Privacy Policy

The Law distinguishes between whoever determines why information is collected and what is done with it (the "database controller") and whoever processes it on that party's behalf (the "holder"). In our case there are two situations:

• Information about the salon's brides, customers, employees and suppliers: the salon is the controller. It decides what to enter, who to give access to and when to delete, and it is the point of contact for the people the information relates to. We are the holder: we store and back up the information and operate the system in accordance with the salon's instructions and the data processing chapter of the Terms of Use, and we do not use this information for any purpose of our own.
• Information about the salon and about those who contact us: sign-up details, users, billing, website inquiries and support. Here we are the controller.

In GDPR terms (UK GDPR and EU GDPR): for the first kind of information the salon is the controller and we are the processor, processing it only on the salon's instructions and under the data processing agreement. For the second kind we are the controller. Paddle, which sells the subscription as Merchant of Record, is an independent controller of the payment details it collects.

The controller of information of the second type: Nerya Cohen, trading as Nerya ERP, support@sewingerp.com. For privacy inquiries, write "Privacy" in the subject line of your message.

In all of these cases, you are under no legal obligation to provide us with the information. Providing it depends on your will and consent, and without it we will not be able to provide what is described next to each type.

• "Fit check" form on the website: name, business name, email, phone (optional) and message. Used to get back to you and arrange a call. Without a name and email address we cannot get back to you. Kept for as long as it is needed to stay in touch with you, and deleted when you ask.
• How you reached the website: when you send the contact form, it is saved together with the page it was sent from, the first page of your visit, the name of the website you came from (not the full address) and the campaign tags in the link (utm), if any. When you sign up, the first page, the website name and the campaign tags are saved with the new business, together with the language of the sign-up. Until you send a form, this stays only in your browser, until the tab is closed, and is not sent anywhere. Used to know which channels bring inquiries and customers.
• Statistics on the marketing website: only if you accepted in the banner, Google Analytics collects which pages were viewed, which channel you came from, approximate country and city, device and browser type, and a random ID in a cookie. No name, phone or email is collected, and Google does not store the IP address. Used to improve the website and to see which channels work. There is no Google Analytics inside the system (after sign-in).
• Sign-up and account: business name, email and password (stored as a hash only), or a Google account (name and email), the selected plan, and the users the business adds (name, email, role). Used to open the account, for sign-in and for managing permissions. An account cannot be opened without an email address.
• Billing: payment is made through Paddle, the Merchant of Record for the order. At checkout you give Paddle your payment details, business name, email, country and VAT or business number (if any) directly. Card details never reach us. From Paddle we receive the business name, email, plan, subscription status, payment history and country, to activate and manage the subscription. Without billing details a paid subscription cannot be activated.
• Support and correspondence: the content of your email inquiries, for the purpose of responding and improving the service.
• Usage and security logs: sign-ins to the system, IP address, browser type, and actions recorded in the audit log. Used for security, troubleshooting and preventing misuse, and collected automatically during use.

The system stores what the salon enters or collects through it. Usually:

• Brides and customers: name, phone, email, address, event date and venue, referral source, preferred language, style notes, status, follow-ups and contact log.
• Body measurements: circumferences and lengths, with the date of measurement and all previous versions, for sewing and alterations.
• Photos and files: inspiration images, fitting and garment photos, and documents attached to a record, a dress, a work order or an alteration.
• Digital signature (if the salon has enabled it): the signed document, the name, the signature image, the time of signing, the IP address and the device type, so that it can be proven who signed and what was signed.
• Online booking and the bride portal (if the salon has enabled them): name, phone, event date and a note that the bride enters herself; the portal shows her the status of the dress, her appointments and the balance due.
• Reminders (if the salon has enabled them): an email to the bride in the salon's name before an appointment or delivery. Any bride may ask the salon to stop sending them to her.
• Finances: prices, deposits, payments and refunds, payment method type and payment references. Brides' card numbers are not stored.
• Salon employees: contact details, role, attendance and hours, and, at the salon's choice, also pay rates.
• Operations: dresses, work stages, tasks, inventory, suppliers, shops and work orders.

The obligation to inform the bride at the time of collection (under section 11 of the Law) rests with the salon. On pages that the bride fills in herself, such as online booking and remote signature, the system displays a short notice in the salon's name, but it does not replace the notice that the salon itself provides.

A salon in the UK or the EU is also the controller under the GDPR: it decides the lawful basis for collection, gives its brides the notice required by Articles 13 and 14 GDPR and handles their requests. We assist it under the data processing agreement.

Body measurements, body photos taken at fittings and signatures are information that we treat as sensitive, even if not every item falls within the definition of "information of special sensitivity" in Amendment 13. It is therefore stored at a level of security at least equal to that of the rest of the system: files in a private folder, signed links valid for one hour, and never in a supplier portal.

The system is not intended for medical information, full ID numbers or information about minors beyond what is required for sewing. A salon that enters such information is responsible for the legal basis for doing so.

