Privacy Policy

Last updated: September 15, 2026

1. Data Controller

Olivier Bellity — Lebanim
Israeli sole trader (עוסק פטור) — registration no. 341111854
64 rehov Hapisga, 9638227 Jerusalem, Israel
Contact: contact@lebanim.com

2. Legal Framework

This Privacy Policy complies with:

• The Israeli Protection of Privacy Law, 5741-1981 (including Amendment No. 13)
• The Israeli Protection of Privacy Regulations (Data Security), 5777-2017
• The Israeli Protection of Privacy Regulations (Transfer of Data Outside State Borders), 5761-2001
• The European General Data Protection Regulation (GDPR) — applicable to users residing in the European Union

Where these frameworks conflict, the provisions most protective of the user apply.

3. Data Collected

3.1 Identification data

Email address, first and last name, encrypted password (not recoverable).

Your phone or WhatsApp number, if you request remote assistance. It is required for that request, and for nothing else: we use it to call you back and to check that you are indeed in front of your screen before we look at it. It is never used for marketing.

3.2 Optional profile data

Hebrew name, tradition (Ashkenazi, Sephardi, mixed, undetermined), family geographic origin, preferred form of address, your age, the town and country where you live, whether you are a man or a woman when you tell us (this chooses the voice that reads text aloud, and the way we address you), and who you are writing for (your children, your grandchildren, yourself).

3.3 Content you produce

Answers to the biographical questionnaire, photographs, family tree data. Family member data concerns third parties who have not directly consented — enter only what you consider appropriate to share.

What you dictate into the microphone, if you use the dictation button instead of the keyboard. Your voice is turned into text, and that text becomes your answer. That transformation is not performed by us: see §6.8.

The dictation corrections you save: the words the microphone gets wrong, and how they should be spelled. These are pairs of words, not your story.

3.4 Technical data

IP address (request limiting and abuse prevention) and anonymous browsing data via Vercel Web Analytics (no cookie, no individual tracking).

And, on the public pages of the site, if you clicked “Accept” in the banner at the bottom: browsing data via Google Analytics, which places files of its own in your browser (_ga, _gid). If you click “Refuse”, it is not loaded at all. The pages where you write your story — the questionnaire, “My account”, the chapter editor — never load it. See §6.12.

The display language you choose (FR, EN or עברית), kept in a small file in your browser called googtrans — see §6.9 and §7.

3.5 If you give Lebanim to someone

When you buy a gift voucher, we record your name and email address, together with the name and email address of the person you are giving it to, and the message you write for them. That is what lets us send them the invitation, and find the voucher again if you call us.

That person’s address is the personal data of a third party, who is not yet a customer of the Service. We use it only to pass your gift on to them: it is neither sold nor used to send them advertising. If you are that person and wish to know what we hold, or to have it deleted, write to contact@lebanim.com — the rights in §9 are open to you as to any user.

4. Purposes and Legal Bases

• Providing the Service (account, stories, PDF): performance of contract
• AI assistance (transmitting content to Anthropic): performance of contract
• Security (abuse prevention, IP limiting): legitimate interest
• Audience measurement (Vercel Analytics): legitimate interest; and, with your consent (Art. 6(1)(a) GDPR), via Google Analytics on the public pages of the site (§6.12)
• Payment (§6.14) — passing our payment provider what it needs to collect your purchase: performance of contract, and compliance with our accounting obligations
• Responding to messages, and carrying our emails through our email provider (§6.11): performance of contract / legitimate interest
• Voice dictation (§6.8) — turning your voice into text when you press the microphone button: performance of contract, on your own action
• Page translation (§6.9) — displaying the site in the language you choose, so that it can be read in English and Hebrew: legitimate interest

5. Data Storage and Hosting

Data stored securely with Supabase Inc., Frankfurt, Germany, EU (region eu-central-1).

Local cache (localStorage) used in browser for responsiveness — complementary only.

