Privacy

Who controls the data

Elinor Gini (אלינור גיני), operating as Eli Eyebrows / אלי גבות, Herzliya. Data controller: Elinor Gini. For privacy, access/deletion and cancellation requests: 050-652-1206. You can also contact us on Instagram @_eli_eyebrows. This policy addresses the Israeli Privacy Protection Law 5741–1981, including Amendment 13, effective 14 August 2025.

A cancellation reason you write is shared only with Eli and deleted with your account.

What we collect

First and last name, phone and email; appointments, chosen treatments, agreed prices and booking terms; change and cancellation requests, waitlist preferences; payment records entered manually by Eli; sign-in details, consented account-contact associations and security activity records. Marketing choices and the time of consent are also recorded. A note (up to 500 characters) that Eli may write when she approves or declines a change or cancellation request; it is shown to you in the request details and included in the copy of your data you download from your account. Do not enter medical or allergy information or private treatment photographs.

When you sign in, your IP address and browser/device type are stored with the session for security and abuse prevention, and are removed when the account is deleted.

To prevent repeated emails, a hashed (non-readable) identifier of your email address is kept for up to 24 hours, not the address itself.

How we use it

To book and manage appointments, send reminders, let Eli contact you about appointments, track payments and protect accounts. Providing account details is your choice, but a name, phone and email are required to book for yourself. Marketing is sent only after a separate, explicit choice: the checkbox starts unticked and the choice is recorded with a timestamp. The sender is Elinor Gini, with the display name “אלי גבות”. Marketing is sent by email. Every marketing email includes a secure, personal, signed unsubscribe link; you can also ask Eli to withdraw consent. Consent is not required to book.

Providers and calendar

The calendar updates through a private, secret subscription link; Google fetches the link's content in order to show it.

Transfers abroad are made to providers bound by data-processing agreements (Cloudflare, Google, Resend), in line with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

Cloudflare hosts the site and data. Account and booking emails are sent through Resend (Plus Five Five, Inc., USA), which processes the information needed to send them. The site runs on Cloudflare (Workers servers, D1 database and R2 file storage). Cloudflare keeps technical request logs for the site (such as IP address and browser type) for security and operations. Messages sent to hello@elieyebrows.com are routed through Cloudflare Email Routing and forwarded to Eli’s Gmail inbox (Google); the message, sender name and address are also stored there. Do not send medical information or card details to this address. Eli can view appointments in Google Calendar through a private calendar link. You sign in to the website with email and password.

The studio’s private, dedicated Google Calendar shows your booking time, treatment (including an extra, if selected), booking reference and first name only. Only Eli sees the calendar. Your first name is trimmed and limited to 30 characters. Your last name, phone and email are not sent to the calendar. The site shows Herzliya only. The full street address is shown to you when signed in, on the booking review step before confirmation and on your booked appointment, and sent in your booking confirmation and reminders, and never appears on the public site or in the calendar title.

Processing may take place outside Israel: Cloudflare and Google are US companies, and data may be processed in the United States and other countries where they operate. Resend processes the information needed to send account and booking emails in the United States under a binding data-processing agreement. Contact Eli for details of processing locations and transfer arrangements. The website never charges cards or stores card details.

Client photographs, including before-and-after photos, are published only with the client’s consent and removed on request. Contact Eli using the details above.

How long we keep it

Payment and bookkeeping records are kept for 7 years, as tax law requires. Other client data is kept for at most as long as you are an active client plus 3 years; erasure after that is a manual review by Eli, not automatic.

The retention policy appears in your account before a deletion request. Removing a login account does not necessarily erase business history: appointment and payment records may remain under the policy and applicable law. Reaching a retention date does not promise automatic erasure. Contact Eli about backup and provider-copy retention periods and end-of-retention handling.

Access, correction and deletion

You can request access and correction under applicable law. In your account, update your name and phone or choose “Download a copy of my data”. You can request account deletion or contact Eli using the details above. We will respond to privacy and access requests within 30 days; a refusal of an access request will be given within 21 days. Requests are reviewed; future appointments, records that must be kept may need separate handling. Contact Eli about changing an email or a linked contact. To report a privacy concern, use the Privacy Protection Authority website and public-inquiry channels (Hebrew), with a description and relevant documents; never send passwords.

Cookies and browser storage

This site does not use advertising, analytics or tracking cookies and loads no third-party services for that purpose, so no cookie consent is needed. Storage is limited to what the service you asked for requires:

• A secure (HttpOnly) sign-in cookie keeps you signed in and protects your account.
• An account-deletion cookie lets you continue a deletion request from the same browser.
• Local and session storage hold your language, light/dark mode, accessibility-menu settings, and recovery details for an unfinished booking, sign-up or action, including a change or cancellation request and accepting or declining an offered time. To return from the email link, your email address and your updates choice are kept in the browser for up to 24 hours. This does not confirm a booking or hold a time.
• Eli’s screens store sidebar and calendar display preferences, and choices and details for unfinished owner actions, such as changing opening hours, moving and cancelling appointments, appointment series, offering times and recording payments.
• A cache holds only the static "offline" page, with no personal data.

This data stays on your device and you can clear it in browser settings; blocking it may prevent sign-in or recovery. On a shared device, sign out when you finish. Cloudflare, which hosts the site, may use technical security cookies.

Clients under 18

There is no blanket age restriction or date-of-birth field on this site. Booking does not automatically establish that a minor can consent to every data use, commitment or treatment. Parent or guardian involvement may be needed depending on age, circumstances and treatment. Contact Eli before sharing information or booking if needed; do not enter medical information here.