# Privacy Policy

> Last Updated: 17 October 2026

- Web page: https://sporesec.com/en/privacy
- Language: English
- Last updated: 2026-10-17
- Also in עברית: https://sporesec.com/he/privacy.md

## Answer

SporeSec ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website sporesec.com and use our services.

Last Updated: 17 October 2026

## 1. Introduction

SporeSec ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website sporesec.com and use our services.

We comply with Israel's Privacy Protection Law, 5741-1981, including Amendment 13 (in force since August 2025). Our services are directed at customers in Israel and are not directed at residents of the EU or EEA: we have no establishment or representative in the EU and do not knowingly collect personal data of EU residents. Wherever you browse from, we keep collection minimal and honor the Global Privacy Control (GPC) signal.

## 2. Information We Collect

**Information You Provide**
- **Contact Information:** Name, email address, phone number when you submit a contact form or subscribe to our mailing list.
- **Business Information:** Company name, website URL, account type (business/personal) when provided.
- **Communications:** Content of messages you send through our contact form.
- **Our notes:** when we answer an enquiry or speak with you, we may keep a short note of what you asked for.
- **Booking a call:** the booking page shows our own booking form, or Cal.com's embedded calendar (next item) when our form cannot show times or while we work with Cal.com instead. On our own form we collect your name, your email address, the time you chose and how you want to talk (video or phone). A phone number is needed only for a phone call. The call topic, a few questions about your business and a free-text note are optional. Please do not put sensitive details (health, ID numbers, passwords) in the note. Giving us these details is voluntary and not a legal duty, but without a name and an email address we cannot book the call online; you can message us on WhatsApp or through the contact page instead.
- **Booking in the embedded calendar:** when the page shows Cal.com's embedded calendar and you book through it, you give your name, email address and an optional note to Cal.com's scheduler. Cal.com holds the booking and tells us about it, and we use it only to arrange and run the call. Giving these details is voluntary, but a call cannot be booked without a name and email address. Cal.com keeps its own records under its own terms.
- **Free Website Audit tool:** The URL you scan is processed through our server-side proxies: Google PageSpeed Insights for performance scores, our own edge scanner for security headers and DNS email records, Google Web Risk for malware status, and a passive read of the returned page for obvious exposure signals (for example an exposed key pattern or a CORS misconfiguration). The scan is read-only and is not a penetration test. We do not store the target's page content; only the URL and the computed result summary. If you request the emailed report, we store the scanned URL, the results, your email address, and your separate marketing opt-in choice.
- **Saving a quote in the configurator:** your email address, the modules you chose, any note or reason you typed, and your language. We email you the quote with a link to open a free account. If you also tick the separate marketing box (never ticked for you), we record the time and the exact wording you saw, and add your address to our mailing list (Brevo); you can unsubscribe in one click at any time. Saved quotes are deleted after 90 days (section 7).
- **Opening an account from a saved scan, proposal or booking:** when you ask us to open a free account, we email a sign-in link to the address saved with that item, and no account exists until you click it. We record your request (the address, which saved item it concerns, the time), your agreement to the Terms of Service and this Privacy Policy (the version of each, the time, a keyed hash of your IP address and your browser type) and, separately, your optional choice to receive advertising emails. Giving these details is voluntary; without your agreement we do not open an account. If you do not click the link within 14 days, we delete the request. We use the record to open your account, to attach the saved item to it and to prove your agreement. Advertising emails need a second step: the box you tick is held as pending, and counts only after you click the link in the sign-in email. You can switch it off with one click at any time.
- **WhatsApp:** if you message our WhatsApp Business number, we receive your phone number, display name and messages through Meta's WhatsApp Business Platform. If you leave your email in the chat on this site, we store it with your message so we can follow up. You can stop at any time by sending STOP.
- **Customers billed without a portal account:** if we have billed you, or worked with you under an agreement, and you have no portal account, we keep a customer record: your name, business name, email address, optional phone number, language and country; the receipts, payment requests and credit notes we issued you (their number, date, amount and a one-line description of the work); the agreements behind the work; and one short factual note from us on how the work went (whether it stayed in scope, and whether we would work together again). You can ask to see all of it, including that note.