6. Data Transfers to Third Parties

6.1 AI provider

Lebanim assistant features transmit texts to:

• Anthropic PBC (United States) — Claude service. Texts processed temporarily (generally 7 days) then deleted. Not used to train AI models. Policy: www.anthropic.com/legal/privacy

Transfer governed by contractual safeguards and Israeli Transfer Regulations 5761-2001.

Anthropic is our only provider for writing and translating your stories. But Google is involved on several precise points, and we must say so: if you use the microphone button to dictate your answer instead of typing it, your voice is sent to Google to be turned into text (§6.8); the site also calls on Google to translate its pages (§6.9), for the shape of the letters on your screen (§6.13), and — only if you accept it — to measure its audience (§6.12). This page previously stated that no other provider was used: that was inaccurate. Each section named here says how to avoid it, where avoiding it is possible.

6.2 Hosting

Vercel Inc. — Europe region (Frankfurt, Germany).

6.3 User database

Supabase Inc. — Frankfurt, Germany, EU. Policy: supabase.com/privacy

6.4 Administrator access

Limited authorized persons may access profiles for administration and technical support only.

6.5 No sale of your data

Your personal data and your life stories are never sold or rented to any third party.

Meta receives data in two different ways, and they must be told apart:

• The Meta Pixel, an advertising measurement tool, shares browsing data with Meta for advertising measurement and targeting purposes. It is activated only with your consent (see §6.6 and §7) and you may refuse it at any time.
• WhatsApp, which also belongs to Meta, carries your assistance link if you choose the “Send to Lebanim (WhatsApp)” button. This is not advertising, and it does not depend on the cookie banner: it is a message you send yourself. But Meta sees it pass through. The details are in §6.10, together with how to avoid it.

6.6 Advertising tool (Meta Pixel)

Subject to your consent (collected via the cookie banner), the Service uses the Meta Pixel, provided by Meta Platforms Ireland Ltd (4 Grand Canal Square, Dublin, Ireland). This tool measures the effectiveness of our advertising campaigns and enables the delivery of advertisements on Facebook and Instagram. It collects browsing data (pages viewed, interactions) associated with an advertising identifier. This processing involves a transfer of data to Meta, which may include the United States, governed by the European Commission's standard contractual clauses. Policy: facebook.com/privacy/policy. You may withdraw your consent at any time (see §7).

6.7 Remote assistance session

When you open an assistance session and send the invitation link to the Helper, the content of the page in front of you — including the story you are writing — is streamed live to that person for the duration of the session. You decide whether to open the session, when, and — for screen control — whether to allow it.

You may designate a relative as your Helper yourself, from “My account”, the “Assistance” tab, under “Who can help you”: you give their email address, and at most five people may be designated at the same time. That designation does not take effect on its own. It stays pending until the Lebanim team approves it, and while it is pending that person cannot join any session, even holding the invitation link. We do not judge your choice: this approval exists for one reason only, to stop a forwarded or copied link from being enough to open your screen to any holder of a Lebanim account. A member of the Lebanim team, on the other hand, may join without that step, because we are the ones you call when you ask for help.

You may withdraw an authorisation at any time, from the same screen. The withdrawal takes effect immediately: if it concerns a session in progress, that session ends. Requests and decisions are logged; how long they are kept is set out in §8.

• The page content is captured in your browser by the open-source library rrweb, which we host ourselves: the capture itself involves no third party (if our own file is blocked, a public repository serves as a fallback to load it).
• The page the Helper looks at loads Google’s translation widget, like the rest of the site: the Helper sometimes reads in Hebrew. But the area where your screen is replayed is excluded from it. It carries a technical instruction asking Google not to translate it, set in both of the forms that widget recognises. What remains translatable on that page are the Helper’s buttons and messages — not your story. One honest reservation: this is an instruction addressed to Google’s program, not a barrier we hold ourselves. A second safeguard is in place: the address of that page contains the token that opens your screen, and the Service asks the browser never to pass that address on to any third-party site — not to Google, not to anyone. See §6.9.
• It is relayed to the Helper's browser by Supabase Inc.'s realtime service, on the Frankfurt (Germany) servers already named in §6.3. This content is not recorded: it passes through, it is displayed, it is gone. There is no video recording, no session archive, no capture kept by us.
• The Helper must have an account (email address and password) to join. That account is handled like any user account (§3).
• The "My account" page cannot be streamed: opening it ends the session.

