Privacy Policy

The Landly website at www.golandly.com and the Landly mobile apps are operated by Landly, Tel Aviv-Yafo, Israel ("we", "us"). Landly is the controller (database owner) responsible for the personal information described in this policy.

For any privacy question or request, contact us at team.landly@gmail.com or by phone or WhatsApp at +972 55-720-6711.

This policy applies to the Landly website, the Landly apps for iOS and Android, and the emails and customer support we provide in connection with them (together, the "Service"). It covers members who sign up for perks and vouchers, and visitors who browse the Service without an account.

Partner businesses that offer perks through Landly are independent. When you visit or buy from a business directly, its own privacy practices apply.

Account information

• Your first and last name, and the display name formed from them.
• Your email address and whether it has been verified.
• If you sign up with an email and password: your password, which is handled by Firebase Authentication and stored only as a salted, one-way hash. Landly staff can never see it.
• If you sign in with Google: the information described in Google user data, including your profile picture.
• The date your account was created and whether you have completed onboarding.

Membership and profile details

• Your member type, which you choose so we can show relevant perks and community offers: Student, New Immigrant (Oleh Chadash), Lone Soldier, Taglit, Long-term program (such as Masa), Traveler, or Other. If you choose Other, the short description you type.
• Your member type is your own statement and you can change it at any time. We do not ask for proof of it, and we do not request or collect military service records, ID documents or any official or classified military information.
• Your country of origin, which you choose during onboarding.
• Where in Israel you live, if you choose to tell us: one of North, Haifa & Krayot, Center, Tel Aviv & Gush Dan, Jerusalem or South, or that you are not in Israel yet.
• Your preferred language for the Service and our emails.
• The offers you save to your wishlist.

Contact and notification details

• Your phone / WhatsApp number, including country code, if you provide it.
• Your notification preference: whether you agreed to receive notifications. The app records only this yes/no choice; we do not currently store device push-notification tokens.

Orders, vouchers and redemptions

• The perks you claim or buy: the offer, the partner business, the price and currency, the order status and the payment date.
• Your vouchers: the unique redemption code (displayed as a QR code in your digital pass), whether the voucher is active or redeemed, and when it was claimed and redeemed.

Payment information

Paid offers are processed by our payment provider, Tranzila. You enter your card details on Tranzila's secure payment page. Landly never receives or stores your full card number or security code; we receive only the outcome of the payment and a transaction reference.

Messages you send us

When you contact us through the support form, by email or on WhatsApp, we receive your name, contact details and the content of your message.

Aliyah mentor requests

If you ask to be matched with a personal Aliyah mentor on our Making Aliyah page (available to signed-in members), we receive the name you enter, your account email address and account reference, your preferred mentor language, your planned Aliyah date, any notes you add and the language you use the Service in. The request is sent to the Landly team, who use it only to match you with a mentor. We share these details exclusively with the verified community mentor matched to you, solely for matching and guiding you, and never with partner businesses or for marketing.

Technical information

Like any website, our servers and hosting provider receive technical data with each request, such as your IP address, browser or device type and the pages requested. We use it to deliver the Service, keep it secure and limit abuse (for example, rate-limiting repeated sign-in, password-reset and verification email requests). We do not use it to build advertising profiles.

You can create a Landly account or sign in with your Google account ("Sign in with Google"). This section explains how we handle the information Google shares with us.

What we receive from Google

We request only the basic sign-in scopes openid, email and profile. With your permission, Google shares:

• your name;
• your email address and whether Google has verified it;
• your profile picture (as a link to the image hosted by Google); and
• a unique Google account identifier used to recognise you when you sign in again.

We do not request access to your Gmail, contacts, calendar, Drive files or any other Google data, and we never receive your Google password.

How we use Google user data

We use the information above only to:

• authenticate you and create and secure your Landly account;
• fill in your member profile and deliver personalised perks and vouchers;
• prevent fraud and abuse of the Service; and
• send you account communications, such as security and service messages.

Limited Use

Landly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We never sell, rent or trade Google user data, and we never share it with third parties for marketing or advertising, or with data brokers or information resellers.
• We never use Google user data to serve advertisements, including personalised or retargeted ads.
• We transfer Google user data to others only as necessary to provide the Service (to the service providers listed in Service providers, who act on our instructions), to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
• No person at Landly reads your Google user data unless you ask us to (for example, in a support request), it is needed for security or fraud investigations, or the law requires it.

You can remove Landly's access at any time from your Google Account at myaccount.google.com/permissions. To delete the Google user data we already hold, see Deleting your account and data.

We use personal information for the following purposes, each on the legal basis shown:

• Providing the Service: creating and managing your account, showing perks that match your member type, issuing vouchers and digital passes, processing orders and refunds (performance of our contract with you).
• Account communications: email verification, password resets, voucher and order confirmations and important service notices (performance of contract and our legitimate interest in operating the Service).
• Notifications about perks: only if you opted in, which you can change at any time (consent).
• Security and fraud prevention: verifying accounts, rate-limiting abuse and protecting members and partner businesses (legitimate interests).
• Customer support: answering your questions and requests (performance of contract and legitimate interests).
• Aliyah mentor matching: only when you ask for a mentor, matching you with one and passing your request to that mentor (performance of our contract with you, at your request).
• Legal compliance: keeping transaction records required by tax and accounting law and responding to lawful requests (legal obligation).

