Privacy policy

CenterGet is a cloud system for managing businesses. It is operated by CenterGet Ltd., company no. 515685345, 444 Main Road, Tayibe, Israel, which is responsible for the information described in this policy.

For any question about this policy or about information kept about you: privacy@centerget.com.

We are responsible for the businesses' accounts. Information about the businesses that sign up to CenterGet and about the people who use the system on a business's behalf — its owners, employees and the users it invites — is collected and processed by us, and this policy applies to it in full.

The business is responsible for the information it enters. Customers, suppliers, leads, documents, messages, and inquiries that arrive from the business's website and business card — this is the business's information. We store and process it for the business, on its instructions and to provide it with the service, and do not use it for any other purpose.

If information about you is held by a business that uses CenterGet — for example, if you are its customer, or contacted it through its website — that business's privacy policy applies to you, and it is the first to contact. If you contact us, we will pass the request on to the business and help it handle it.

• Account and profile: name, email address, phone, role in the system, a profile picture if one was uploaded, language and notification preferences. Where the business filled them in, also a job title, department, employee number, manager and start date. Passwords are kept by Google (Firebase Authentication), not by us.
• The business's details: name, company or VAT number, address, logo, package and subscription. When a business buys a domain through us, also the holder details the registrar requires: name, ID or company number, email, phone and address.
• Sign-in and use: the time of the last sign-in; the business's activity log — who did what and when; devices that allowed notifications, with the browser and operating system; and error reports from the browser — a description of the error, the page, the browser, and the user's ID when signed in.
• Communication: support tickets — including the page they were opened from and the browser — team chat messages, and the files attached to them.
• Remote assistance: only after the person asking for help approves, every time, for an hour at most. Nothing is recorded. The connection data, which includes IP addresses, is deleted when the session ends.
• What the business enters: everything the business records in the system or uploads to it — customers, suppliers (including bank details), quotes, orders, documents, expenses, stock, production, files, and the content of its website and business card. Uploaded pictures are cleaned in the browser of information embedded in them, such as where they were taken. Videos are kept as uploaded, including such information if the device recorded it.
• An employee's business card: name, role, phone, WhatsApp, email, a short description and a photo. The card is published only after the employee approved it, or the owners declared that the employee agreed (the declaration is recorded in the log), and only while the employee is active and has not hidden it.
• The customer portal: the business's customers sign in with a one-time code sent by SMS to the phone the business recorded for them, with no account and no password.

The websites and business cards that businesses build with CenterGet use no cookies, store nothing in the visitor's browser and do not identify the visitor.

Counting visits: every page opened and every button pressed is counted without a cookie or a visitor ID. Only daily totals are kept: the pages, what kind of site the visit came from (only the site's name, for example a search engine or a social network), whether it came from a campaign or a QR code, whether from a phone or a computer, and in what language. The IP address and the browser are read only to filter out bots and prevent flooding, and are not kept.

Contact form: what the visitor wrote is kept — name, phone or email, message, and whether they asked for updates — together with the page and language it was sent from, the browser, and a one-way hash of the IP address, from which the address cannot be recovered, to prevent spam. The inquiry goes to the business: it appears in the system, is sent to the business's people as a notification and by email, and can become a lead in its CRM.

Embedded videos: a YouTube or Vimeo video loads only after the visitor presses it, and from then on that service's privacy policy applies to it.

What the business publishes on its website and card, including testimonials and details of its staff, is the business's responsibility.

Signing up and signing in: you can sign up and sign in with a Google or Microsoft account. In that case we receive only the account's basic details — its identifier, name and email address — and keep them to recognise you the next time you sign in.

Connecting a mailbox: a business can connect its Gmail or Microsoft 365 account, so that the system sends email from it on the business's behalf: documents and quotes to customers, team invitations, sign-in codes and notifications. For that we ask for one permission, to send — at Google the gmail.send scope, and at Microsoft the Mail.Send permission (with offline_access, so that sending works when nobody is signed in).

We do not read your mailbox. We do not ask for permission to read, delete or change email, contacts, calendar or files, and we do not access them. What we keep is the connection's access token (a refresh token), in the business's settings, which are closed to the browser.