Your assistance requests and appointments

When you ask for help — right away or at an agreed time — we record the time requested, your phone number as it was on that day, and the state of the request. This is what lets the team keep a diary rather than a conversation thread, and lets you find your appointments again under “My account”.

The number is kept as it was when you made the request: if you change it later, the team must still be able to reach you on the number you gave that day.

We do not tick a box to record whether an appointment took place: the Service infers it from the existence of an assistance session at the expected time. No judgement is recorded, and nothing is added to your file.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Retention period: see §8.

The email address of the person you designate as Helper

If you designate someone close to you as your Helper, you give us their email address. We store it for one reason: to keep the list of people you have designated, and to check — when one of them joins a session — that they are indeed the person you chose. We do not review it and we do not approve it: the choice is entirely yours.

This is the personal data of a third party, who is not necessarily a customer of the Service. We make no other use of it: it serves only to identify whom you designated and to decide on the request. It is neither shared nor used for marketing.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in operating a feature you asked for, and in being able to answer later the question "who was allowed to watch my screen, and when?". If you are that person and wish to know what we hold, or to have it deleted, write to contact@lebanim.com — the rights in §9 are open to you as to any user.

Retention period: see §8.

What IS kept is an audit log: for each session, the date, its duration, both account identities, and the list of actions performed — a click, a keystroke, a scroll, with the technical name of the element targeted (for example textarea#ta_q_3_1). Neither the text typed nor the content of your story appears in that log. It exists for one reason: to let you know what the Helper did on your account. You may request a copy at any time (§9). Its retention period is in §8.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR) for the streaming itself, which you initiate, and legitimate interest (Art. 6(1)(f)) for the audit log, whose purpose is the protection of both people involved.

6.8 Voice dictation (Google)

In the questionnaire, a microphone button lets you dictate your answer instead of typing it. Here is what happens if you press it.

Your browser listens, then sends what you say to Google’s servers, which turn it into text. The text then comes back into the page. This is the speech recognition built into the browser: on Chrome, it goes through Google. We do not choose that recipient, and your voice does not pass through our servers: the browser talks to Google directly.

What is sent: the sound of your voice, while the microphone is on. What is not sent: the rest of your story, your name, your address, your account. The purpose is the only one you asked for: to write down what you say. The resulting text is then saved like any other answer (§5).

To avoid this, type on the keyboard. The microphone never switches on by itself: it switches on when you press the button, and off when you press it again. No answer in the questionnaire requires dictation.

Google’s policy: policies.google.com/privacy

6.9 Automatic page translation (Google Translate)

The Service is written in French. So that it can be read in English and Hebrew, every page loads Google’s translation widget (Google Translate): that is what makes the “FR / EN / עברית” selector at the top of the screen work.

What that means, said plainly:

• A small file is placed in your browser to remember the language you chose. It is called googtrans, it contains only that language (for example /fr/en), and it serves no advertising purpose.
• The translation program is loaded from Google’s servers. Google therefore sees that a page of our site is open, with the usual technical information (IP address, browser type).
• When translation is active, the texts displayed on the page are sent to Google to be translated. If you leave the site in French, there is nothing to translate and nothing is sent to be translated.
• This widget is not subject to the consent banner: it is loaded for everyone, because without it the language selector does not work. We write it here rather than pass over it in silence.

The case of the remote assistance page — the one where your screen is replayed (§6.7). It carries the same language selector, because the Helper sometimes reads in Hebrew. The area where your screen is replayed is marked “do not translate”: your story is therefore not sent to the translator along with the rest of the page. And the address of that page contains the token that opens your screen: the Service asks the browser never to pass it on to any third-party site. So the token does not travel with the translation.

Where your story is shielded from translation. The areas where you write, and those that display your story, carry the “do not translate” instruction: the questionnaire’s answer field, the transcription of your dictation, your exchanges with the assistant, the preview of your book, the editor’s passages — including those built on screen while you work — as well as your name and your relatives’ details in “My account”. Google’s widget does not read them.

