Homi

Privacy Policy

2026-08-29-draft-1 · 29 August 2026

Draft. Describes the data the system actually collects, but not yet reviewed by a lawyer. Not legal advice.

This document explains what personal data Homi collects, why, who it is shared with and how long it is kept.

Data controller: Sagi Katz (sole trader; no company registered yet). For anything concerning privacy: contact@gethomi.co.il.

1. What we collect

Only what the service needs to work:

  • Account: email address, display name, and a password stored only as a hash (we never store the password itself).
  • Booking: the treatment address — where the professional travels to — plus time, service and price.
  • Professional profile: name, headline, description, service area, coordinates derived from it for distance search, and work photographs.
  • Reviews: the rating and text you wrote, shown on the professional's profile.
  • Arrival channel: how you first reached the site (source, medium, campaign, landing page).
  • Cookies: an encrypted session cookie, and a small cookie remembering your arrival channel.
  • Consent records: which version of these documents you accepted and when. We deliberately do NOT store an IP address or browser fingerprint alongside a consent.

2. Why we collect it

Every piece of data has a stated purpose:

  • Running your account and signing you in.
  • Creating and confirming a booking, and giving the address to the professional travelling to you.
  • Operational messages about a booking — requested, confirmed, cancelled, expired.
  • Searching for professionals by area and distance.
  • Displaying ratings and reviews.
  • Understanding, in aggregate, which channels people arrive through.
  • Security, preventing misuse, and meeting legal obligations.

3. Is providing it required?

Providing your data is voluntary — no law compels you to give it. But without it we cannot provide parts of the service: no email means no account, and without an address we cannot send a professional to your home.

Data that is not necessary, such as a personal description on a profile, may be left out.

4. Who we share it with

We do not sell personal data and do not pass it to advertisers. We use the following processors, each for a stated purpose:

  • Railway — server and database hosting. Region: EU West.
  • Resend — sending operational email. Region: Ireland.
  • Cloudflare R2 — storing professionals' work photographs.
  • Google Maps Platform — turning the service area a professional typed into coordinates, for distance search.
  • When in-app payment is enabled we will add the payment processor here before switching it on, and update this document.

5. Transfers outside Israel

Some processors store data outside Israel, mainly in the European Union. We chose EU-region providers to limit transfers and to sit within a recognised data-protection standard.

6. How long we keep it

Account and booking data is kept while the account exists. Deleting your account erases or anonymises the personal data attached to it.

Data we are legally required to retain — for example accounting records, once payments begin — is kept only for the period the law requires.

7. Your rights

Under the Israeli Privacy Protection Law including Amendment 13, and where applicable the GDPR, you may:

  • See the data held about you.
  • Ask us to correct inaccurate data.
  • Delete your account and data — yourself, from the account page, without contacting us.
  • Withdraw consent to marketing email at any time.
  • Contact us with any question, and complain to the Israeli Privacy Protection Authority.

8. Security

Passwords are stored only as hashes. The session cookie is encrypted and unreadable to browser code. Traffic is encrypted. Access to personal data is permission-limited, and sensitive actions are written to an audit log.

We do not write passwords, tokens or free-text personal content into system logs.

9. Cookies

We use one cookie necessary to keep you signed in, and a small cookie remembering which channel you arrived through.

We use no advertising or cross-site tracking cookies. If we add measurement later, we will use a cookieless tool or ask for consent first.

10. Children

The service is not intended for anyone under 18. We do not knowingly collect data about children. If we discover we have, we will delete it.

11. Changes to this policy

We will update this document when needed. Each version carries a number and date at the top, and a material change requires fresh agreement.

12. Contact

For any privacy question: contact@gethomi.co.il

Privacy Policy