Privacy policy
Last updated: 2026-08-11
This document was written from the statutory requirements and has not yet been reviewed by a lawyer. It describes accurately what the system actually does, and will be updated once reviewed. Questions to [email protected]
This policy explains what Shuldex collects, why, who it is shared with, and what you can ask us to do about it.
1. Who we are
Shuldex operates the service and holds the data. The institution that entered the data owns the database. Privacy enquiries: [email protected]
2. What we collect
From the institution and its staff: name, email address, phone, role and a hashed password.
About community members, as entered by the institution:
- Full name, father’s name, address, phone and email
- Pledges, donations, payments and balances
- Aliyot, seats and personal events on the Hebrew calendar
From use of the system: IP address, browser type, and an audit record of actions taken, for security.
We do not collect or store card details. Those go directly to the payment processor.
3. What it is used for
Running the service for the institution: managing members, computing balances, issuing receipts and sending reminders.
Security and prevention of misuse.
Support, when you contact us.
We do not sell data, do not pass it to advertisers, and never use one institution’s data for another.
4. Who receives it
Infrastructure and service providers only, and only as far as running the service requires:
- Hosting and database servers
- An outbound mail provider, for receipts, reminders and sign-in codes
- A payment processor, when a payment is made
- Any service the institution itself chose to connect in settings
Any further disclosure is made only where the law requires it or you have agreed to it.
5. Your rights
Under the Protection of Privacy Law you may see the data held about you, ask for it to be corrected, and ask for it to be deleted.
A community member should ask their own institution first, as owner of the database. If the institution is unreachable, contact us and we will help.
Requests are answered within a reasonable time and no later than the law requires.
6. Security
Traffic is encrypted with HTTPS. Passwords are stored as a one-way hash and cannot be recovered.
Third-party credentials entered by an institution are sealed with AES-256-GCM and cannot be read back after saving.
Access to an institution’s data is limited to that institution’s users, enforced on every query at the server.
7. How long it is kept
For as long as the account is active. After an account is deleted the data is deleted, except what the law requires us to keep — accounting records, for instance.
8. Cookies
We use strictly necessary cookies only: your session and your language preference. There are no advertising cookies and no cross-site tracking.