We do not use your information for automated decision-making that has legal or similarly significant effects on you, and we do not sell it or use it for third-party advertising.

When you redeem a voucher, the partner business sees only what it needs to honour it: the voucher's reference, the offer and the dates it was claimed and redeemed. We do not give partner businesses your name, email address, phone number or member type.

We use the following trusted providers to run the Service. They process personal information only on our instructions and under contractual confidentiality and security obligations:

• Google Firebase and Google Cloud (Firebase Authentication, Cloud Firestore): account sign-in and secure storage of account, profile, order and voucher data.
• Vercel: hosting of the website and our server functions, including request logs.
• Resend: delivery of transactional emails such as email verification, password resets and order confirmations, and of the messages you send through our support, business and mentor request forms to our team.
• Tranzila: secure payment processing for paid offers.
• Google Fonts and Cloudflare (cdnjs): delivery of fonts and icons used by the website. Your browser contacts these services directly, which reveals your IP address to them.
• Apple App Store and Google Play: distribution of the mobile apps. If you allow notifications, your device's operating system delivers them.

We do not sell or rent personal information. We may disclose it only:

• when required by law, court order or a lawful request from a public authority;
• to protect the rights, safety and property of Landly, our members, partner businesses or the public, including to prevent fraud;
• as part of a merger, acquisition or sale of all or part of our business, in which case the recipient must honour this policy and we will notify you; or
• with your consent or at your direction.

We do not use advertising cookies, analytics tools or cross-site tracking. The Service uses your browser's or device's local storage only for essential functions: keeping you signed in (Firebase Authentication), remembering your language, saving an onboarding form you have not finished yet, and remembering which notices and introductions you have already seen. You can clear this storage at any time in your browser or device settings; you will then need to sign in again.

• All data travels over encrypted connections (HTTPS / TLS).
• Data is stored on Google Cloud infrastructure (Firebase Authentication and Cloud Firestore), which encrypts data at rest.
• Passwords are never stored in readable form; Firebase Authentication keeps only a salted hash.
• Database security rules ensure that each member can read only their own profile, orders and vouchers. Orders and vouchers can be created or changed only by our servers.
• Administrative access is restricted to authorised Landly staff and protected by a password, short-lived sessions and rate limiting.
• Sign-in, password-reset and email requests are rate-limited to slow down automated attacks.

No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant authorities of a data breach where the law requires it.

• Account and profile data (including Google user data, member type, country of origin, region, phone number, preferences and wishlist) is kept for as long as your account exists and is deleted when you ask us to delete your account.
• Order, transaction and voucher records are kept for up to 7 years, as required by Israeli tax and bookkeeping law, and then deleted. During that period they are used only for legal, accounting and dispute purposes.
• Support messages are kept as long as needed to resolve your request and handle any follow-up.
• Mentor requests are kept as long as needed to match you with a mentor and handle any follow-up.
• Server logs are kept for a short period by our hosting provider for security and troubleshooting.

You can ask us to delete your Landly account and personal data at any time. You can submit an account deletion request directly through your app settings under Settings → Delete Account (or via the website settings), or by contacting our team at team.landly@gmail.com.

1. In the app or on the website, confirm the request while signed in. You can tell us why you are leaving, but you do not have to. The request, with any reason you give, is sent to our team.
2. By email, write from the address registered to your Landly account, with the subject "Delete my account". We may ask you to confirm the request from that address, so that nobody else can delete your account.
3. We will delete your account, your sign-in record (including any Google user data) and your profile data, and confirm by email, within 30 days of your request.

Order, transaction and voucher records that we must keep by law are retained as described in Data retention and are no longer linked to an active account. Unredeemed vouchers are cancelled when the account is deleted.

If you signed in with Google, you can also remove Landly's access from your Google Account at myaccount.google.com/permissions; this stops future access but does not by itself delete the data we hold, so please also send us a deletion request.

Depending on where you live, including under Israel's Protection of Privacy Law, 5741-1981 and its regulations, and the EU and UK General Data Protection Regulation (GDPR), you have the right to:

• Access: ask for a copy of the personal information we hold about you;
• Correction: correct inaccurate or incomplete information (you can also edit most details on your Profile page);
• Deletion: ask us to delete your information, as described above;
• Restriction and objection: ask us to limit or stop certain processing;
• Portability: receive the information you gave us in a common, machine-readable format;
• Withdraw consent: for example, turn off notifications, at any time and without affecting earlier processing; and
• Complain: lodge a complaint with the Israeli Privacy Protection Authority or, in the EU/UK, with your local data protection authority.

To exercise any of these rights, email team.landly@gmail.com. We will respond within 30 days and will not discriminate against you for exercising them.

Landly is based in Israel. Our service providers, including Google Cloud and Vercel, may store and process data in other countries, including the European Union and the United States. When personal information is transferred outside Israel or the EU, we rely on the safeguards required by law, such as adequacy decisions and Standard Contractual Clauses offered by our providers.

Landly is intended for people aged 16 and over. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has given us personal information, contact us at team.landly@gmail.com and we will delete it.

We may update this policy as the Service changes. We will update the "Last updated" date above and, for material changes, notify members by email or in the Service before the changes take effect. The English version of this policy is the governing version; any translation is provided for convenience.