Privacy Policy

1. Operator and scope

This policy describes personal data processing in Laasot Tov (לעשות טוב), its mobile and web applications and laasottov.co.il during the closed, free beta test. Participation is limited to operator-approved users from Israel aged 18 or over. Use while temporarily travelling abroad does not itself change the intended scope of the service.

The operator is Andrei Brandaus / אנדריי ברנדאוס, an Israeli sole proprietor (עוסק מורשה), registration number 346960891, trading as ND Evolution. The operator determines the purposes and means of processing account and service-operation data. Contractors decide which client and team data to enter and whom to share it with for work; this does not remove the operator’s own obligations.

Contact: everptech.il@gmail.com; +972 53-2757376. Postal address: 8 Shalom HaGalil Street, Apartment 9, Nahariya 2227068, Israel. Clients and other people whose data users enter may also contact us without having an account.

2. Providing information

Registration information is provided voluntarily; there is no legal obligation to register. A name and phone number are necessary to create an account and operate the service; registration is unavailable without them. Email and business name are optional. The phone number is verified by an SMS code on first sign-in.

Information comes from the user, the contractor inviting them or assigning work, and automatically through operation of the application. Entering an end client’s contact details in an order does not create an account for that client. Do not enter excessive information, payment card details, medical information or other sensitive information unnecessary for the work.

3. Account and work data

Data includes names, phone numbers and other supplied contacts; roles, specialisations, employer relationships, invitations and assignments. Projects, work orders and checkpoints may contain client contacts, site addresses and access codes, work descriptions and schedules, statuses, budgets, payment terms, time and materials, issues, responses and execution history.

We also process directories, photographs, documents and other uploaded files, completion evidence, subcontract transfer details and support requests. Monetary amounts support work organisation and record-keeping; the service does not receive payments or request payment card details.

4. Device permissions and messages

The camera is used with user permission to describe work and confirm completion. Users may select existing photographs or documents. Device geolocation and the microphone are not used.

Contact selection for team invitations is planned for the beta. When available, permission is requested separately and is optional: only selected contacts are transferred, not the entire address book. An invitation does not bypass operator approval of each new participant.

Push notifications contain order-status updates without client names, addresses, work times or descriptions. Delivery uses technical device or browser identifiers and subscriptions. Notifications can be disabled in device or browser settings. The WhatsApp feature opens the user’s WhatsApp; the user chooses and sends the message themselves. Once sent, processing is also subject to WhatsApp’s rules and the recipient’s actions.

5. Installation statistics and diagnostics

For signed-in mobile users, our own system records a random installation identifier, platform and OS version, app version and build number, technical update information, and first and last report times. The record is linked to the account. The first report is not necessarily the installation date. Sign-out sends an unlinking request, which may be delayed without connectivity. Only the latest installation state is retained, not the history of all reports. Device model and IP address are not stored in installation statistics.

Application and web-server logs may contain technical request data, errors and the client IP address. Sentry receives error descriptions, stack traces, event times, app versions, software-environment details and diagnostic entries. Session recording, server local-variable values and automatic addition of personal data are disabled; standard sensitive-data scrubbing and Sentry’s IP-storage prevention are enabled. However, internal user IDs and some form data may enter diagnostics: complete filtering of all messages and logs has not been implemented.

6. Processing purposes

Purposes include registration and access verification; organising projects, orders and teams; sharing information among authorised participants; service notifications; support, data requests and feedback; diagnostics, security, abuse prevention, backups and service improvement during testing; and compliance with applicable law.

The beta does not use promotional mailings, advertising profiling or third-party marketing analytics. Personal data is not sold. Technical diagnostics and internal installation statistics are used to operate and improve the service.

7. Access and disclosure

Contractors and their dispatchers access their organisation’s work information within their permissions. Specialists receive information necessary for their assigned published orders, including contacts and related attachments. Assignment to one order does not expose all other orders or the client database.

When an order or project is subcontracted, the receiving contractor gains access to the transferred document’s data, including contacts, financial information and attachments. The originating contractor and dispatcher retain viewing access to the transferred work. Transfer alone does not open the other organisation’s remaining database. These provisions apply when the relevant feature is available.

The administrator and architect-developer, located in Israel, have administrative access for operation and support. External testers do not receive general database access; they work with their own data and assignments. Limited information may be disclosed to authorities on a lawful demand or to protect rights and investigate abuse, subject to law.

