Privacy Policy

The short version#

• The form on this site collects four things: your name, your phone number, your business name, and what is eating your time. The first two are required, the last two are not.
• The form posts nothing to a server. It composes a WhatsApp message, opens it on your device, and you send it yourself. Your details therefore travel through Meta and land in a personal WhatsApp conversation.
• The details are used for one thing: getting back to you and setting up a call. They are never sold or rented.
• No marketing messages are sent unless you ask for them.
• You can ask to see what is held about you, correct it, or have it deleted. You get an answer within 30 days at the outside.
• The site runs no measurement tools at all: no analytics, no tag manager, no advertising pixel, and no tracking cookies. Your accessibility preferences stay in your own browser.

The detail is below. It is short on purpose.

1. Who is responsible for your data#

Trading name

Faber Flow

Legal entity

Scale Up Marketing, a registered Israeli sole trader (osek patur)

Database owner and database manager

Oren Grach

Phone and WhatsApp

+972 54 481 2109

Website

faberflow.net

Oren Grach is both the owner and the manager of the database, in the sense those terms carry under Israel's Protection of Privacy Law, 5741-1981. There are no employees and no one else administers the data.

The WhatsApp number above is the contact channel for anything to do with this data, including a request to access, correct or delete it. It is the only channel, and it is answered.

2. What data is collected#

What you enter yourself

The form on the homepage has four fields and nothing else:

• Name. Required. Without it there is no one to get back to.
• Phone. Required. It is the only reply channel the site offers.
• Business name. Optional. Skip it if you like.
• What is eating your time. Optional, chosen from a fixed list. Skip it if you like.

The WhatsApp message that opens carries exactly what you filled in, and a field you skipped does not appear in it. Nothing else travels with it.

Whether you arrive through the form or press one of the WhatsApp buttons on the site, I also receive your phone number and your WhatsApp profile name, exactly as in any WhatsApp conversation.

What is collected automatically

The site is hosted on Cloudflare Pages. When you load a page, Cloudflare records ordinary server data in order to serve the page and protect it from attacks and bots:

• IP address
• Browser and operating system (user agent)
• The page requested, the time of the request, and the response code
• The approximate country the request came from

Amendment 13 to the Protection of Privacy Law, in force since August 2025, broadened the statutory definition of "information" to cover any data about an identified or identifiable person. An IP address counts as personal data under that definition, which is why it is listed here rather than buried under "technical data".

The site's fonts are loaded from Google Fonts. To deliver the font files, Google's servers receive your IP address and browser details. That happens on page load, before you touch the form.

The site runs no measurement tools whatsoever. There is no Google Analytics, no Google Tag Manager, no Meta pixel, no Cloudflare Web Analytics, and no alternative such as Plausible or Umami. There is no advertising code and there are no tracking cookies. The only data recorded about your visit is the Cloudflare server log listed above, plus the font request that reaches Google.

What is not collected

There is no advertising tracking, no behavioural profiling, and no automated decision-making about you. No sensitive data is collected: no health data, no financial status, no opinions, no precise location, no biometrics. If something of that kind appears in free text you send me on WhatsApp, it is kept only for the purpose of handling your enquiry.

3. Why the data is collected#

The data is used for nothing else. It is not sold, not rented, and never passed to advertisers.

4. Basis for holding the data, and your consent#

Giving your details through the form is entirely voluntary. There is no legal obligation to provide them, and you can reach me on WhatsApp without filling in anything. The practical consequence of not providing them is simple: without a name and a phone number there is no way for me to get back to you.

Section 11 of the Protection of Privacy Law requires me to tell you, at the moment I ask you for information, what happens to it. Amendment 13 broadened that notice duty. This document is how I meet it, and these are the points the law requires:

1. Who is asking and who holds the data. Oren Grach, Scale Up Marketing. Details in section 1.
2. Whether you are legally obliged to provide it. You are not. It is voluntary.
3. The purpose it is requested for. The table in section 3.
4. Who it will be passed to and for what purposes. The full list in section 5.
5. Your rights. Section 7.