Under the GDPR, measurements and photos are not in themselves a "special category" of data (Article 9) unless they reveal information about health. For that reason, health information must not be entered into the system, even when it seems relevant to the fitting.

• Providing the service to the salon: managing brides, measurements, dresses, appointments, signatures and payments.
• Minimal sharing with a sewing workshop or factory the salon works with: job number, model, garment measurements, color and photos that the salon has explicitly marked for sharing. Without the bride's name, phone number or event date.
• Backup, security, fault prevention and technical support.
• Billing the salon and communicating with it.

What we do not do: we do not sell information, do not use it for advertising, do not build profiles, do not train artificial intelligence models on it and do not contact brides in our own name. Marketing emails are sent to the salon only with its consent, and every such message includes a way to unsubscribe.

Lawful basis under the GDPR for the information we control:

• Sign-up, account, users and support: performance of our contract with you (Art. 6(1)(b)).
• Billing and financial records: performance of the contract, and the legal obligation to keep records under tax law (Art. 6(1)(b) and 6(1)(c)).
• The "Fit check" form and website inquiries: steps taken at your request before a contract, and our legitimate interest in answering an inquiry (Art. 6(1)(b) and 6(1)(f)).
• Usage and security logs: our legitimate interest in protecting the system and the data, detecting faults and preventing misuse (Art. 6(1)(f)).
• Website statistics (Google Analytics): consent (Art. 6(1)(a)), which you can withdraw at any time from "Cookie settings".
• Marketing emails to the salon: consent (Art. 6(1)(a)), which you can withdraw at any time.
• Information the salon enters: the salon decides the lawful basis; we process it on the salon's instructions (Art. 28).

The providers that store or transmit information for us, for every account (sub-processors):

• Supabase: database, authentication and file storage. Frankfurt, Germany.
• Hetzner Online GmbH: application server. Germany.
• Cloudflare: website protection, DNS and traffic encryption, through a global network. In addition, an encrypted backup copy is stored with Cloudflare R2 in the North America region.
• Brevo: sending operational emails and reminders enabled by the salon. European Union.
• Google Ireland Limited (Google Analytics), only for marketing-website visitors who accepted statistics: website usage data, without a name or contact details. Google may also process this information in the United States, under the EU-US Data Privacy Framework and the standard contractual clauses in its data processing terms.
• YouTube (Google): the origin video on the home page is embedded from youtube-nocookie.com and loads only after you click play. From that moment Google's privacy policy applies.
• Paddle.com Market Limited (United Kingdom) and its affiliates, for paying businesses: subscription payment processing, invoices, tax, fraud prevention and refunds. For the payment details Paddle collects at checkout it is an independent controller, under its own privacy policy (paddle.com/legal/privacy).

Only if the salon connects them itself in the settings, relevant information is also transferred to:

• Morning (Green Invoice), iCount, Sumit: the customer's name and the amount, for an invoice or receipt.
• UPS: name and address for shipping.
• Webhook or API to the address and tools configured by the salon.

Transfer outside Israel. Most of the information is stored in the European Union, which is recognized in Israel as having an adequate level of protection. The backup copy in North America is encrypted before it leaves the server, and the provider is contractually bound to safeguard it. The transfer is carried out in accordance with the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001.

Transfers under the GDPR. Information from the UK and the EU comes to us in Israel, which the EU recognizes as providing an adequate level of protection (Commission Decision 2011/61/EU, reconfirmed in the review of January 2024), as does UK data protection law (Data Protection Act 2018, Schedule 21). Most of the information is stored in Germany, inside the EU. The encrypted backup copy on Cloudflare R2 in North America is transferred on the basis of the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA / UK Addendum) in Cloudflare's data processing agreement. You can ask us for a copy of these safeguards.

Billing details are processed by Paddle in the United Kingdom and, where needed, in the United States and other countries where it operates, under its privacy policy and the data protection laws that apply to it.

Beyond this, information will be disclosed only where required by law (for example, a court order or a demand by a competent authority). We will notify salons of any new sub-processor 30 days in advance and update the list here.

The terms on which we process information on the salon's behalf, including the list of sub-processors and their locations, are set out in the data processing agreement (DPA).

• Salon data: as long as the account is active. After closure: 30 days during which everything can be exported, followed by deletion.
• Backups: 14 days on the server and 60 days in the off-site copy, after which they are deleted automatically. In addition, one encrypted copy from each month is kept for 12 months. Information deleted in the system exists in backups until they expire.
• Financial records (payments, expenses, invoices): 7 years, in accordance with bookkeeping requirements, even after the record is deleted.
• Signed documents: as long as the record exists. Permanently deleting the bride also deletes them.
• Account and users (where we are the controller): as long as the account is active. 30 days after closure, users who have no other business in the system are deleted; the business name, billing details and our invoices to the salon are kept for bookkeeping.
• Audit log: 12 months, and 24 months for actions on payments, expenses, signatures, the business account, users and permissions; after that it is deleted automatically. When a bride is permanently deleted, her entries in the log are emptied of content (the date and the action remain).
• Integrations log: 90 days. Shop-floor work reports: 3 years.

