Privacy Policy
This is an English translation provided for convenience. The Hebrew version is the legally binding version. In any conflict, the Hebrew version prevails.
Last updated: 14 September 2026
This policy explains what personal information is collected on the Moadon platform (the "Service"), why, with whom it is shared and what your rights are, in accordance with the Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות), including Amendment 13, and the regulations issued under it. The terms "Operator", "Community Owner" and "Community Member" are defined in the Terms of Use. References in the masculine form are for convenience only.
1. Definitions
1.1. "Personal information" - information about an identified or identifiable person, as defined by law.
1.2. "Processing" - any operation on personal information, including collection, storage, use, transfer, disclosure or deletion.
1.3. "Controller" - the party that determines the purposes of processing a database. "Holder" / "Processor" - the party that processes information for the Controller and according to its instructions.
2. Who is responsible for the information
2.1. The Operator is the Controller of information about user accounts (registration, sign-in and profile), information about Community Owners' platform subscriptions, security logs, Moadon's own mailings and website browsing data.
2.2. The Community Owner is the Controller of information about members of their community created within the community: community membership, community subscriptions and payments to the Community Owner, activity and progress in the community, notes and tracking maintained by the Community Owner, and mailings they send. For this information, the Operator acts as a Holder, acting for the Community Owner and according to their instructions, in accordance with the Data Processing Agreement (DPA).
2.3. A Community Owner may publish their own privacy policy, displayed on the community page and linked from the payment page. Inquiries about a particular community's information may be addressed to the Community Owner or to us, and we will forward them to the Community Owner and assist in handling them.
3. Information we collect
3.1. Information you provide:
- Registration details - name, email address and password (stored as a one-way hash), or name, email and profile picture when signing in with Google.
- Profile details - username, picture, biography, and phone number if you choose to provide it or the community requests it.
- Consent records - the date/time of acceptance of the Terms of Use, and the date/time, source and IP address of consent to mailings.
- Content - posts, comments, files, private messages, responses to polls and quizzes, event attendance confirmations and support inquiries.
- Payment details - transaction details such as amount, date/time, status, transaction IDs and an invoice link. We do not store full card numbers or CVV codes.
- Additionally, for Community Owners - connection details for a payment processor, email server and connected services (Zoom, Google), which are stored encrypted, and API keys they have created.
3.2. Information collected automatically:
- Activity and progress - lesson completion, lesson viewing time, last activity date/time, points, levels, badges, streaks and leaderboard position.
- Technical data - IP address, browser and device type, and operating system.
- Security logs - sign-ins and administrative actions (actor, action, target, date/time and IP address).
- Cookies and local storage - see the Cookie Policy.
4. Legal basis for processing
4.1. Performance of a contract - processing required to provide the Service (account, communities, courses, events and payments).
4.2. Consent - for example, to marketing mailings and analytics cookies. You may withdraw consent at any time, as detailed in section 10.
4.3. Legitimate interest - information security, prevention of fraud and abuse, and improvement of the Service, to an extent that does not disproportionately infringe your privacy.
4.4. Legal obligation - such as retaining records for tax purposes or responding to an order from a competent authority.
5. Purposes of using the information
- Providing the Service: account, communities, courses, events, messages and notifications.
- Providing management tools for Community Owners: member lists, subscriptions, analytics, alerts about members whose activity has declined, and member mailings.
- Managing the engagement system (points, levels, badges and leaderboard).
- Operating AI features that the user or Community Owner has chosen to use.
- Processing payments, cancellations and refunds, and checking the accuracy of charges.
- Information security and prevention of fraud and abuse.
- Sending system messages and marketing mailings to those who have consented.
- Complying with legal requirements.