We do not claim the coverage is complete. The Service has dozens of screens, and we are marking these areas one by one. Some secondary places — a chapter title you named yourself, a reminder shown in a banner, the filename of a photograph — may still be sent to Google if you switch the page to English or Hebrew. We are closing them as we go. If you would rather no text left at all, keep the Service in French: with no language change, the widget sends nothing.

To avoid this: leave the selector on “FR”. Nothing is then sent to be translated, and the googtrans file is erased (§7).

Google’s policy: policies.google.com/privacy

6.10 The assistance link sent over WhatsApp (Meta)

When you open an assistance session, the Service creates an invitation link. That link is the key: whoever opens it sees your screen.

Several buttons are offered to pass it on. One of them, “Send to Lebanim (WhatsApp)”, opens WhatsApp with a message already written that contains this link. The message then travels over WhatsApp, a service of Meta Platforms Ireland Ltd, and therefore passes through Meta’s servers, like any WhatsApp message.

Here Meta is a carrier, not an advertiser: this path has nothing to do with the Meta Pixel of §6.6, and it does not depend on the cookie banner, since you are the one sending the message.

To avoid it, use the “Copy the link” button. It sets the link aside on your device; you then paste it wherever you wish — a text message, an email — or you read it out on the phone. The link is also written out in full in a field, which you can select by hand. On a phone, a “Share” button opens your device’s own menu, where WhatsApp is only one choice among others.

WhatsApp’s policy: whatsapp.com/legal/privacy-policy-eea

6.11 Carrying our emails (Zoho)

Our emails do not come from nowhere: they are carried by Zoho Corporation, the email provider for the @lebanim.com addresses. This covers gift voucher emails — the one the buyer receives and the one received by the person the gift is for, carrying the message written for them (§3.5) —, the confirmation of your payment, the questions sent by email, and the internal messages described below.

The most important case to know about is the assistance request. When your assistance credit is used up and you click “Request assistance”, an email is sent to our contact@lebanim.com mailbox. That email contains: your name, your email address, your phone number, your plan, the credit you have left, the date of the request, your account identifier, and the message you wrote if there is one. Your email address also appears in the subject line, so that the team can find you without opening the message.

The content of your stories does not appear in it. The purpose is to let the team call you back and add time by hand. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

Like any email service, Zoho sees these messages pass through and keeps them in our mailbox for as long as we do not delete them. The servers involved are those of the international zoho.com domain, which may involve a transfer outside the European Union, governed by the European Commission’s standard contractual clauses. Policy: zoho.com/privacy.html

To avoid having this information gathered automatically, nothing obliges you to use that button: a phone call or a WhatsApp message to the team achieves the same result. An email you write to us yourself, however, will also go through Zoho, since that is our letterbox.

6.12 Audience measurement (Google Analytics)

On the public pages of the site — the home page, the plans, the FAQ, the blog, and this page — a banner appears at the bottom of the screen the first time you come. If you click “Accept”, the Service loads Google Analytics, Google’s audience measurement tool. It places files in your browser (named _ga and _gid) and sends Google the pages you open, your IP address and the type of your device.

If you click “Refuse”, none of this is loaded — neither Google Analytics nor the Meta Pixel of §6.6. Your choice is kept in your browser; to change it, clear the site’s data.

The pages where you write your story never load this tool: not the questionnaire, not “My account”, not the chapter editor. Google Analytics therefore sees nothing of your story. The legal basis is your consent (Art. 6(1)(a) GDPR). Google’s policy: policies.google.com/privacy

6.13 The shape of the letters on your screen, and the technical libraries

Four servers that are not ours are called upon to download technical files — the shape of the letters, and open-source programs we do not rewrite ourselves. None of them receives any content, but each of them sees a request go by, and all of them must be named. The Service’s other third parties are not here: translation is in §6.9, audience measurement in §6.12, advertising in §6.6.

