Privacy Policy

1 General and the Party Responsible for the Information

1. The party responsible for processing personal information and the database controller is the operator of the Service (Walz). This policy applies to everyone who makes use of the Service: visitors without an account, senders of inquiries, registered customers, property owners, agencies and brokers, developers and system administrators.
2. We minimise the information collected to what is necessary for the purposes set out in this policy, and encrypt sensitive contact details at rest.
3. Providing information is done at the User's own will; there is no legal obligation to provide information, but without certain details we will not be able to provide part of the services (see Section 3).

2 What Information We Collect

Information you provide to us

1. Account details: a mobile phone number (the sign-in identifier, verified by OTP via WhatsApp), name, email address, and, at your choice — a secondary contact, a profile picture and a cover image.
2. Business profile (searching customers): field of activity, number of employees, years in business, transaction type, budget, area sought, move-in date and preferred areas — collected in the registration questionnaire and used to match properties (processing for content personalisation).
3. Inquiries (leads): name, phone number and the content of the inquiry sent via "leave your details" forms — even without an account.
4. Advertiser content: listing details — address, property characteristics, price, photos and floor plans; for agencies — the agency's name and brokerage licence number.
5. Communications: in-system chat messages, support inquiries, and declarations and consents you have ticked.
6. Billing: purchase details and transaction history. Full payment-method details are processed by an external payment processor (Cardcom) and are not stored by us.

Information collected automatically

1. Technical identifiers: IP address, browser and device type, and a visitor identifier — data classified as personal information under Amendment No. 13.
2. Usage data: pages and listings viewed, searches, referral source (referrer/UTM) and usage events — for security, measurement and improvement purposes.

Information from external sources

1. Registrar of Real Estate Brokers: for licence verification purposes we synchronise with the public database of the Registrar of Real Estate Brokers (data.gov.il) and retain the name, licence number and status. The source is public and the purpose is protection of the platform's users.

3 Purposes of Use and the Duty to Provide Information

1. Operating the Service, creating an account and secure sign-in verification.
2. Displaying listings, matching properties to the business profile and forwarding inquiries to Advertisers.
3. Processing purchases, issuing receipts and recording charges.
4. Improving the Service, securing it, preventing fraud and misuse, and enforcing these Terms.
5. Support, responding to inquiries and sending operational messages.
6. Marketing communications — only with separate consent as set out in Section 7.
7. Notice under Section 11 of the Law: you are not legally required to provide information. Providing a name and phone number in an inquiry form is required in order to forward the inquiry to the Advertiser; account details are required to create an account; the profile questionnaire is used to match properties. Without providing them we will not be able to provide the requested service.

4 Forwarding Inquiries (Leads) to Advertisers

1. When an inquiry regarding a property is sent, the name, phone number and content of the inquiry are forwarded to the property's Advertiser — the property owner, the handling agency (and the broker to whom the inquiry was routed) or the developer — so that they may respond to you regarding that property only. Forwarding takes place only after the consent box on the form has been ticked.
2. The Advertiser is obligated to us to use the details solely to respond to your inquiry. Use of inquirers' details for marketing communications requires your separate consent given to that Advertiser, and responsibility for this rests with the Advertiser alone.
3. Routing an inquiry to an agent within an agency is an operational action; professional responsibility remains with the agency.

5 Sharing with Third Parties and Sub-Processors

1. We do not sell personal information. We use service providers (controllers/processors) to operate the Service, under agreements that include confidentiality, security and legal-compliance undertakings. Our principal sub-processors:
   • Meta / WhatsApp — sending verification codes and service messages via WhatsApp.
   • Cloudflare — content delivery network (CDN), security and media storage.
   • Fornex — hosting of our servers, database and encrypted backups (VPS and S3 storage).
   • Sentry — monitoring of technical faults, with minimisation of personal information.
   • PostHog — usage analytics, subject to consent given in the cookie banner. This includes anonymised screen recordings and heatmaps; input fields and personal details are masked in the browser, and private areas (account, admin) are never recorded.
   • MapTiler / OpenStreetMap — displaying maps; TomTom — live traffic layer and travel-time estimates over the property map.
   • Email providers (SMTP) — service messages and confirmations.
   • AI providers — text content — Perplexity and DeepSeek (a Chinese company; part of the processing takes place in China) for drafting property descriptions, articles, comparisons and the Walz AI chat. In these features account details (name, phone number, email) are not transmitted; a phone number or email appearing inside a chat message is masked before it is sent.
   • Voice assistant and dictation — the voice itself is processed by Soniox (speech recognition and response synthesis); the conversation transcript — including anything said aloud, such as a name or phone number if spoken — is sent to DeepSeek (a Chinese company) to run the conversation.
   • Google (Places API) — the address the user types, for address autocomplete suggestions.
   • YouTube (Google) — the viewer's IP address and device data, only after clicking "watch" on a podcast episode.
   • Cardcom — external payment processor; full payment card details are entered on its own form and are not stored by us.
   • "Moving help" service providers — when you choose to contact a specific provider from the catalog and confirm it, your name, phone number and request are sent to that provider only, so they can reach you.
   • data.gov.il — synchronisation of the Registrar of Real Estate Brokers.
2. We will also disclose information where required by law, by a court order, or in order to protect our rights and the security of users, and within a merger, sale or transfer of business — subject to preserving the principles of this policy.

