rely on appropriate safeguards — including contractual data-processing agreements — to protect your information when it is transferred across borders. By using the Platform, you acknowledge that such transfers may occur as described in this policy.

12. Database Registration

In accordance with the Israeli Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות) and its regulations, Goatic maintains a personal-information database (רישום מאגר מידע) for the purposes described in this Privacy Policy. The database is operated in compliance with applicable registration, disclosure, and data-security requirements under Israeli law.

• Database owner: אבו ח'אלד קוסאי, עוסק פטור מס' 325579860, operating the Goatic platform.
• Registered address: Beit Hanina, Al-Hijra 18, Jerusalem, Israel
• Registration number: Filed with the Israeli Privacy Protection Authority; contact us for the current registration reference.

You may exercise your rights of access, correction, and deletion as set out in Section 6 of this policy by contacting us at contact.goatic@gmail.com.

13. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your data, please contact our Data Protection Officer at:

Email: contact.goatic@gmail.com