Privacy policy
What Yesslip collects, why, how it is kept and who it is passed to. This policy covers the site and the system, and complements the terms.
Last updated: 2026-11-05
Who collects it
- Registered name
- רועי בן יוסף, no. 066360306
- Address
- ארלוזורוב 13, גבעתיים
- Phone
- 054-585-8028
- [email protected]
The service is operated by the business named above. For any question about the data, its use or its deletion, reach us through those contact details.
Whose data it is
Data about parents and children belongs to the business they registered with: it collected the data, it decides what to collect, and we hold and process it for that business and on its instructions. A parent’s request to see, correct or delete their data goes to the business, and we help it act on the request.
Data about the business itself — who signed up, the contact details, the package and the charges — is collected by us in order to run the subscription.
What is collected
From the business: its name and the name of whoever signed up, an email address and the Google account id used to sign in, the contact details the business chose to show on its sign-up page, and its package and charges.
From a parent, on the business’s sign-up page: name, ID number, phone and email; the child’s name and school year; and answers to the questions the business defined — including sensitivities and allergies, a health declaration, and who is allowed to collect the child.
As evidence of a signature: the image signed with a finger, the time it was signed, the exact wording that was signed, and the IP address it came from. These are kept so that it can be shown what was actually agreed, and for nothing else.
Card details are neither collected nor stored by us, for a business or for a parent. They are entered on the payment provider’s own page, and all we receive back is an identifier.
What it is used for
To run the service: register participants, produce documents and invoices, collect the payments a business set up, show a business its rosters, and provide support.
To meet legal duties, including keeping documents for accounting and tax purposes, and to protect against abuse and fraud.
Not for advertising, not sold, not passed to a third party for that party’s own purposes, and not used to train models.
How it is kept
Everything in transit is encrypted. Each business has its own encryption key, itself encrypted, and every secret of that business is encrypted with it — so deleting the account makes any encrypted copy of it unreadable.
The separation between businesses is enforced by the database itself and not only in code: one business’s rows are invisible to another business’s request.
Signed documents are kept in separate storage, and each is reachable only through a link carrying its own token. ID numbers and phone numbers are not written to the logs.
Who it is passed to
Only to the providers the service runs on, and only in order to run it: Morning and its payment provider, for documents and collection; Google, for sign-in; the hosting and database provider; and the document storage provider.
Beyond that it is passed on only where the law requires it, or with consent.
How long it is kept
For as long as the account is active. Signed documents and charges are kept after a subscription ends, for as long as they may be needed as evidence or for tax purposes: seven years, and for a minor, seven years from their eighteenth birthday.
Deletion at a business’s request removes the account and everything that depends on it. It is done on a request through the contact details above, and we confirm in writing when it is complete.
Your rights
Under the Privacy Protection Law you may ask to see the data kept about you, to have anything incorrect corrected, and to ask for it to be deleted. We answer such a request within 30 days.
A parent who registered for an activity should approach the business they registered with, which owns the data; if the request reaches us, we pass it on to that business and say so.
Security incidents and changes
A serious security incident is reported to the Privacy Protection Authority and to the businesses affected, as Amendment 13 to the Privacy Protection Law requires.
If this policy is updated, the date at the top of the page changes, and a material change will be notified.