• The typefaces — the shape of the letters you read — are downloaded from Google’s servers (the Google Fonts service), on almost every page.
• The program that connects the page to your account is downloaded from jsDelivr, a public repository of open-source libraries, on every page that talks to your account: signing in, resetting your password, “My account”, the questionnaire, the chapter editor, payment, redeeming a gift voucher, and the Helper’s page. On that last one, jsDelivr also provides the stylesheet for the module that replays your screen.
• The program that produces your gift voucher is downloaded from Cloudflare (the cdnjs service), on the two gift pages — the one where you buy the voucher and the one where you collect it. The voucher itself is produced inside your browser.
• The program that lays your book out into pages is downloaded from unpkg, another public repository of open-source libraries, in the book window. See the paragraph below: it is the only one of these downloads that happens in a window holding your story.

A fifth server, cdn.rrweb.com, is called only if ours fails, and only during an assistance session (§6.7).

What is sent: what any server sees when it is asked for a file — your IP address, the type of your browser, and the address of the site making the request, reduced to https://lebanim.com by an instruction we set on all our pages. What is not sent: your story, your name, your photographs, the contents of your account. None of these services receives any content.

The case of the book window, because it deserves to be spelled out. When you ask for your book, it is produced entirely inside your browser and opens in a window that is not a page of our site: it exists only on your computer, and it holds your complete story. To lay it out into numbered pages, that window downloads a program from unpkg. What unpkg receives: a request for a file — that is, your IP address, the type of your browser, and the address https://lebanim.com. What unpkg does not receive: your story, a single line of your story, the title of your book, your name, your photographs. The text is sent nowhere: the program comes to it, not the other way round. The typefaces for that book are in fact embedded in the file — the book window calls no server other than that one.

One honest reservation: a downloaded program file runs in the window it arrives in, and therefore technically has access to what that window holds. We do not run these servers. This is true of any site that loads a public library; we would rather write it than leave it unsaid.

These downloads are not subject to the consent banner: without them the page does not display correctly or does not work. Google’s policy: policies.google.com/privacy — jsDelivr’s policy: jsdelivr.com/terms/privacy-policy-jsdelivr-net — Cloudflare’s policy: cloudflare.com/privacypolicy — unpkg: unpkg.com

6.14 Payment (Allpay)

When you buy a plan, a printed book or a gift voucher, the payment is not collected by us: it is handled by Allpay, our payment provider. You are taken to its page to enter your card there.

What we pass to it: your email address, your first name, the order number, the amount, the currency, and the description of what you are buying. What we never see: your card number. It is entered at Allpay, and it does not pass through our servers.

Your first name is not passed on for its own sake. It is written into the address of the thank-you page Allpay returns you to once the payment is accepted, so that the page can greet you by name — and Allpay therefore receives that address along with the rest of the order. When you buy a gift voucher, no first name is passed: it is your email address that appears in the return address.

In return, Allpay confirms to us that the order is paid, and we keep that confirmation with the order. The content of your stories is never passed to it. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and, for keeping accounting records, compliance with our legal obligations (Art. 6(1)(c)). Allpay’s policy: allpay.to

7. Cookies and Trackers

• Essential (always active): session, security, cookie consent preference
• Preferences: localStorage — stores your content and preferences
• Analytics: Vercel Web Analytics — privacy-friendly, no cookie, no individual data
• Language: the googtrans cookie — placed when you choose English or Hebrew in the language selector. It remembers only that language (for example /fr/en) and lets Google’s automatic translation apply to every page. It is not subject to the consent banner: without it, the language selector does not work. It serves no advertising purpose and tracks no one. The translation widget itself is provided by Google and may place files of its own (see §6.9). To remove it: switch back to French in the selector — the file is then erased — or clear the site’s cookies in your browser.
• Audience measurement: Google Analytics (Google) — the _ga and _gid measurement files, placed on the public pages of the site only after you accept via the banner. Legal basis: your consent (Art. 6(1)(a) GDPR). They are never placed on the pages where you write your story. See §6.12.
• Marketing: Meta Pixel (Meta Platforms Ireland Ltd) — the _fbp advertising cookie and associated trackers, used to measure the effectiveness of our campaigns and to deliver advertisements on Meta's platforms (Facebook, Instagram). Legal basis: your consent (Art. 6(1)(a) GDPR). This tracker is set only after you accept via the consent banner, and involves a transfer of data to Meta (see §6.6). You may withdraw your consent at any time. The Service offers no cookie settings screen: your choice is kept in your browser, and to change it you must clear the site’s data in your browser settings — the banner then reappears on your next visit, and you can answer differently. You may also object via the advertising settings of your Meta account.

