This document is an initial skeleton only and is not legal advice. Every substantive sentence is marked with the tag [pending legal review] and must be verified, completed or replaced by a lawyer before binding publication. Do not rely on this wording as is. This English version is provided for convenience; the Hebrew version prevails.
Privacy Policy
Who we are, what information we process, where and with whom, how long it is kept — and how you can exercise your rights.
Last updated: — · [pending legal review]
1. Who we are and our role
RestoMatch is operated by Digital Efficiency Ltd.. Privacy inquiries: info@digitalefficiency.co.il [pending legal review]
We are the database controller only for information about website visitors, people who submitted the contact form, account security and billing [pending legal review]
For the information a customer restaurant enters into the system — about its staff, suppliers, orders and invoices — the restaurant is the controller and we are the holder: we process that information on its behalf and on its instructions, under a data processing agreement with it [pending legal review]
2. Categories of information
Account information: name, role, email address, phone number, interface language and the identification details required for sign-in and permission management [pending legal review]
Supplier and procurement information: supplier details and their contact people, orders, catalogs and prices entered or uploaded by users [pending legal review]
Images of invoices and delivery notes, and the data extracted from them by automated reading [pending legal review]
Details provided voluntarily through the contact form on the website, and how you reached the site (for example a campaign), which is kept in the browser until the tab is closed and sent with the form [pending legal review]
Activity logs and technical identifiers required to secure and operate the service [pending legal review]
3. Purposes of use
We use the information to provide the service: matching order, goods receipt and invoice, showing discrepancies, running approvals and supplier credit requests, and sending operational alerts [pending legal review]
We also use information to secure the system, for billing and for support. A customer restaurant's information is used for nothing else; product improvement uses only aggregate data, and only with the restaurant's consent [pending legal review]
The legal basis for each purpose (performance of a contract, consent, legal obligation) is under review and will be set out here [pending legal review]
4. Service providers (sub-processors)
We use only four service providers. Each receives only the information its role requires [pending legal review]
| Provider | Purpose | Country | DPA |
|---|---|---|---|
| Supabase | Database, sign-in and storage of document images | Japan (Tokyo) | In review |
| Vercel | Running the website and app, and operational logs | Japan (Tokyo) + global edge network | In review |
| Anthropic | Reading invoices and delivery notes (OCR), receiving-screen translation and the assistant | USA | In review |
| Resend | Operational email (sign-in links, alerts) | USA | In review |
Reading invoices and delivery notes (OCR) is done by Anthropic: the document image is sent to it to be read. Anthropic is also used to translate the receiving screen for staff and to answer questions in the in-app assistant [pending legal review]
The data processing agreements (DPAs) with these providers are under review, so they are marked "In review" [pending legal review]
5. Transfers outside Israel
Information is processed outside Israel: in Japan (Supabase, Vercel) and in the USA (Anthropic, Resend). Vercel also serves the website through a global edge network [pending legal review]
The transfer relies on the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001: the controller's consent, and each provider's written undertaking to protect the information and not pass it on. This basis is under review [pending legal review]
6. How long information is kept
Account information is kept while the account is active [pending legal review]
Contact-form details: the proposed retention periods are about 30 days after consent is withdrawn, and about two years if no marketing consent was given. Automatic deletion is not active yet; until it is, we delete on request [pending legal review]
A customer restaurant's information: when the engagement ends, on request we hand over the document images and the data as CSV files within 14 days, and delete the information within 30 days. Copies in backups are deleted when the backup cycle ends [pending legal review]
Keeping invoices and documents as tax law requires is the restaurant's duty [pending legal review]
7. Your rights
You may review the information about you and ask to correct or delete it [pending legal review]
Staff or suppliers of a customer restaurant should contact the restaurant first, as it is the controller of their information. A request that reaches us will be passed to the restaurant, and we will help it handle the request [pending legal review]
For any other request, write to info@digitalefficiency.co.il [pending legal review]
Account holders: Manage personal data and privacy requests.
8. Cookies and browser storage
We use only the cookies and browser storage needed for sign-in, security, language and working in the system. There are currently no analytics or advertising cookies [pending legal review]
Full details: Cookie Policy.
9. Information security
Each restaurant's information is separated at the database level (Row-Level Security); document images are kept in private storage and opened only through short-lived signed links; passwords are stored as argon2id hashes; traffic is encrypted (TLS); and two-step verification can be turned on [pending legal review]
Support access to a restaurant's information happens only through the admin console and is logged [pending legal review]
10. Contact
Privacy inquiries: Digital Efficiency Ltd. · info@digitalefficiency.co.il [pending legal review]
You may also contact the Privacy Protection Authority [pending legal review]