Privacy Policy

Effective date: 1 October 2026. Last updated: 1 October 2026.

1. Who we are

Salamandra AI, of 67 Yigal Alon St. (Toyota Building), Tel Aviv, Israel (the "Company", "we") operates our software service (the "Service") and the website salamandrai.com (the "Website"). This policy explains what personal data we collect, how we use and share it, and your rights. It forms part of our Terms of Service. You are not legally required to give us personal data, but without it we cannot provide the Service. Privacy contact: [email protected].

2. Data we collect

Do not upload special categories of data, such as health or biometric data, or data about third parties that you are not entitled to share.

3. How we use data

We use personal data to:

1. create and manage your account, authenticate you and keep the Service secure;
2. provide the Service, including storing, displaying, analyzing and exporting Your Content and sharing your notes with people on your project;
3. run AI features that you choose to use;
4. provide support and send service messages, such as security, account and policy-change notices;
5. maintain, debug and improve the Service, including through de-identified and aggregated statistics, and training our AI models on de-identified data;
6. send marketing messages, only where you have consented as required by section 30A of the Communications (Telecommunications and Broadcasting) Law, 1982; you may withdraw consent at any time;
7. comply with law, enforce our Terms, and establish, exercise or defend legal claims.

Where the GDPR or a similar law applies, our legal bases are performance of a contract (1 to 4), our legitimate interests in operating, securing and improving the Service (5 and 7), consent (6), and legal obligations (7).

We do not sell personal data, and we do not use it for third-party advertising. AI providers process content on our behalf under their enterprise terms.

4. Who we share data with

1. Service providers (processors): cloud infrastructure, authentication, storage and hosting providers, and AI model providers that process content you submit for analysis. They may process data only on our instructions.
2. Other users: notes and replies you add to a shared project, with your name, are visible to users who have access to that project.
3. Professional advisers: lawyers, accountants and auditors, under confidentiality.
4. Authorities and legal process: where required by law, court order or a competent authority, or to protect the rights, property or safety of the Company, our users or others.
5. Corporate transactions: a buyer, successor or investor in a merger, acquisition, financing or sale of assets, subject to this policy.

5. International transfers

Our providers store and process data outside Israel, including in the United States, the European Union and other countries. We transfer data in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, and, where the GDPR applies, the European Commission's Standard Contractual Clauses or another valid transfer mechanism. Data held abroad may be subject to access by authorities in those countries.

6. Retention

We keep personal data for as long as your account is active and as long as needed for the purposes above. After account closure, we delete or de-identify Your Content within about 90 days, except where we must keep it longer by law, or to resolve disputes, defend claims or enforce agreements. Backups are deleted on their ordinary cycle. Note that project notes are marked deleted rather than erased, so that shared discussions stay consistent; we will erase them on a valid request where the law requires it.

7. Security

We use reasonable technical and organizational measures in line with the Privacy Protection (Data Security) Regulations, 2017, including encrypted transmission, access rules that limit stored plans to their owner, and least-privilege access by staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a serious security incident occurs, we will notify the Privacy Protection Authority and affected users as the law requires.

8. Your rights

Under the Privacy Protection Law, 1981 (as amended, including Amendment 13), you may ask to review the personal data we hold about you and to correct or delete data that is inaccurate, incomplete, unclear or outdated. You may also ask to be removed from direct-marketing lists. Where the GDPR applies, you also have the rights to erasure, restriction, portability, objection, and withdrawal of consent, and to complain to your supervisory authority. In Israel you may complain to the Privacy Protection Authority.

To exercise your rights, email [email protected] from your account email. We may need to verify your identity, and we will respond within the time the law sets. Some rights are limited where the law allows, for example where data must be kept for legal claims.

If you upload data about other people (for example a client or architect named in a plan), you are responsible for having a lawful basis and for informing them as required. For that data, we act as your processor.

9. Cookies and local storage

The Service uses strictly necessary browser storage and similar technologies, from us and from our service providers, to keep you signed in, keep the Service secure, and remember your settings. The Website also uses analytics cookies (Google Analytics; see section 10). We do not use advertising cookies. Where the law requires it, we will ask for your consent before setting non-essential cookies.

10. Our website

When you visit the Website:

1. Contact and pilot forms. If you fill in a form, we collect what you enter: your name, email address, phone number and, on some forms, your company name. We use it to reply to you, arrange a pilot or demonstration, and follow up with you about the Service. The forms are processed by a third-party form service, and the answers are stored in our account with it. We send you marketing messages only if you have agreed to receive them, and you can withdraw that consent at any time.
2. Analytics. We use Google Analytics to understand how visitors use the Website, for example which pages are viewed and when a form is sent. Google Analytics uses cookies and collects data such as your IP address, device and browser type, approximate location and the pages you visit. You can block these cookies in your browser settings or with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout).
3. Hosting and fonts. The Website is served through a content delivery network that keeps technical logs, such as IP addresses and request times, for security and performance. It loads fonts from an external font service, which receives your IP address.
4. Links. The Website links to third-party sites and services, such as LinkedIn and WhatsApp. Their own privacy policies apply when you use them.

We keep form submissions for as long as needed to handle your enquiry, and for up to 3 years after our last contact with you, unless you ask us to delete them sooner.

11. Minors

The Service is intended for professionals aged 18 and over. We do not knowingly collect data from minors. If you believe that a minor has given us personal data, contact us and we will delete it.

12. Changes

We may update this policy. We will post the updated version with its effective date and, for material changes, notify you by email or in the app.

13. Language and contact

This policy is published in Hebrew and English. For users in Israel the Hebrew version prevails in the event of conflict; for all other users the English version prevails. Contact: Salamandra AI, 67 Yigal Alon St. (Toyota Building), Tel Aviv, Israel, [email protected].