Advertising cookies are placed only after your consent via our cookie banner. The googtrans language file is not subject to it, and Google’s translation widget is loaded on every page: we write this because this page previously stated that the Service used “no other third-party cookie” for commercial purposes, which gave the impression that no third party was called at all. Apart from the cases listed above, the Service uses no tracking cookie, and no cookie is used to sell or rent your data.

8. Data Retention

• Active account: for as long as you use the Service
• Deleted account: permanent deletion within 30 days. No restoration possible. One thing survives: the accounting records of your payments, below.
• Orders and payments: the order number, amount, currency, date and the confirmation sent by Allpay (§6.14) are kept as accounting records for seven (7) years from the close of the financial year concerned, then deleted. They are not erased with the account: the Israeli accounting rules applicable to the publisher require us to keep them, and that obligation overrides the right to erasure (Art. 17(3)(b) GDPR). These records contain no part of your stories — only the fact that a payment took place, for what amount and on what date.
• Analytics: aggregate and anonymous only
• Technical logs: a few weeks
• Emails received in our mailbox (including the assistance request of §6.11): kept in our Zoho mailbox for as long as they are useful to follow up your request, and deleted at your simple request
• The googtrans language file: kept for one year in your browser, or until you switch back to French or clear the site’s cookies
• Google Analytics files (_ga, _gid): placed only if you clicked “Accept”, they stay in your browser until they expire or until you clear the site’s data. How long Google keeps the measurements is a matter for Google (§6.12).
• Assistance requests and appointments: kept twelve (12) months after the date of the appointment, then deleted automatically. Deleted immediately if the account is deleted.
• Helper requests (a third party's email address): a refused request, a withdrawn approval, or a request left undecided, is kept twelve (12) months after the decision — or after the request, if no decision was taken, then deleted automatically — the same period as the log, and for the same reason: to be able to answer "who was allowed to watch my screen, and when?". An approval in force is kept while it is in force. Everything is deleted immediately if the account is deleted.
• Record of assistance time granted: when the team adds or removes time from your plan — extra minutes, a bonus, an adjustment after a missed appointment — the trace of that action (who did it, for which account, how long, when) is kept for seven (7) years, like the accounting records above and for the same reason: it is the counterpart of a paid service. It contains neither your stories nor the content of any session. It is distinct from the session log, which is deleted after twelve months.
• Remote assistance session log: kept twelve (12) months from the end of the session, then deleted automatically. That period matches the length of a plan: it lets you find out what happened during the assistance, and no longer. The log is deleted immediately if the account is deleted.

9. Your Rights

Under the GDPR and Israeli Protection of Privacy Law 5741-1981:

• Right of access
• Right of rectification
• Right to erasure (directly from your account — immediate and irreversible)
• Right to restriction
• Right to portability (JSON export from your account)
• Right to object
• Right to withdraw consent
• Right to lodge a complaint:
  • France: CNIL — www.cnil.fr
  • Israel: Privacy Protection Authority — www.gov.il/en/departments/the_privacy_protection_authority

Contact: contact@lebanim.com — response within 30 days.

10. Security

Measures in accordance with Israeli Data Security Regulations 5777-2017:

• Password encryption (PBKDF2)
• HTTPS
• IP-based request limiting
• Restricted administration access

11. Minors

Service accessible to users aged 15+. Under-16s in the EU require parental consent. Purchasing reserved for users aged 18+.

12. Policy Changes

Substantial changes communicated by notice on the Service or by email.

13. Contact

Olivier Bellity — Lebanim
Email: contact@lebanim.com

Voir la version française →