7. Transfer of information outside Israel
Some service providers store or process information outside Israel, mainly in the USA and the European Union. In accordance with the Protection of Privacy Regulations (Transfer of Information to Databases Outside the State's Borders), 5761-2001 (תקנות הגנת הפרטיות (העברת מידע אל מאגרי מידע שמחוץ לגבולות המדינה)), we work to ensure an adequate level of protection through one or more of the following: transfers to countries with a recognized level of protection; entering into data processing agreements; and reviewing providers' privacy policies and security measures.
8. Information security
- Password hashing using bcrypt.
- Encryption of data in transit (TLS) throughout the website, including WebSocket connections.
- Permission-based access control and separation between communities, so that a Community Owner sees only their own community's members.
- Optional two-factor authentication for the account.
- Encryption of secrets (payment processing, email server and two-factor authentication details) at rest.
- Request rate limiting, bot protection and an administrative action log.
No security method is completely immune to threats, and we act in accordance with accepted standards to protect information.
Serious security incident
- We will report to the Privacy Protection Authority as required by law.
- We will notify affected individuals by email, to the extent required, and Community Owners whose members' information was affected, detailing the incident, the type of information and the steps taken.
- We will take reasonable steps to reduce harm and prevent recurrence.
9. Information retention period
| Information type | Retention period |
|---|---|
| Account details | For as long as the account is active, and up to 30 days after a deletion request |
| Content published in a community | For as long as the account is active; after deletion, removal or display as "Deleted user" |
| Private messages | For as long as the parties' accounts are active; deleted when the account is deleted |
| Engagement and progress data | For as long as the account is active; deleted when the account is deleted |
| Payments, invoices and refund requests | Up to 7 years, in accordance with tax and consumer protection laws |
| Consent records (terms and mailings) | For as long as required to prove consent, and up to 7 years |
| Technical data and security logs | Up to 12 months |
10. Your rights
- Access - to review your personal information held by us.
- Correction - to request correction of incorrect, incomplete or outdated information.
- Deletion - to request deletion of information and/or closure of the account.
- Objection - to object to a particular use, including direct mailings, at any time.
- Portability - to receive a copy of the information in a machine-readable format (JSON).
- Withdrawal of consent - at any time, without affecting the lawfulness of processing carried out until then.
Information export and account deletion requests are available in Privacy Settings. For any other inquiry, write to privacy@moadon.io, and we will respond within 30 days. A request concerning a particular community's information will be handled together with the Community Owner, as stated in section 2.3.
Not providing information
Providing information is voluntary, but without a name and email address you cannot open an account, without payment details you cannot join paid communities, and blocking essential cookies will prevent sign-in.
11. Minors
The Service is intended for people aged 18 and above, and we do not knowingly collect information about minors. If we learn that a minor has opened an account, we will delete it. You may report this to privacy@moadon.io.
12. Marketing mailings (section 30א of the Communications Law (חוק התקשורת))
12.1. Marketing mailings, whether from Moadon or a Community Owner, are sent only to those who have given explicit prior consent through a separate checkbox that is not preselected.
12.2. Every marketing mailing is marked with the word "פרסומת" (Advertisement) in the subject line and includes an immediate unsubscribe link that does not require sign-in.
12.3. Consent records (date/time, source and IP address) are retained as evidence of compliance with the law.
12.4. You can manage email preferences in Notification Settings or through the unsubscribe link in each message.
12.5. System messages (password resets, receipts, account verification, registration and cancellation confirmations, and renewal reminders) are not advertisements and are sent without requiring separate consent.
13. Data Protection Officer
- Name: Peleg Dror
- Role: Data Protection Officer (DPO)
- Email: privacy@moadon.io
- Maximum response time: 30 days from receipt of the inquiry
If you believe your privacy has been infringed and you have not received a satisfactory response, you may submit a complaint to the Privacy Protection Authority.
14. Changes to the policy
We may update this policy in accordance with legislative changes or changes to the Service. Material changes will be published on the website and/or sent by email to registered users.
15. Contact
- Privacy: privacy@moadon.io
- Support: support@moadon.io
- Address: Peleg Dror, 8 Yitzhak Sadeh, Tel Aviv