6 Transfer of Information Outside Israel

1. Some of our sub-processors are located, or store information, outside Israel (among other places in the European Union, Switzerland, the United States and China).
2. Transfer of information outside the State's borders is carried out in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Outside the State's Borders), 5761-2001, and subject to the recipient's undertaking to comply with the conditions applicable to the information under Israeli law, with the necessary changes.
3. Even after the transfer, we remain responsible for the information and act to safeguard it in accordance with this policy and with law.

7 Marketing Communications (Separate Consent)

1. Sending an "advertisement" by email, SMS or WhatsApp is done only with your prior express consent, in accordance with Section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982.
2. Consent is collected via separate tick boxes — for each channel independently — and is not a condition for using the Service.
3. Every marketing message will be marked "Advertisement", will include our details, and will offer an immediate, free-of-charge means of unsubscribing. You may update or withdraw consents at any time from the settings area or by contacting us.
4. Operational messages (a verification code, an action confirmation, an update regarding an inquiry) do not constitute marketing communications and do not require separate consent.

8 Cookies and Tracking Technologies

1. A full breakdown of the types of cookies, their purposes and consent management is set out in the Cookie Policy.
2. Essential cookies operate to enable the site to function and do not require consent; measurement and marketing cookies are activated only after consent (opt-in) in the banner.
3. You may withdraw consent and manage preferences at any time via the banner or your browser settings.

9 Data Security and Recording of Consents

1. Encryption at rest: sensitive contact details (phone number, email, content of inquiries) are stored encrypted (envelope encryption, AES-256-GCM).
2. Encryption in transit: all traffic is protected by TLS (HTTPS).
3. Access control: role-based permissions; administrative access is recorded in an audit log.
4. Recording of consents: every confirmation of the Terms, privacy consent, marketing consent and content-rights declaration is recorded in a dedicated log (date, version, source) as required to prove consent.
5. Monitoring, backups and procedures: in accordance with the data-security regulations; a serious security incident will be reported as required by law.
6. No security method is entirely immune, and we cannot guarantee absolute protection against every threat.

10 Data Retention Period

1. Account details and content: for as long as the account is active, and after its closure — for the period required for the purposes for which it was collected or as required by law.
2. Analytics data: viewing events are retained at identifier level for up to 180 days, and thereafter in aggregate form only.
3. Billing records: in accordance with tax and bookkeeping law (up to 7 years).
4. Consent log and audit records: for as long as required to demonstrate legal compliance.
5. Walz AI chat and reminders: conversation history with the Walz AI chat, reminders and the associated impression events are retained for up to 90 days from the last inquiry or event, and are thereafter deleted or retained in aggregate form only.

11 Your Rights

1. Access: to receive a copy of the information we hold about you (a full export is also available from the settings area).
2. Rectification: to request correction of information that is incorrect, inaccurate or out of date.
3. Account closure and erasure: to request closure of your account (archiving, a reversible action for a limited period) or permanent, irreversible erasure of your personal information, subject to exceptions under law (for example, billing records). Closing an account is not equivalent to immediate deletion of all data. A request is available from the settings area and will be handled within the period prescribed by law.
4. Withdrawal of consent: to withdraw marketing consent or other consents at any time, at no cost.
5. To exercise a right: [email protected]. If your request was not properly addressed, you may contact the Privacy Protection Authority.

12 Minors

1. The Service is intended for adults (18+) and for business entities. We do not knowingly collect information from minors.
2. If you become aware that information about a minor has been provided, please contact us and we will act to delete it.

13 Changes to This Policy

1. We will update this policy from time to time; the updated version will be published on this page with an update date.
2. For a material change — including the addition of a purpose of use or a material provider — we will give notice on the site or by direct notice, and in cases requiring it we will seek renewed consent.