Privacy Policy

1. Introduction and identity of the data controller

Vexpora ("Vexpora", "the Company", "we", "us") operates vexpora.co.il ("the Site") and provides digital marketing services — SEO, AI visibility (GEO), paid advertising (PPC), website building, and managed digital-asset management for clients. Vexpora is the "database controller" (as that term is used in Israel’s Privacy Protection Law, 5741-1981) with respect to the personal data described in this document.

This privacy policy applies to personal data collected through the Site and in the course of providing services to clients, and explains: what data we collect, from whom and on what basis, the purposes for which we use it, who it may be shared with, where and for how long it is retained, and how you can exercise your rights regarding it.

Using the Site and submitting details via the contact form constitute agreement to this policy, to the extent required by law. If you do not agree, please refrain from using the Site or submitting details.

2. Definitions

For purposes of this policy:

• "Personal data" — any information relating to an identified or identifiable individual, including name, contact details, and data automatically collected while using the Site.
• "Special-category data" — sensitive data categories defined under Israel’s Privacy Protection Law (e.g. health, genetic data, political/religious views, criminal record, biometric data). Vexpora does not collect these categories through the Site.
• "Database controller" — the party that determines, alone or with others, the purpose of processing the data — in this case, Vexpora.
• "Processor" / "provider" — a third party that holds or processes data on Vexpora’s behalf to deliver the service (e.g. Google, Meta).
• "You" / "the user" — anyone visiting the Site, filling out the contact form, or a Vexpora client.

3. What data we collect and its source

3.1 Data you knowingly provide — contact form

When you fill out the contact form on the Site, we collect: your full name and phone number. Providing this information is entirely voluntary and is not a condition for receiving any service — you are not legally required to provide it. Consequence of not providing it: we will not be able to follow up with you regarding your inquiry. The details are given at your free discretion, for a single purpose: following up regarding our services.

3.2 Data collected automatically while browsing

While browsing the Site, technical and usage data is collected automatically via cookies and measurement tools, including: IP address, browser and device type, operating system, pages viewed and viewing order, time on page, referral source, and interaction with advertising campaigns (clicks, conversions). This data is collected via:

• Google Tag Manager (GTM) — manages measurement tools and tags on the Site; does not itself collect data, but activates the tools below.
• Google Analytics 4 (GA4) — analyzes usage and traffic on the Site, including browsing patterns and audience statistics.
• Meta (Facebook/Instagram) and Google Ads advertising pixels — measure ad campaign effectiveness and identify returning visitors for remarketing (targeted ads).

This data is collected anonymously/pseudonymously and is not knowingly linked to your full identity unless you chose to submit details via the contact form.

3.3 Data in the context of managed client services

Managed-service clients grant Vexpora limited access permissions to their own Google digital assets (see full detail in section 6). This data is received directly from the client through Google’s authorization (OAuth) process, not from the public website.

4. Legal basis and purposes of use

We use the information collected on the basis of your consent (for data submitted via the form) and/or our legitimate interest in operating a digital marketing business (for analytics and security data), for the purposes of:

• Responding to inquiries and following up after a form submission.
• Operating, maintaining, and securing the Site.
• Analyzing Site usage for statistics and to improve content and services.
• Measuring advertising campaign effectiveness and remarketing (showing relevant ads to prior visitors).
• Delivering the managed service to clients (managing YouTube assets, as detailed in section 6).
• Complying with legal requirements.

We do not sell or rent personal data to third parties, and we do not use the data for a purpose beyond those listed above without updating this policy and/or obtaining additional consent, as required.

5. Sharing information with third parties and service providers

Contact details submitted via the form are forwarded to internal lead-management tools — Google Sheets and Gmail — to track and respond to the inquiry. Access to these tools is limited to the Vexpora team and is not shared with external parties.

Anonymous/aggregated usage data is shared with the following measurement and advertising providers, which act as independent data processors subject to their own privacy policies and terms of use:

• Google (Tag Manager, Analytics, Ads) — privacy policy: policies.google.com/privacy
• Meta Platforms (Facebook/Instagram Ads) — privacy policy: facebook.com/privacy/policy

We may also share information: (a) with our professional advisors (e.g. accountant, legal counsel) as needed for our business activity and subject to confidentiality; (b) with competent authorities, as required by law, court order, or to protect our legal rights; (c) in the event of a corporate restructuring (merger, acquisition, sale of assets) — in which case we will update this policy and/or notify users as required by law.