Disconnecting: you can disconnect at any time on the system's "Outgoing channels" screen. The token is then deleted on our side, and a Gmail connection is also revoked at Google. You can also disconnect from the security settings of the Google or Microsoft account. When a business is deleted from the system, access to its Gmail mailbox is revoked at Google, unless the same account is also connected to another business in the system.

CenterGet's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular: we use the permission only to send the email that the business, or the system on its behalf, sends; we do not transfer information received from Google to anyone, except as needed to provide the service, to comply with the law or to keep the system secure; we do not use it for advertising and do not sell it; we do not use it to train or improve artificial intelligence models; and no person at CenterGet reads it — except with your explicit consent, for security, to comply with the law, or when it is aggregated and anonymised for internal operations.

Backup to Google Drive: a business can back up export files to a folder in its Drive account. The permission (drive.file) gives access only to files the system itself creates, and it is kept only in the browser, not by us.

• To provide the service and run the modules the business chose.
• To contact you about the account, billing, changes to the system and support.
• To keep the system secure, prevent misuse and investigate faults.
• To charge for the subscription and issue invoices.
• To meet our obligations under the law.

We do not sell information, do not use it for advertising, and do not use the businesses' information to train artificial intelligence models. Marketing email is sent only to those who agreed to receive it, and can be stopped at any time.

Some features use artificial intelligence services of outside providers. They receive only what the action requires, without the user's name or the business's ID, and what they return is shown to a person to review before it is saved or published.

• Expense scanning: the expense document's file is sent to Google Cloud Vision to recognise its text, and the file and the text are sent to Anthropic to read its details, together with the names of the business's expense types.
• Reading production orders: the order's PDF is sent to Anthropic to be read.
• The studio — website and business card: the details the business gave about itself (name, field, services, area, audience and tone), its logo, pictures from its library, texts to rewrite and translate, and employees' photos to crop and to replace their background — are sent to Anthropic and to Google (Gemini and Veo), depending on the action. A video Google creates is kept by Google for up to two days.

Under the providers' terms, what is sent to them through their paid APIs is not used to train their models.

We use providers that process information for us, only to provide the service:

• Google Cloud and Firebase: servers, database, file storage, sign-in, notifications (Firebase Cloud Messaging), backups and error logs. The servers, the database and the files are in the Tel Aviv region (me-west1).
• Cloudflare: carrying traffic to the platform's addresses and to the addresses businesses connect, security certificates, and relay servers for remote-assistance sessions. On centerget.com, Cloudflare also counts visits — see the section on cookies.
• Anthropic and Google (Vision, Gemini, Veo): artificial intelligence, as described above.
• Inforu: sending SMS messages — the phone number and the message. In our SMS log the number is masked and the message is not kept.
• Yesh Invoice: issuing documents and recording expenses, through the business's own account — the customer's or supplier's details and the document.
• The email provider the business chose — Gmail, Microsoft 365, Resend, SendGrid or an SMTP server: the business's email is sent through it, including the invitations and sign-in links for its staff. Email CenterGet sends itself — for example to a business that has just been opened, and our messages to the businesses' owners — is sent from CenterGet's mail account at Google Workspace.
• WhatsApp (Meta): when a business connects a WhatsApp Business account — the phone number and the message.
• Zoho Assist: when a user asks for remote assistance through it, the installation and consent take place at Zoho.
• A domain registrar: when a business buys a domain through us — the holder details the registrar requires.
• GitHub: managing our development. No business's information is passed to it.

We will also disclose information when the law requires us to, to protect the rights and safety of users or our own, or to whoever acquires the business of CenterGet — subject to this policy.

Transfers abroad: some providers process information outside Israel — for example Anthropic, Google's artificial intelligence services, Cloudflare and GitHub. We choose providers that undertake to protect the information to the standard Israeli law requires.

The system uses no cookies for advertising or tracking. It keeps in the browser only what it needs in order to work: your sign-in (Firebase Authentication's), the language, the colour scheme and the state of the menu, a device that allowed notifications, a sign-up draft while you are away at Google or Microsoft, and a note of error reports already sent.