Submitting the form is informed consent to use your details for the purposes in section 3. It is not consent to receive marketing. Those are two separate things, and section 8 explains the difference.

5. Who the data goes to#

I do not sell data and I do not pass it to advertisers. Three technical providers sit in the path, because without them the site does not function. This is the complete list.

How the form reaches me, and this is the important part of the document. The form posts nothing to a server of mine. There is no backend behind it, no database, and no automation server. Pressing "send" makes your browser compose a WhatsApp message containing what you filled in and open the conversation with me. You are the one who presses send, from your own account.

What that means in full: the details you typed travel through WhatsApp's and Meta's infrastructure, so Meta processes them the way it processes any message on its service, and they arrive with me as a personal WhatsApp conversation on my phone. That is where they sit, and that is the only place. If you would rather your details did not pass through Meta, do not use the form or WhatsApp, and call instead.

Transfers outside Israel

All three providers run servers outside Israel, mainly in the United States and in Europe. That means your data leaves the country.

Those transfers are made under the Protection of Privacy Regulations (Transfer of Information to Databases Abroad), 5761-2001. The basis for the transfer is your consent to provide the information for the purposes set out in section 3, together with the terms of service and data protection commitments these providers give their customers. If you would rather your details did not pass through a service hosted outside Israel, do not use the form or WhatsApp, and ask by phone for a different channel.

6. Database registration and Data Protection Officer#

Two questions come up constantly since Amendment 13, so here are the answers in plain terms.

Database registration. Amendment 13 sharply narrowed the duty to register databases. It now applies mainly to public bodies, to businesses whose occupation is collecting information in order to pass it to others, and to very large databases holding information of special sensitivity. A sole trader's lead list, holding a name and a phone number and trading in nothing, falls into none of those categories. This database is not registered and is not required to be.

Data Protection Officer. Amendment 13 created a duty to appoint a Data Protection Officer, but that duty applies to defined categories: public bodies, financial institutions, businesses whose main activity is large-scale processing of sensitive information, and businesses whose activity involves systematic and extensive monitoring of individuals. A business of this size falls into none of them, so no officer is required. The address for any privacy question is Oren Grach, at the details in section 1.

This is spelled out so it is clear what does and does not apply. The absence of a registration duty changes nothing about the rest: the notice duty, purpose limitation, security obligations, and your rights all apply in full.

7. Your rights#

On deletion, honestly. Israeli law gives you an explicit right to demand correction or deletion of information that is inaccurate, incomplete, unclear or out of date. Beyond that, and regardless of whether the law compels it, this is my commitment: if you ask me to delete your details, I delete them. The only exception is information I am required to keep under other law, chiefly accounting and tax records if we have worked together. In that case I will tell you exactly what remains, why, and for how long.

How to exercise them. Send a request on WhatsApp to +972 54 481 2109. To avoid handing someone's data to the wrong person, I will check that the request comes from the same phone number that was provided, or verify identity by another reasonable means.

Response time. Within 30 days, as the law requires. In practice, in a business this size, it takes days rather than weeks. If I refuse a request I will give the reason in writing.

What deletion actually covers. Your details sit in one place: the WhatsApp conversation on my phone. There is no copy in a spreadsheet, a database or a CRM, because the form never reaches one. Deletion means deleting that conversation and everything given in it. If we worked together, what remains is the accounting records tax law requires me to keep, and I will tell you exactly which.

8. Marketing messages, direct mail, and Israel's anti-spam rule#

Short answer: I do not send marketing.

Replying to your enquiry is not advertising. If you left a phone number asking me to get back to you, getting back to you is exactly what you asked for.

Section 30A of the Communications (Telecommunications and Broadcasts) Law, 5742-1982, Israel's anti-spam provision, prohibits sending advertising material without prior express consent. The section names email, SMS, fax and automated dialling. As for WhatsApp, my working assumption is that it falls within scope, so I follow the section there as well rather than looking for a loophole.