**Automatically Collected Information**
- **Log Data:** IP address, browser type, pages visited, timestamps. Processed by our hosting provider (Cloudflare) for performance and security.
- **Cookies:** Essential and functional cookies only, by name: NEXT_LOCALE (language), sporesec_pending_claim / sporesec_pending_proposal (short-lived, HTTP-only carriers that attach a saved scan or a saved proposal to your new portal account; one day at most), sporesec_pending_ref (the same kind of carrier for a referral: it holds only the referral code, for up to 30 days, so a referral still counts when you open your account later; the code is also kept for up to 30 days in your browser's local storage on sporesec.com, under the key sporesec-pending-ref), two offer keys in your browser's local storage on sporesec.com: sporesec_offers (your choice not to see offers, kept until you change it) and sporesec_promo_quiet_until (one timestamp: the end of a 7-day pause after you dismiss an offer), the portal sign-in and two-step cookies (named __Host-sporesec.<name>; the sign-in cookie ends when you close the browser, or lasts 30 days if you tick "Keep me signed in on this device for 30 days", and a 30-day trusted-device cookie is set only if you tick "Remember this device for 30 days" at the second step), sporesec_google_signup_pass (a 10-minute, HTTP-only proof that you accepted the terms, set only when you sign up with Google), portal-locale, portal-sidebar-side, portal-sidebar-rail and portal-nav-prefs (portal display preferences), the embedded Cal.com scheduler's cookies (only after functional consent), and the Cloudflare Turnstile bot check (operated under Cloudflare's Turnstile Privacy Addendum; it evaluates the browser without tracking you across sites). None of these are advertising cookies. Your browser's local and session storage on our sites also holds items that stay on your device until you send them or clear them: your cookie choice (sporesec_consent), your display currency (sporesec-configurator-currency), the quote you are building in the configurator (sporesec-configurator-build-<service>), your accessibility display options (sporesec-a11y-v2), recent searches (sp-search-recent) and unsent message drafts (sporesec.msgdraft.<thread>); for one tab only, the last scan result (sporesec-scan-report) and, with your analytics consent, a random visit id (sporesec_sid). If you tick "Keep me signed in", the portal also remembers on this device the email address and the sign-in method you used (sporesec-portal-returning); it is removed when you sign in once with the box unticked or clear your site data.
- **Analytics:** First-party and cookieless by default: aggregate page and event counts. Each event carries only a fixed label, such as the page area or the form type, and the coarse country of the request (from Cloudflare, never your address). In analytics and security logs your raw IP address is not stored; we keep only a keyed, non-reversible hash of it (still personal data, which is why we minimize and protect it). One record holds the IP address as received: portal sign-in sessions (removed when the session expires or when you delete your account). Contact-form and scan-report submissions keep only a keyed hash of it that changes every day (the record is anonymized after 180 days). Richer analytics run only if you opt in through the cookie banner (reopen it anytime via "Manage Cookies" in the footer) and include: the website you came from (its host name only, never the page address), UTM campaign tags, a random session id, and interaction signals such as repeated or dead clicks and abandoned forms. We do not use Google Analytics. Advertising attribution (a Meta/Facebook pixel) is wired but inactive, loads only under the separate marketing opt-in, and is disclosed here by name. We honor the Global Privacy Control (GPC) signal, keep everything non-essential off by default, and run no on-site ads or third-party ad tracking.
- **Client portal (app.sporesec.com):** available as a free self-serve account or as a client account when we work together; it stores your account details (name, email, phone, business name and address, language), projects and milestones, documents you receive, contract signatures (signer name, time, a hashed IP, and the document fingerprint, per the Electronic Signature Law), payment requests and receipts, messages with us, meetings with us, notification preferences, push-notification subscriptions you enable, referrals you make (including the referred person's email address), the record of your marketing choices, and a security access log (event type, hashed IP, browser). You can export your data as a file (account details, projects, documents, messages, payment records and activity), excluding credentials, security data and our internal handling notes, or request deletion from Settings. On deletion we erase your portal data and the CRM contact, and irreversibly anonymize your earlier lead and scan records on the marketing site (identifiers and the scanned address removed). Signed agreements and tax records are retained after deletion only as, and for as long as, the law requires; see section 7 for the exact categories and periods.