Counting visits on centerget.com: on the centerget.com website we use Cloudflare Web Analytics to count visits and measure loading speed. According to Cloudflare, it uses no cookies, stores nothing in the browser and does not track visitors across sites.

A business's information is kept for as long as the business uses the system. A business whose trial or subscription has ended is suspended, and its information is kept so that it can carry on. You can ask for it to be deleted at any time.

When a business is deleted from the system, its people's accounts, all its records and files, its website and business card, its inquiries, statistics, activity log, settings and domain orders are deleted — and access to the Gmail mailbox it connected is revoked. All we keep is the business's customer record in our own accounts, the orders and invoices issued to it, and a line in our own log recording the deletion, as the law requires accounting records to be kept.

Backups: the database is backed up every day (each backup is kept for 7 days) and every week (kept for 14 weeks). The sign-in accounts — email, name, phone, the linked Google or Microsoft account, and for an account with a password a hash of it, from which the password itself cannot be recovered — are backed up every night, and each backup is kept for 98 days. Deleted information remains in the backups until they expire, and is then deleted from them too. A deleted file is kept for another 7 days, so that a deletion made by mistake can be undone, and is then deleted for good.

Fixed periods:

• Sign-in and verification codes: 5 minutes. A customer portal session: one hour.
• A link sharing an export file: 7 days.
• Notifications that were read: 90 days.
• An inquiry marked as spam: 30 days after it was marked. Counters that prevent flooding: two days.
• The studio's recycle bin and artificial intelligence jobs: 30 days.
• A device not seen for 60 days stops receiving notifications and is deleted.
• Error reports: Google Cloud Logging's default, 30 days.

The activity log, chat, support tickets, inquiries and the statistics of the businesses' websites are kept for as long as the business exists, unless the business deletes them.

A user removed from a business is deactivated: they can no longer sign in, and their record is kept so that their name stays beside the actions they took. You can ask for it to be deleted entirely.

Every business is kept apart from all others. Every write to the database goes through the server, which checks the role and permissions of whoever asks, on every action. Keys and secrets of connections to other services are closed to the browser. Sign-in codes are stored hashed, and the number of attempts is limited. All traffic is encrypted (HTTPS).

An invitation to the system may include an initial password chosen by whoever sent it; change it when you first sign in. A file the system exports for sharing opens only through the link made for it, which carries a random key, and only for 7 days; whoever holds the link can open the file, so share it only with whoever needs it. The business's logo is public: it is shown before signing in too, for example on the sign-in page and on the website.

No system is completely immune. If a security incident affecting information is discovered, we will notify the businesses affected, and the Privacy Protection Authority as the law requires.

To support a business, CenterGet's owners can work on its devices and signage screens without signing in to its account. This includes viewing them and changing their settings, playlists, schedules, walls, ads and automatic designs.

• Management mode: every such access starts with a written reason and lasts up to an hour.
• Notice: the business's owners are told the moment it starts, with the reason.
• Record: every change is written in the business's activity log as "Platform operator", and in ours too.
• Limits: management mode gives no access to the business's customers, sales, documents or users. A business that is suspended, or does not have the module, can only be viewed.

Under the Privacy Protection Law, you may review the information kept about you, and ask for it to be corrected if it is not correct, complete, clear or up to date, or to be deleted. You can see and change most of your details directly in the system, on the profile screen.

To make a request: privacy@centerget.com. We will answer within 30 days. To protect the information, we may ask you to confirm your identity.

If your information is held by a business that uses CenterGet — for example, if you are its customer — contact the business itself. If you contact us, we will pass the request on to the business and help it handle it.

You may also contact the Privacy Protection Authority.

CenterGet is a system for business use. Whoever signs up on behalf of a business must be at least 18 years old.

We will update this policy when the system or the law changes. A new version is published here, with the date it takes effect. We will give the businesses' owners advance notice of a material change, by email or by a message in the system.

CenterGet Ltd., company no. 515685345, 444 Main Road, Tayibe, Israel.

Privacy: privacy@centerget.com. Support: support@centerget.com.