Privacy Policy

The owner of the database is the operator identified at the top of this page. Privacy requests go to the email address shown there.

This policy is written under the Privacy Protection Law, 5741-1981, including Amendment No. 13, and under the regulations made under that law, including the Privacy Protection (Data Security) Regulations, 5777-2017, and the Privacy Protection Regulations (Transfer of Information to Databases Abroad), 5761-2001.

Information you give us. Registration with email stores a name, an email address, and a password as a hash, not as readable text. If you register or sign in with Google, when that option is open, Google gives the operator an account identifier, a name, an email address, and sometimes a photo. You do not have to use Google.

A guest purchase includes a name, an email address, and a phone number on the site's form. An account is opened, or an existing account is matched, so the course can be delivered.

Credit-card details are typed on the payment page of the payment provider, Cardcom, and are not stored by the operator. After the charge we store the result, the provider's transaction identifier, the amount, and the order. If the provider returns the phone number typed on the payment page, it is stored on the order.

An instructor may give a headline, a description, a photo, a phone number, and bank-account details or a payment note so a balance can be transferred. They also upload or link the course: video, text, a PDF deck, files, reels, a YouTube, Vimeo, or Google Drive link, a WhatsApp group link, and a live-session link.

Connecting Zoom is optional, and only for an instructor. If they connect a Zoom account, we store the Zoom user identifier, the Zoom email address, and encrypted access tokens. For a meeting created through that connection, a cloud recording can be imported into the course's video storage, and Zoom's participant report can supply attendance time by email address.

A copyright report includes a name, an email address, a link, a description, and the relationship to the work. The report is emailed to the operator and is not stored as a record in the site's database.

You may send a design preference: font, colour, and corners, with an optional comment. If you send it while signed in, your user identifier is stored as well.

Information from using the site. We store lesson progress (position and completion), cart items, orders, coupons, and course enrolment. A review written by an enrolled student is shown on the course page with their name and the text they wrote. An instructor's name, photo, headline, and bio are shown on the course page and on their public channel.

A click on buy, and submitting the guest form, are recorded so the instructor can see at which stage a visit to their course stopped. A visitor who is not signed in is identified for this purpose by a random browser identifier, until they identify themselves in the same browser.

Opening the session link inside the time window is recorded as attendance: the time and the number of entries. That is the site's record, not Zoom's own participant list.

A sign-in session may store an IP address and a browser type. The interface language you chose is stored as well. An email address removed from the mailing list is kept so that mail covered by the removal is not sent again.

The operator does not store credit-card numbers, and does not run a third-party analytics tool. Personal information is not sold.

The information is used to open an account and sign in; to complete a purchase, record access to a course, and handle a refund; to show a lesson, slides, and files to someone allowed to view them; to let an instructor see who bought their course and contact them about it; to send a purchase confirmation, a password-reset link, a message the instructor writes to the course's students, an automatic notice of a new lesson if the instructor turned that on, and a reminder for a live session the instructor set; to attribute a sale to an instructor by their referral link, coupon, or embedded purchase card; to secure the site and prevent misuse; and to operate the site technically.

A name and an email address are required to open an account and receive access. Without the details typed at the payment provider, a paid purchase cannot be completed. An instructor's phone number, bank details, a Zoom connection, and a design comment are optional.

When registering an account, the user expressly agrees to the terms of use and to this privacy policy. Optional actions, including connecting Zoom, sending a design preference, and opening a WhatsApp link, are started by the user.

Processing needed to provide what you asked for — an account, a purchase, viewing, a refund — is done to deliver that service. A guest purchase collects a name, an email address, and a phone number in order to finish the purchase you started and to open access.

Information is also kept where the law requires it, including a record of the transaction under consumer-protection law, and a response to a competent authority where disclosure is required.

Information will not be used for a purpose other than the purposes in this policy without telling you, as the law requires.

The operator does not sell personal information.

An instructor whose course you bought sees your name, your email address, and the phone number given on the guest form or on the payment page, and attendance at their live session. That is so they can provide the course. They do not see card details. Bank details an instructor gave are not shown to students.

A message an instructor sends to a course's students is sent separately to each address. The student list does not appear as visible recipients. The reply address is the instructor's, and the sender address is the site's.