## 3. How We Use Your Information

- To respond to your inquiries and provide our services
- To arrange, confirm, remind you about and hold the calls you book on our own booking form (a confirmation when you book, and reminders 24 hours and 1 hour before the call: service messages you asked for, with no offers)
- To send the audit report you requested (transactional, sent once per request)
- To send security insights, service updates, and advertising emails, only if you opted in. Where you opt in while asking for an account, the choice is held as pending and counts only after you click the link in the sign-in email (double opt-in). Every advertising email is marked as advertising at the start of its subject and body (in Hebrew with the word פרסומת), names us as the sender with our address, and includes a working unsubscribe link, as required by Israel's spam law (Communications Law section 30A), the US CAN-SPAM Act, and the Australian Spam Act 2003
- To open and secure your account, to attach what you saved to it, and to keep proof of your agreement to the Terms of Service and this Privacy Policy (the sign-in email is a service message with no promotion in it)
- To keep our customer records: to perform our agreements, to keep our books as the law requires and to defend against legal claims
- To publish a testimonial on our website, only with your agreement: you write it, or you approve the words we wrote from what you told us (in your account, or by message). It shows under the name you choose (your full name, your first name and business, or no name). We change only spelling. You can withdraw it at any time, in your account or by writing to us, and we delete it; we also delete it when your account or customer record is erased
- To improve our website performance and user experience
- To comply with legal obligations

## 4. Data Sharing

We do not sell your personal data. We may share data with:
- **Cloudflare:** Hosting, edge network, bot protection (Turnstile), and secure storage of form submissions (Cloudflare D1, server-side only)
- **Brevo:** Transactional email (including booking confirmations, reminders and account sign-in links) and contact management
- **SUMIT:** the accounting and invoicing service in which we issue and keep our receipts, payment requests and credit notes (your name, the invoice details you gave us and the amounts); it processes them only to provide us that service
- **Google (Calendar and Meet):** When you book a call on our own booking form, we create an event in our own Google Calendar. The event holds your name, your email address, the call topic, your answers and note, and your phone number if you chose a phone call, and it can carry a Google Meet video link. Google stores and processes it under its own terms, including outside Israel. This step sends you no email from Google (our confirmation comes from Brevo), but the invitation may still show in your own Google Calendar if you use one. We use this data for nothing else.
- **Cal.com:** Meeting scheduling when you book a call through the embedded calendar (shown when our own booking form cannot show times, or while we work with Cal.com instead)
- **Google:** PageSpeed Insights processes the URL you scan to produce the lab performance results; Google Web Risk checks that URL against Google's lists of unsafe sites; if you choose to sign in with Google, Google authenticates you and shares your name and email address with us
- **Meta:** the WhatsApp Business Platform delivers your WhatsApp messages to us; the advertising pixel loads only after a separate marketing opt-in, for campaign attribution
- **Have I Been Pwned (Pwned Passwords):** when you set a portal password we check it against known breaches by sending only the first five characters of its hash, never the password

Each provider processes data only to deliver its service to us, under its own data-processing agreement or terms (for example Cloudflare's Customer DPA and Brevo's DPA). Some process data outside Israel; where they do, it is under contractual data-protection commitments consistent with Israeli law.

