Service providers and data transfers

1. Purpose of this list

This page supplements the Privacy Policy The operator and controller is יהלום זקס, trading as Yahalom Digital Systems Enquiries: yahalomdigitalsystems@gmail.com

Providers receive information according to their role and the action you requested Use of a provider does not authorise disclosure of the entire calendar to a provider that does not need it A provider’s public policy does not replace the contractual terms and safeguards required for processing on our behalf

2. Providers and processing roles

Google - authentication Basic account details and technical sign-in information Google may also act as an independent controller for its services Ordinary sign-in does not authorise access to Gmail, Drive or Calendar Policy: https://policies.google.com/privacy

Google Cloud - application hosting and execution Network requests, account information and content needed to run the application, and operational and security information The application’s primary hosting region is in Israel, me-west1 This does not mean all processing, backups, delivery or support occur in Israel Operational information is also subject to the provider’s privacy notice, while content processed on our behalf is subject to the relevant data processing terms https://cloud.google.com/terms/cloud-privacy-notice

Google Cloud Firestore - active database Account, calendar, settings and operational records are stored in Google Cloud Firestore in the me-west1 region in Israel Selecting a database region does not guarantee that all operational processing, support or information transfers take place in Israel Policy: https://cloud.google.com/terms/cloud-privacy-notice

Email provider - Brevo (Sendinblue SAS) Recipient addresses, limited service-message content and delivery information The entire calendar is not disclosed for a reminder We do not add an opening-tracking pixel to messages, but delivery and failure information may be retained Policy: https://www.brevo.com/legal/privacypolicy/

SMS and OTP provider - 019 SMS (טלזר 019 שרותי תקשורת בינלאומיים בע״מ) Phone numbers, a limited service message or verification code, and delivery information Mobile operators also process information needed for network delivery SMS reminders require phone verification and separate consent Policy: https://lp.019sms.co.il/privacy-policy/

Nominatim / OpenStreetMap - location lookup Following an explicit location request, coordinates and technical request information are sent through the server to identify a city and country We do not intentionally include a name, email or calendar content Coordinates can also be personal data Usage policy: https://operations.osmfoundation.org/policies/nominatim/

Google Gmail - business enquiry mailbox Email sent to yahalomdigitalsystems@gmail.com is processed in a Gmail mailbox It includes the sender’s address, enquiry content and attachments you provide Do not send a full calendar, password, verification code or intimate information unnecessary for the enquiry Policy: https://policies.google.com/privacy

Cloudflare - DNS and email routing DNS processes technical information involved in locating the website Application traffic does not pass through Cloudflare’s Proxy service in this configuration Messages addressed through the domain’s email routing service are processed for forwarding Policy: https://www.cloudflare.com/privacypolicy/

3. Previous hosting and payment

MongoDB Atlas was the previous database and is not the service's active database Historical information or transition copies retained there, if any, remain subject to their retention purposes and the Privacy Policy, and do not authorise restoring a deleted account to ordinary use Policy: https://www.mongodb.com/legal/privacy/privacy-policy

Vercel is a previous hosting platform that has been paused and is not currently used for active website traffic Historical records or information retained there, if any, are subject to the purposes of retention and the Privacy Policy This does not entail ongoing calendar transfers to Vercel

Commercial billing is not active and payment cards are not collected in the current configuration A payment provider and the information disclosed to it will be published before activation Consent to data processing is not authorisation for a charge

4. Limited access and international transfers

A provider acting as our processor must process information within its role, under appropriate instructions and contractual safeguards A provider acting as an independent controller is also subject to its own duties and policy Using a provider does not exempt us from any duty imposed by law

Information may be processed outside Israel Transfers and onward transfers are subject to Israeli law and mechanisms required by other applicable law Selecting an Israeli hosting region does not replace reviewing the processing chain Contact yahalomdigitalsystems@gmail.com for information on processing countries and safeguards applicable to a particular enquiry or service, subject to limiting commercial and security information unnecessary to exercise a right

5. Changes to the list

The list will be updated when a relevant change occurs Replacing a provider does not authorise a new purpose or new use of sensitive data Additional disclosure and consent will be provided and requested where required by law

6. Data sources and licences

GeoNames - source of the Israel city catalog The city catalog is based on GeoNames data licensed under Creative Commons Attribution 4.0 (CC BY 4.0) The data has been filtered and processed into a local catalog, including selection of Hebrew names and spelling normalisation Manual searches run locally and do not send the text you enter to GeoNames The data is provided as is, without warranty of accuracy, timeliness or completeness Source: https://www.geonames.org/ Licence: https://creativecommons.org/licenses/by/4.0/

OpenStreetMap - location lookup data © OpenStreetMap contributors OpenStreetMap data is used to identify city and country names through Nominatim, under the Open Database License (ODbL) Copyright and licence information: https://www.openstreetmap.org/copyright

AI customer support

AI support, when activated, requires separate consent under the Terms for AI customer support It is limited to operational support without permission to read personal calendars or religious data Entered text and necessary support facts may be sent through OpenRouter to Anthropic’s Claude model hosted by Google Vertex in Europe, or directly to Google Vertex’s Gemini model in eu, outside Israel Conversations and titles kept by us expire within 60 days of creation without automatic extension Consent withdrawal and chat deletion do not delete formal support requests No training does not guarantee zero provider retention AI activation requires legal review and privacy verification

Provider retention details appear in the AI service terms