Privacy policy

Last updated: 5 November 2026

This is a translation of the Hebrew version, which governs if the two differ.

Nikuvit is a platform where businesses create and run digital punch and loyalty cards that live in their customers’ phone wallets (Apple Wallet and Google Wallet). This policy explains what we collect, why, who we share it with, and your rights.

Who this policy is for

Businesses and their staff: anyone who signs up for Nikuvit or signs in to the dashboard or the staff app. We are responsible for this data.
Customers of those businesses: anyone who joined a business’s card. We hold and process this data on the business’s behalf and on its instructions. The business is responsible for it, and its own privacy policy, linked from the card’s sign-up page, is the one that applies. See Customers of businesses.
Visitors to nikuvit.co.il.

What we collect about businesses and users

Account details: name, email address, role in the business, and password. The password is stored as a one-way hash, and we can’t read it.
Business details: name, category, address and contact details, logo, card designs and rewards, and texts you write, such as the policy and terms for your customers.
Sign in with Google or Apple: if you use it, we get your name, email address and account ID from them. We never get your password there.
Payment: card details are entered directly on Cardcom’s payment page and never pass through us. We keep only the last four digits, the expiry date, a token that allows repeat charges, and the records of payments and receipts.
Activity: actions in the dashboard and the staff app, such as adding a stamp, redeeming a reward or sending a message, and who took them.
Technical data: IP address and browser or device details, for security, blocking repeated attempts, and troubleshooting.

How we use it

To provide the service: run your account, create and update the cards, and send the messages you send to your customers.
To take payment and issue receipts.
To secure the service and prevent abuse.
To contact you about your account and about changes to the service or these terms. We send marketing only if you agreed, and you can stop it at any time.
To improve the service, based on aggregate usage data.

We don’t sell personal data, and we don’t use your customers’ data for any purpose of our own.

Customers of businesses

When a customer joins a business’s card, we store:

the details the business asks for on its sign-up form: name, phone, email or birthday (the business chooses which);
when they joined, and whether they agreed to receive updates;
the stamps, rewards and gifts on the card, and when they were added or used;
technical identifiers for the card and device, so the card in the wallet stays up to date.

The business sees and uses this data. We store and process it only to provide the service to the business. To see, correct or delete this data, or to stop messages, contact the business or us. If you write to us, we’ll pass the request to the business and help it handle it. Removing the card from your wallet stops the messages that come through it.

We share data only with providers that help us run the service, and only as much as they need:

Hetzner (Germany): the servers that run the service and the database, and the backups.
Cloudflare: serving the website and the dashboard, and protection against attacks.
Apple and Google: the wallet cards and their updates, and signing in with their accounts for those who choose it.
Google Maps: looking up the business’s address in the dashboard.
Cardcom (Israel): payment processing and receipts.

We will also disclose data when the law or a court order requires it, or when needed to protect our rights and other users. If Nikuvit is sold or merges with another company, the data will pass to the new owner, who will be bound by this policy.

Where data is stored

The database and the backups are on servers in the European Union (Germany). Some of the providers above, such as Cloudflare, Apple and Google, also process data in other countries. Transfers out of Israel follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

How long we keep data

For as long as the account is open.
After an account is closed, we delete its data within 30 days. Copies in backups are deleted within a further 30 days.
A customer the business deletes is removed from the system at once, and from backups within 30 days.
Payment records and receipts are kept for as long as the law requires, usually 7 years.

Cookies and browser storage

The nikuvit.co.il website uses no cookies and no tracking or advertising tools.
The dashboard keeps your sign-in and preferences in your browser, so you don’t have to sign in on every visit.
A card’s sign-up page sets a cookie that remembers who joined from that browser, to show them their card.
Cloudflare may set technical cookies for security.

Security

Connections to the service are encrypted (HTTPS), passwords are hashed (Argon2), the system’s keys and secrets are stored encrypted, and access to the servers is restricted. No system is completely secure. If a security incident affects your data, we’ll notify you and the authorities as the law requires.

Your rights

Under the Israeli Privacy Protection Law, you may see the data held about you, ask for it to be corrected if it’s wrong, and ask for it to be deleted. You can also edit your account details yourself in the dashboard. For any request, write to hello@nikuvit.co.il and we’ll answer within 30 days.

You are not legally required to give us any data, but without the basic details we can’t open an account for you.

Children

The service is for businesses, not children. Anyone opening an account must be at least 18.

Changes to this policy

We update this policy from time to time. We’ll announce material changes in the dashboard or by email before they take effect. The date at the top is the date of the last update.

Contact

Privacy questions and requests: hello@nikuvit.co.il

Back to home