• Access (section 13 of the Law): to receive the information stored about you.
• Correction and deletion (section 14): to request the correction or deletion of information that is not correct, complete, clear or up to date.
• Unsubscribing from marketing (section 17F of the Law and section 30A of the Israeli Communications Law (Telecommunications and Broadcasting)): to stop receiving marketing communications at any time.
• Export: account owners can download all of the salon's data at any time, as CSV files.
• Additional rights under the GDPR (for people in the UK or the EU): in addition to access, rectification and erasure, also restriction of processing, data portability, objection to processing based on legitimate interests (and always to direct marketing) and withdrawal of consent at any time. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

If you are the salon, or contacted us through the website: write to support@sewingerp.com. We will respond within 30 days, and if we need to verify your identity first, we will ask for the minimum required.

Under the GDPR we will respond within one month. For a complex request or several requests this can be extended by two further months, and we will tell you so within the first month. Exercising your rights is free of charge.

If you are a bride or a customer of a salon: the salon is the controller of your information, and your request should therefore be directed to it. The salon has all the tools in the system: viewing the full record, editing, exporting and "Delete permanently" (which deletes the record, measurements, appointments, payments, signatures, photos and contact log, and empties the entries about you in the system logs). If you contacted us directly, we will forward the request to the salon within 5 business days and keep you informed.

Anyone who believes that their rights have been infringed may also apply to the Privacy Protection Authority at the Ministry of Justice.

Anyone in the UK may complain to the Information Commissioner's Office (ico.org.uk), and anyone in the EU to the data protection supervisory authority of the country where they live or work or where the infringement took place. We would appreciate it if you contacted us first, so that we can try to resolve the matter.

• Separation between businesses at the database level (Row Level Security), and an automated test that verifies that no row passes between businesses.
• Encryption in transit (TLS) on every connection; encryption at rest with the storage providers; backups encrypted before they leave the server.
• Passwords and API keys are stored as hashes only; integration secrets are encrypted in the database.
• Roles and permissions within each business, and an audit log of every change.
• Supplier portals without identifying details of brides; files accessible only through a short-lived signed link.
• Our support team's access to business data is view-only and is recorded in the business's audit log.
• A firewall, rate limiting against sign-in attempts, health checks every 5 minutes and periodic backup restoration drills.

If a security incident affecting a salon's information is discovered, we will notify the salon without delay, setting out what is known, what was affected and what is being done, and we will assist it in reporting to the Privacy Protection Authority where required by law. In the case of an incident affecting information of which we are the controller, we will report to the Authority ourselves in accordance with the Data Security Regulations.

Where the GDPR requires it, we will report such an incident to the competent supervisory authority within 72 hours of becoming aware of it, and notify the people affected when there is a high risk to them.

More detail on the Security page.

The system itself (after sign-in) uses only cookies that are needed to provide what you asked for: signing in, staying signed in securely and remembering a choice you made. The marketing website (home page, pricing, legal pages) also has Google Analytics statistics cookies, and they run only if you accepted them in the banner. There are no advertising cookies. You can change your choice at any time from the "Cookie settings" link at the bottom of every page of the website. The cookies:

• Sign-in (sb-…-auth-token, nco_activity): keep you signed in and sign you out after 12 hours without activity or 30 days after signing in. The browser also stores the time of your last activity (nco_last_activity), to lock a screen left open.
• Selected business (nco_tenant): which business you entered, when you have more than one. Up to one year.
• Language and display (nco_lang, nco_theme): the language and color theme you chose. Up to one year.
• Site access (nco_gate): only while the website is in restricted access, for people who entered through an access link. Up to 90 days.
• Message after an action (nco_flash): a single confirmation or error message. A few seconds.
• Floor reporting and time clock (nco_worker, nco_worker_pin): on a shared device in the workroom, remember which employee reported. Up to 30 days; the personal-code clearance up to 12 hours.
• Your banner choice (nco_consent): remembers whether you accepted or declined statistics, so we don't ask again. 180 days. In addition, the website keeps in your browser (not in a cookie) how you reached it (nco_lead_source), until the tab is closed, and sends it only with the contact form or the sign-up form.
• Website statistics (_ga, _ga_…): only after you accept in the banner. Google Analytics counts visits, pages and traffic sources, without linking them to your name. Up to two years, or until you withdraw your consent.
• Cloudflare (for example __cf_bm): security cookies that identify malicious traffic.

The checkout page is operated by Paddle, which may use its own cookies and tools there for fraud prevention and to complete the payment, under its own policy.

The system is intended for businesses. A customer under the age of 18 (for example, for a bat mitzvah dress) is registered by the salon with a parent's consent, and the salon is responsible for this, including with regard to photographs.

When the policy changes, the date at the bottom of the page is updated, and we will notify salons by email of any material change. Questions and requests: support@sewingerp.com. The terms of use, including the chapter on processing information on behalf of the salon, are available in the Terms of Use.