6. Client Google account data

Managed-service clients grant Vexpora permission to manage digital assets on their behalf. For this we request these scopes and no others:

• youtube.force-ssl — edit video metadata on the client’s channel: titles, descriptions, tags, thumbnails.
• youtube.upload — upload videos to the client’s channel from footage the client supplied.
• yt-analytics.readonly — read viewership data to produce performance reports for that client.

We do not request or receive access to email, contacts, files, calendar, or any other Google service.

This data is used solely to perform the contracted service with that client. We do not sell it, do not transfer it to third parties, and do not use it to train artificial-intelligence models.

Access tokens are held in a restricted environment accessible only to the Vexpora team, and deleted within 30 days of engagement termination or on client request.

Revoke access at any time: myaccount.google.com/permissions

Limited Use: Vexpora’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Cross-border data transfer

Some of the providers listed in section 5 (notably Google and Meta) are international companies that process data outside of Israel as well, including in the United States and other countries where they operate. Such transfers are subject to the contractual and regulatory safeguards used by those providers (per their own terms of use and privacy policies), consistent with Israel’s Privacy Protection Regulations (Transfer of Data to Databases Outside the State’s Borders).

Vexpora does not knowingly transfer user databases to parties outside Israel beyond the use of the third-party tools listed above.

8. Cookies and tracking technologies

The Site uses cookies and similar technologies (including pixel tags) across three main categories:

• Essential cookies — required for the basic operation of the Site.
• Measurement/analytics cookies — Google Analytics 4, to understand usage patterns on the Site.
• Advertising/remarketing cookies — Meta Pixel and Google Ads, to measure campaigns and show targeted ads to returning visitors.

You can block, delete, or manage cookies via your browser settings (usually under "Privacy" or "Cookies"), and opt out of ad personalization via Google’s ad settings (adssettings.google.com) and Meta’s ad preferences (facebook.com/adpreferences). Fully blocking cookies may impair some Site functionality.

9. Data retention

We retain personal data only for as long as needed for the purpose it was collected, as detailed below:

• Contact details (name and phone number) — retained for as long as needed to handle the inquiry and manage the customer relationship, and deleted or anonymized once no longer needed for reasonable business activity or to comply with legal requirements (e.g. statute-of-limitations or record-keeping duties).
• Usage data collected via GA4 and advertising pixels — retained per those providers’ (Google, Meta) own retention policies, available in their privacy policies.
• Access tokens to clients’ Google accounts — deleted within 30 days of engagement termination or on client request (see section 6).

An earlier deletion request can be submitted at any time per section 11.

10. Data security

We take reasonable and accepted measures to protect the data we collect from unauthorized access, use, alteration, or disclosure, including: restricting data access to staff who need it for their role, using encrypted connections (HTTPS/TLS) for data transmitted over the internet, and storing access tokens in a restricted-access, secure environment.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure, and we cannot guarantee the total absence of security incidents. In the event of a material security incident, we will act in accordance with our legal reporting obligations.

11. Your rights and how to exercise them

Under Israel’s Privacy Protection Law, 5741-1981, you may contact us at any time to:

• Right of access — review the personal data we hold about you (section 13 of the law).
• Right of correction — correct inaccurate, incomplete, or outdated data (section 14 of the law).
• Right of deletion — request deletion of the contact details you submitted, to the extent we have no legal obligation or legitimate interest justifying continued retention.
• Withdraw consent — withdraw any consent given at any time, including regarding use of data for remarketing purposes, without needing to give a reason.
• Removal — request removal from a mailing list or lead database.

To exercise these rights, contact the email address in section 14. We will endeavor to respond to your request within a reasonable time.

If you are not satisfied with how your request was handled, you have the right to contact Israel’s Privacy Protection Authority at the Ministry of Justice.

12. Consent and the ability to withdraw it

Submitting details via the contact form, as well as continued browsing on the Site, is done at your free discretion. We do not condition responding to your inquiry on consent to data that is not needed for that purpose. Should we in the future run proactive marketing communications (such as an email newsletter), this will only be done after obtaining explicit, separate consent, in accordance with applicable law, and a free and simple opt-out will be available in every message.

13. Children

The Site is not intended for individuals under 18, and we do not knowingly collect data from minors. If we become aware that data about a minor was collected without the required parental/guardian consent, we will act to delete it.

14. Contact us

For questions, requests, or to exercise rights regarding this privacy policy, contact us at: noam@vexpora.co.il

15. Changes to this policy

We may update this privacy policy from time to time, including due to legal changes or changes to the services or tools we use. The updated version will be posted on this page along with the last-updated date. Continued use of the Site after an update is posted constitutes agreement to the updated version.

16. Governing law

This privacy policy is governed by the laws of the State of Israel, primarily the Privacy Protection Law, 5741-1981, and its regulations.