We may produce and share anonymized, aggregated statistics derived from the free security scans, for example how common a class of misconfiguration is across a sector or company-size band. These aggregates are stripped of anything that could identify you or your site: the scanned domain is removed, the figures are decoupled from any contact record, and a number is reported only for a group large enough that no single site can be singled out. We never publish a result, grade, or benchmark tied to an identifiable website, and we never sell or share identifiable lead or contact data. Because these statistics are truly anonymized, they fall outside the Privacy Protection Law; the de-identification method and the re-identification risk test we run before any release are documented in our internal anonymization standard. If you ask us to delete your data, it is excluded from any future aggregate.

We collect only what is needed to run the service, and we never sell your personal data.

## 5. Your Rights

Under Israel's Privacy Protection Law (as amended by Amendment 13) you have the right to:
- Access the personal data we hold about you
- Request correction or deletion of your data
- Change or cancel a call booked on our own booking form yourself at any time, with the link in your confirmation email
- Withdraw analytics or advertising consent at any time via "Manage Cookies" in the footer
- Withdraw consent for marketing communications at any time (every marketing email also carries an unsubscribe link)
- Export your portal data as a file from Settings
- Lodge a complaint with the Israeli Privacy Protection Authority

To make a request, email contact@sporesec.com or use our contact form and select "Privacy / data request". We honor the Global Privacy Control (GPC) browser signal automatically.

## 6. Data Security

We implement industry-standard security measures including encryption in transit (TLS), secure hosting infrastructure, and strict access controls. We build security in by default, and we hold our own systems to the same standard.

## 7. Data Retention

We keep personal data only as long as it is needed for the purpose it was collected, then delete or anonymize it. The main periods:
- **Booked calls:** for a call booked on our own booking form, your name, email, phone, answers and note are anonymized 180 days after the call, and the entry is deleted from our Google Calendar at the same time. A booking you cancel is removed from the calendar shortly after. Only the call type, time, status and language remain, with nothing that identifies you. A call booked through Cal.com's embedded calendar is kept by Cal.com under its own terms.
- **Contact and lead records:** while the enquiry is active plus a short follow-up window. On the website, the name, email and IP address are removed 180 days after the enquiry. In our own lead record (your name, email, phone, company, a short note from us on what you asked for, and a log of our emails, meetings and calls with you: the date and one line from us, never the message itself), these details are removed 180 days after our last contact with you, or 24 months after it if we held a call, sent you a proposal, or work with you as a partner, freelancer or supplier. If you become a client, they are held in your client record instead. If you ticked the box to receive marketing email, your address and the record of that consent stay on our mailing list until you unsubscribe; everything else about the enquiry is still removed after 180 days.
- **Free scan results saved with an enquiry:** identifiers are removed after 180 days, leaving only an anonymous score and grade; a scan in progress is deleted after one day. **Configurator drafts and saved proposals:** up to 90 days, then deleted.
- **Unfinished account requests:** a request to open an account that you never confirm by clicking the link, with its pending advertising choice, hashed IP address and browser type, is deleted after 14 days.
- **WhatsApp:** conversation transcripts up to 90 days; enquiries up to 180 days. An enquiry we follow up is also held in our lead record, under the rule in Contact and lead records above.
- **Analytics events:** up to 400 days (aggregate, with a hashed IP).
- **Cookie-consent records:** up to 400 days.
- **Application and error logs:** up to 30 days on the marketing site; up to 365 days in the client portal (debug entries 30 days).
- **Portal notifications:** up to 180 days once read (365 days otherwise); the activity feed up to 365 days; the security access log up to 730 days.
- **Free accounts with no activity:** a free self-serve account that has had no sign-in or other activity for 24 months, and holds no contract, invoice or project, is deleted (the Brevo contact and the live-chat record with it).
- **Customer records (people we billed who have no portal account):** the phone number and our note on how the work went are deleted 24 months after the newest document. The rest of the record (identity, receipts and other documents, agreements) is kept for the 7 years the law requires for accounting records, counted from the newest document, with an extra year of margin before our nightly job deletes it.
- **Marketing list:** until you unsubscribe.
- **Backups:** Cloudflare keeps a point-in-time history of our databases for the last 30 days, and a weekly copy is stored in a private bucket, up to the newest 12 weekly copies (about three months), then replaced. A record we delete from the live database can remain in a backup until that history ages out or that copy is replaced.

