Privacy Policy
How Fydelup protects your personal data
Dernière mise à jour : June 29, 2026
1. Who we are
This policy applies to the website fydelup.io and the application app.fydelup.io operated by Eytan's Ltd. ("Fydelup"), a company incorporated under Israeli law, registered under number 332382159 with the Israeli Registrar of Companies, with registered offices at Berenice , Jerusalem , Israel.
Contact: Contact@fydelup.io
2. EU Representative (Article 27 GDPR)
Pursuant to Article 27 of the GDPR, and although Fydelup is established in Israel , a country benefiting from an EU adequacy decision (see section 8) , Fydelup has designated an EU representative as a contact point for supervisory authorities and data subjects:
Eytan's, Berenice , Jerusalem , Israel
Email: Contact@fydelup.io
You may contact this representative for any question relating to the processing of your personal data, in addition to or instead of contacting Fydelup directly.
3. Two distinct roles
a) Data of Fydelup platform users (controller)
When you create a Fydelup account , as a merchant or a team member , we process your data as a data controller. This policy describes those processing activities.
b) Data of merchants' end customers (processor)
When a merchant uses Fydelup to send campaigns to their own customers, the merchant is the data controller of that data. Fydelup acts as a processor under Article 28 GDPR. End customers must contact the merchant directly to exercise their rights. This processing relationship is governed by our Data Processing Agreement (DPA).
4. Data we collect about you
| Category | Data | Source |
|---|---|---|
| Identity | Name, first name, job title | You |
| Professional contact details | Email, phone | You |
| Business data | Company name, registration number, address, industry | You |
| Login | Credentials, hashed password, login history, IP address | Automatic |
| Usage | Pages visited, features used, campaigns created | Automatic |
| Billing | Billing details, payment history | You + Stripe |
| Support | Exchanges with our support team | You |
5. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Account creation and management | Contract performance |
| Provision of Fydelup services | Contract performance |
| Billing and collection | Contract performance + legal obligation |
| Customer support | Contract performance |
| Product improvement (anonymised analytics) | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Product and marketing communications | Consent (checkbox) |
| Accounting and tax obligations | Legal obligation |
6. Retention periods
- Active account: for the duration of the contract.
- After termination: deletion within 30 days, except data retained for legal obligations (accounting: applicable statutory period).
- Login data / technical logs: 12 months.
- Marketing data (newsletter): until consent is withdrawn, then immediate deletion.
7. Who we share your data with (sub-processors)
All sub-processors are bound by contract and subject to GDPR obligations. We never sell your data.
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Base44 | Hosting, database, server functions | Israel | EU Adequacy Decision |
| Amazon Web Services (AWS SES) | Email sending | Israel (il-central-1) | EU Adequacy Decision |
| Meta Platforms Ireland | WhatsApp messaging | EU / US | Standard Contractual Clauses (SCCs) |
| Twilio / Brevo | SMS sending | US / France | SCCs (Twilio) or EU (Brevo) |
| Cloudflare | DNS, CDN, DDoS protection | US / EU | Standard Contractual Clauses |
| Stripe | Payment processing | Ireland / US | SCCs + supplementary measures |
| Sentry | Application error monitoring | Germany (EU) | Standard Contractual Clauses |
8. Transfers outside the European Union
Transfers to Israel , Adequacy Decision
Israel benefits from an EU adequacy decision (Decision 2011/61/EU, reaffirmed in the 2024 periodic review), recognising that Israel provides a level of data protection essentially equivalent to that guaranteed within the EU. No additional safeguards under Article 46 GDPR are therefore required for processing carried out by Fydelup and its sub-processors located in Israel (Base44, AWS il-central-1 region).
Transfers to other third countries (US in particular, via Meta, Twilio, Stripe, Cloudflare): governed by Standard Contractual Clauses approved by the European Commission, supplemented where applicable by additional technical measures (encryption, pseudonymisation).
Sentry: monitoring data is hosted in the European Union (Germany, Sentry's de region). As Sentry Inc. remains a US company, the relationship is still governed by the Standard Contractual Clauses.
9. Your rights
Under the GDPR, you have the following rights:
- Right of access to your data
- Right to rectification of inaccurate data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to object to processing
- Right to data portability
- Right to withdraw consent at any time
- Right to set instructions for your data after death
To exercise these rights, write to Contact@fydelup.io or to our EU representative mentioned in section 2.
You may also lodge a complaint with the CNIL (3 Place de Fontenoy, 75007 Paris, www.cnil.fr) or with the Israeli Privacy Protection Authority (PPA).
10. Security
Fydelup implements technical and organisational measures to protect your data: encryption in transit (TLS), encryption at rest for sensitive secrets, strong authentication, strict multi-tenant isolation, access logging, regular backups, least-privilege principle.
11. Applicable Israeli law
As an Israeli company, Fydelup is also subject to the Israeli Privacy Protection Law (5741-1981, as amended by Amendment 13 which entered into force in 2025), which complements , without replacing , the GDPR obligations for our EU-based users.
12. Cookies
See our Cookie Policy.
13. Changes to this policy
We may update this policy. In case of a material change, we will notify you by email or via an in-app notification at least 30 days before it takes effect.