Privacy policy

1. Who is responsible for your data

The data is collected and held by the operator of start.business. The operator’s details and contacts appear at the bottom of the page.

2. What we collect

• Sign-up details: name, email, phone, business type and interface language.
• Application details: Teudat Zehut number, business name, field and description of activity, business address and expected turnover and profit. For a company, also shareholder details and their shares, directors and authorised signatories, and proposed company names.
• Documents you upload: Teudat Zehut and appendix, a cheque or bank account confirmation, driving licence or passport, proof the business is ready and documents the accountant asks for. We strip metadata, such as location, from photos before saving them.
• Documents the accountant uploads for you, such as the Osek certificate and the bookkeeping confirmation.
• Payment details: amount, chosen services, the last four digits and type of card, and the receipt number. The full card number and security code go directly to the Sumit payment provider and never reach our servers.
• Account details: your password, stored only as a hash from which it cannot be recovered, and your two-step sign-in setting.
• Technical data: IP address, browser type and the time of important actions such as sign-in, payment and decisions on documents. We use it for security, to prevent abuse and to investigate faults.
• Cookies and browser storage, as described in the cookie policy.

Cookie policy

3. Do you have to give us this information

The law does not require you to give us information. Without the details and documents, however, we cannot register your business, because the authorities require them.

4. How we use the information

• To prepare your application and file it with the authorities on your behalf.
• To run your account and show the status of your application.
• To take payment and issue a receipt.
• To send service messages: sign-up and payment confirmations, requests to replace a document, notice that the business is registered, password resets and sign-in codes.
• To secure the site and prevent fraud.
• To meet legal duties, such as keeping accounting records.
• To improve the site using aggregate usage statistics.

We do not send advertising without your explicit consent, and we do not sell personal data.

5. Who receives the information

• The authorities: the Israel Tax Authority, Bituach Leumi and the Registrar of Companies, to register your business.
• The accountant and staff who handle your application, only as far as needed.
• Providers working for us: Sumit (payments and receipts), Render (servers, database and files), Resend (sending email), Google (Google Tag Manager and statistics tools) and Cloudflare (bot protection on sign-in pages, when it is enabled).
• A competent authority, when the law or a court order requires it.

Each provider receives only the data it needs to do its job.

6. Data stored outside Israel

Some providers, such as Render, Resend and Google, store or process data on servers outside Israel, for example in the United States and the European Union. Data is sent to them only to run the service.

7. How long we keep information

• For as long as your account is active and the information is needed for the service.
• When you delete your account, your applications, documents and files are deleted too. Payment records are kept without a link to you, because the law requires accounting records to be kept.
• You can delete your account in the account settings. While the accountant is handling your application, deletion is blocked, and you can contact us instead.

8. Security

• Your connection to the site is encrypted (HTTPS).
• Passwords are stored only as hashes (bcrypt).
• You can turn on two-step sign-in with a code sent to your email.
• Documents are kept in private storage and open only to the account owner and authorised staff.
• Access to the admin panel is limited to authorised staff, and important actions are logged.

No method is completely secure. If a serious security incident affects your data, we will act as the law requires and let you know.

9. Your rights

• To view the information about you (section 13 of the Privacy Protection Law).
• To ask us to correct or delete information that is not accurate, complete, clear or current (section 14).
• To delete your account.
• To opt out of marketing messages.

You can view and update most information in your account. For other requests, email us. If you do not get an answer, you can contact the Privacy Protection Authority.

10. Minors

The service is intended for people aged 18 and over. We do not knowingly collect information about minors.

11. Changes to this policy

We may update this policy. The update date is shown at the top of the page. We will announce material changes on the site or by email.

12. Contact

You can ask questions about this document by phone, on WhatsApp or by email.