**What we keep after you ask us to delete your account.** When you delete your account we erase your profile, saved scans, messages, and marketing records, and confirm what was removed. The following is kept afterward, because the law requires it or entitles us to keep it, or because we need it to honor your refusal, and only this:
1. **Tax and accounting records.** We are legally required to keep our accounting documents (receipts, payment requests and their supporting documents) for at least 7 years from the end of the relevant tax year (Income Tax (Keeping of Books) Instructions). We cannot delete these before that period ends.
2. **Signed agreements and accepted proposals.** Where you electronically accepted or signed a proposal or agreement, we keep the signed document and its signature record (your name, email, the time of signing, and a technical fingerprint proving the document was not altered) for at least 7 years after you accepted or signed it, so either party can rely on or defend the agreement within the limitation period set by the Prescription Law, 5718-1958. A further safety margin of one year runs before our nightly job deletes it.
3. **The record of your agreement to the Terms of Service and this Privacy Policy** (the version and fingerprint of each document, the time, a hashed IP address and your browser type), for the life of your account and until 7 years after you delete it (the same one-year safety margin runs before our nightly job deletes it), because we bear the burden of proving your agreement. The email address stored with the request is erased.
4. **Your do-not-contact entry** (your address, or a hash of it, and the time of your refusal), so that we do not contact you again.
5. **The security access log**, until its 730-day window ends.
6. **An anonymized account record** with no name or email address, kept only while one of the records above is still kept, so that those records stay linked to something.

**If you never had an account.** If we hold a customer record about you and you ask us to erase it, we remove your name, business name, phone number and our note, and make your email address unusable in our records. We keep the receipts and other accounting documents for the period in item 1, without your contact details attached.

We keep only the records above, for at least the periods stated, and delete each one once its reason ends. If we retain anything after your deletion request, we tell you what and why. Marketing list subscribers can unsubscribe at any time.

## 8. Contact Us

For privacy-related inquiries or to exercise your rights:
- Controller: SporeSec (Mahdy Lorens Gribkov)
- Email: contact@sporesec.com
- Security issues: security@sporesec.com
- Location: Tel Aviv, Israel

## 9. Reporting a Security Issue

If you find a security problem in sporesec.com, app.sporesec.com or admin.sporesec.com, email security@sporesec.com. Tell us what you found, the page or request involved and the steps to reproduce it. We aim to reply within 5 business days and to tell you when it is fixed.

**Good-faith research.** We will not take legal action over research on our own systems that stays inside these limits:
- Test only your own account, or one we gave you, and stop as soon as you reach another person's data.
- Copy, change or delete nothing beyond the minimum that proves the problem.
- No denial of service, spam, social engineering or physical attacks.
- Do not test the providers we rely on (such as Cloudflare, Brevo or Google); their own programs apply.
- Give us a reasonable time to fix the problem before you publish it.

This is not a paid bug-bounty program, and it cannot authorize testing of anyone else's systems.

## Facts

- Last Updated: 17 October 2026 (source: https://sporesec.com/en/privacy; as of 2026-10-10)

---

- Contact: contact@sporesec.com | WhatsApp https://wa.me/972532322318 | https://sporesec.com/en/contact.md
- Book a free intro call: https://sporesec.com/en/book.md
- Machine-readable site data: https://sporesec.com/llms.txt | https://sporesec.com/agents/en/index.json