8. Providers and processing outside Israel

During testing, the main server, database, files and backups are hosted by LiveDNS in Israel. BulkGate sends SMS and receives the recipient number and necessary message data. Expo Push Notifications handles mobile notifications with Apple and Google delivery infrastructure. Web notifications use browser push services with VAPID. Expo also supports the mobile app’s technical infrastructure.

Sentry diagnostics uses the selected EU storage region. Email support requests are processed through Google’s Gmail. Requests through the testing group or messaging applications are also processed by those services; do not post client information in the shared group.

Some technical and contact information may be processed by providers outside Israel. Hosting the main server in Israel does not mean all processing occurs there. Transfers are limited to this policy’s purposes and must comply with applicable cross-border rules and necessary contractual safeguards. This policy does not replace those safeguards or authorise providers to use data for unrelated independent purposes.

9. Cookies and browser storage

The public information website contains demonstration forms and sample interfaces. Information entered into them is processed only in page memory and is not sent to the operator; no real requests or accounts are created. Selecting a file displays its name without uploading the file to a server. The website code does not set cookies or use localStorage, sessionStorage or IndexedDB, and includes no advertising tools or third-party analytics. When the website is visited, hosting and security infrastructure may process technical request information and keep logs. Technical cookies at this infrastructure level are checked separately; their presence cannot be determined from the absence of cookies in the website code.

The user web application uses an HttpOnly cookie to restore authentication; the access token is held in memory. localStorage contains language, selected role, form drafts, directory caches and service settings. The administrative interface also uses an HttpOnly cookie; its access token and current-user information are stored in localStorage, and list state in sessionStorage.

Browser storage can be cleared in browser settings; doing so may end the session and remove local drafts. Sign out and clear locally stored data when using a shared device.

10. Retention

Work data is retained during use and testing, subject to deletion requests and necessary lawful exceptions. We intend to retain data when transitioning to a permanent version. Planned termination of testing or data clearing is announced in the participant group at least 5 business days in advance.

LiveDNS backups are created daily at 18:50 Israel time and retained for 14 days. Application logs are kept for up to 30 days, but a 500 MB limit may cause earlier deletion. Nginx logs rotate daily; 14 archive files and the current log are retained.

Sentry error events are retained for 30 days on the Developer plan in use. This period does not automatically apply to other Sentry data categories. The latest installation state has no configured automatic age-based deletion period: it remains until manual deletion, including an applicable account-deletion request. This does not permit retention beyond what the stated purposes require or the law allows.

11. Access, correction and deletion

Contact the email above to inspect personal data, obtain a copy, correct inaccurate information or delete an account and related data. Applicable inspection and correction rights are governed, among other provisions, by Israel’s Protection of Privacy Law, 1981. Deletion rights and exceptions depend on law and circumstances; the operator additionally offers the account-deletion process described here.

During the beta, submit deletion requests by email or a private message to developers in the testing group. The architect carries out deletion manually. Following necessary account-ownership verification, the operator fulfils the request within 24 hours, excluding weekends, Shabbat and official Israeli holidays. Verification must be proportionate; do not send passwords or SMS codes. Uninstalling the application does not itself delete the account.

Deleting a specialist removes their personal information and related records and files; the contractor’s underlying order may remain. Deleting a contractor removes their projects and orders, except accepted, unfinished subcontracted work retained by the performing contractor. In retained documents, information identifying the deleted person is removed or anonymised unless a specific lawful retention ground applies. The requester is informed of any such exception and its reason.

Backup data remains until the relevant copy’s 14-day retention period expires. An automatic mechanism to repeat deletions after backup restoration has not yet been implemented; honouring prior deletions after restoration requires manual operator action. Data retained for a legal requirement or a specific dispute is restricted to that purpose and the necessary period.

12. Security and policy changes

Measures include HTTPS, server-side role and attachment-access checks, password hashing and session management. Failures, leaks and unauthorised access cannot be ruled out entirely. Beta status does not remove applicable data-security duties. Report suspected security incidents to the operator by email.

This policy is updated when processing changes. Material changes are notified through the participant group and/or application before taking effect; separate consent is obtained where required by law. A new publication does not automatically authorise incompatible uses of previously collected data. Hebrew, Russian and English versions are available; the Hebrew version prevails in a discrepancy to the extent permitted by law.