In practice:

• No newsletters, promotions or campaign messages go to people who filled in the form.
• If I ever start sending marketing content, I will ask for your consent separately and in advance. I will not treat form submission as consent to it.
• Any future marketing message, if one is ever sent, will be labelled as advertising and will carry the sender identification and the opt-out route section 30A requires, through the same channel it arrived on.
• You can opt out at any time, including before anything has been sent. "Don't send me anything" on WhatsApp is enough.

Direct mail. I do not operate a direct mail services database and do not carry out direct mail within the meaning of sections 17C to 17F of the Protection of Privacy Law. I do not profile people into population segments in order to approach them, and I do not hand the database to anyone for that purpose. If that ever changes, this document will be updated before it happens.

9. How long data is kept#

At the end of the period the data is deleted. Keeping data after its purpose has expired is not caution, it is unnecessary risk for both of us.

10. Cookies and local storage#

The site sets no cookies of its own and runs no advertising tracking code.

Two things do happen in your browser:

1. Local storage of accessibility preferences. If you used the accessibility widget to enlarge text, switch on high contrast, stop animations, or underline all links, that choice is saved in your browser's localStorage so it returns on your next visit. It stays on your device, is never sent to any server, and I never see it. You can remove it by clearing site data in your browser, or by pressing "reset" in the widget.
2. Cloudflare technical cookies. Cloudflare may set a technical cookie for bot detection and attack protection. It is not used for advertising and builds no profile of you.

11. Security#

The database is run in line with the Protection of Privacy Regulations (Data Security), 5777-2017, at the security level applicable to a database of this size, holding contact details only and administered by one person.

What that means concretely:

• Access is limited to Oren Grach. There are no employees, no subcontractors, and nobody looking at the data "to help".
• Traffic between your browser and the site is encrypted (HTTPS).
• The devices and accounts where the details sit are password protected with two-factor authentication.
• No data is collected without a purpose. The less that is collected, the less there is to lose.

No system is immune. If a security incident occurs that could affect your privacy, I will notify you as soon as possible and act toward the Privacy Protection Authority as required.

12. Minors#

This service is aimed at business owners. It is not directed at children and is not designed to collect data about anyone under 18. If a minor's details have been submitted without the consent of a responsible adult, contact me and the details will be deleted.

13. Complaints#

If you believe your data was mishandled, I would rather you came to me first. It is usually resolved the same day.

Either way, the right to complain is yours. The address is the Privacy Protection Authority at Israel's Ministry of Justice, reachable through the Authority's pages on gov.il. The Authority can investigate complaints and apply enforcement measures.

14. GDPR: where it does and does not apply#

This is an Israeli business serving Israeli small and medium businesses. It does not offer goods or services to people in the European Union, does not market to them, and does not monitor their behaviour. An English version of the site exists so that Israeli business owners who prefer to read in English can, and it changes none of that. On that basis the EU General Data Protection Regulation does not apply to this business, and no EU representative has been appointed under Article 27. Faber Flow is not registered under GDPR and does not claim to be.

If that changes, and services are offered to people in the EU or the UK, this document will be updated first and the applicable GDPR obligations will be met before the offering begins.

Two points worth knowing in the meantime:

• If you are in the EU and choose to contact me anyway, I will handle your details on the same terms set out here: minimal collection, a single purpose, deletion on request.
• Israel holds an adequacy decision from the European Commission, first granted in 2011 and maintained following the Commission's review in January 2024. Personal data can therefore move from the EU to Israel without additional transfer safeguards.

15. Changes to this policy#

If this policy changes, the date at the top will change with it and the change will be described here. A material change, such as adding a measurement tool or a new use for data already collected, will not be applied retroactively. In that case I will ask for fresh consent before the new use begins.

16. Contact#

For any question about this document, to exercise a right, or to request deletion, the address is WhatsApp or phone: +972 54 481 2109.

That is the only contact channel the business has, and it is also where every right in section 7 is exercised. A message sent to it comes straight to me.