Providers that process information in order to run the site: Supabase hosts the database (PostgreSQL) and the files: course images, PDF decks, and lesson attachments. Sign-in is run by the operator on that database, not by Supabase's authentication service. Vercel hosts the site and runs the server, in the Dublin region. Cardcom runs the payment page, and card details are typed there. Bunny Stream stores course videos and serves playback. Cloudflare Stream stores reel videos and serves playback. Resend sends email. A report of a blocked address or a spam complaint can update the site's removal list. A temporary bounce does not remove an address permanently.

Google is used for sign-in, if you choose it. A lesson that is a YouTube video or a Google Drive file is loaded from Google in the viewer's browser. Vimeo is loaded in the browser when the lesson is a Vimeo link.

Zoom is used only by an instructor who connected an account: creating a meeting, importing a cloud recording, and a participant report. Disconnecting, or a notice from Zoom that the app was removed, deletes the connection.

WhatsApp: the site is not connected to WhatsApp's interface and does not send it a student list. The group button checks that you have access to the course, then sends the browser to the invite link. From that point, WhatsApp's own policy applies.

NEXT_LOCALE stores the interface language you chose. Without a saved choice, the first visit opens in Hebrew.

The sign-in cookie is httpOnly and identifies the account. The hint cookie coursely_auth, for seven days, tells the menu that an account is signed in, without exposing the sign-in token.

coursely_ref stores an instructor referral, for up to 90 days, so a sale can be attributed. coursely_vid is a random browser identifier, for 180 days, so a buy click by an unidentified visitor can be tied to a later purchase from the same browser. It is not used for cross-site advertising.

While connecting Zoom, a short-lived cookie with a random identifier checks that Zoom's response belongs to that request.

In the browser only, and not sent to the server, we store accessibility preferences, the design preview, and which pane is larger — the video or the slides. Sending a design vote is the action that is stored on the server.

The site does not use third-party advertising cookies.

Account details are kept while the account is open. After a deletion request we delete what can be deleted, and we keep a record still needed to preserve access that was already bought, to handle a refund, or to meet a legal duty.

Orders and payments are kept so the course stays available, a refund can be handled, and legal duties can be met. The site has no automatic deletion date for an order.

Zoom tokens are deleted on disconnect, or when Zoom reports that the app was removed. A forgot-password reset link is valid for one hour. A set-password link sent after a guest purchase does not expire by time, and it stops working once it has been used.

coursely_vid is kept for 180 days, coursely_ref for up to 90 days, and the hint cookie for seven days. An address removed from mailings is kept so the removal continues to apply.

Passwords are stored as a hash. Zoom tokens are encrypted. Playback of a video we host uses a short-lived signed link, and a lesson file is opened with a signed link as well. Traffic to the site is encrypted. Public access to the database through the database provider's public interface is blocked. The site itself reaches the database from the server.

These measures reduce risk. They are not a promise that a breach will not happen.

Under the Privacy Protection Law, including Amendment No. 13, you may ask to see the information about you, to correct information that is not accurate, complete, clear, or up to date, and to have it deleted. Deletion is subject to the law and to the need to keep a record of a transaction and of access that was already bought.

The request goes to the email address at the top of this page. We will reply within a reasonable time. The site has no button for deleting an account yourself. Deletion is done on request.

Mail an instructor sends, a notice of a new lesson, and a session reminder include a removal link. Opening the link does not remove you; a confirmation is required. An address that was removed will not receive that mail. A message needed to deliver a purchase, such as a purchase confirmation or a password-reset link, may still be sent.

The site is meant for someone who can enter the agreement in the terms of use. The site does not check age, and the operator does not knowingly ask a child for information. If we learn that a minor's information was collected without a parent's or guardian's consent where the law requires that consent, we will delete it after a request to the email address at the top of this page.

The site is aimed at an audience in Israel. Some providers process information outside Israel. The site's server runs in the Dublin region in Ireland, and the Supabase database is in Ireland, in the European Union. Bunny Stream, Cloudflare, Resend, Google, and Zoom may process information outside Israel, including outside the European Union. Cardcom operates in Israel.

A transfer outside Israel is made only as far as it is needed to run the service, under the Privacy Protection Regulations (Transfer of Information to Databases Abroad), 5761-2001.

The operator may update this policy. The date of the latest update appears at the top of this page, and a material change will be published on the site. Continued use after an update takes effect is agreement to the updated text.

A request for access, correction, or deletion, and any other notice under this policy, should be sent to:

[Business name]

[Company number / licensed dealer number]

[Postal address]

Yossi@coursely.co.il