Privacy Notice
What data Rega collects, why, how long it keeps it and what your rights are.
Draft, pending lawyer review · Draft for counsel review. This document is not in force yet.
This document is published by Business details are provided with your order confirmation · [email protected]. The numbers in this document come straight from the system settings.
Who controls the data
Database owner (controller): Business details are provided with your order confirmation · [email protected], company/business no. , . Privacy contact: [email protected].
Privacy protection officer: Business details are provided with your order confirmation · [email protected].
What data and why
No law obliges you to give us data. You give it by choice, but without the data marked "Required" we cannot provide the service.
Photos can include sensitive data (for example children, health, location). We do not recognise faces or identify people.
| Data | Why | Must you give it? If not |
|---|---|---|
| Email and name | Account, sign-in, order emails | Required. No account without an email |
| Photos, videos and their data (date, place, camera) | Build the album, show it to people you share with, print it | Not required by law. No photos, no album |
| People's names, answers, captions | Write the story | Optional |
| Delivery address and phone | Print and ship | Required to order. Without it we can't ship |
| Support messages | Answer you | Optional |
| Usage data without content | Improve the service and keep it secure | Only with your consent; change it in Cookie settings in the footer |
| Order and payment details | Invoice and tax duties | Required by tax law |
AI
Rega uses a model by Anthropic to choose photos and suggest questions. The model receives small thumbnails, dates, place names and your answers. It does not receive emails, phone numbers, addresses, file names or original files. Business details are provided with your order confirmation · [email protected]
Who receives the data
We do not sell data. Data goes only to providers that process it for us under contract:
The full list is on the Subprocessors page.
- Prodigi (UK) and its print labs and carriers, in Business details are provided with your order confirmation · [email protected]: the album file; name, address, phone and email for delivery.
- Resend (US): email address, to send app emails.
- PostHog (EU region): usage events without content or cookies, plus technical device data (IP address not stored).
- Anthropic (US): as above.
- Hosting provider: Business details are provided with your order confirmation · [email protected].
- Forward Email and Google: emails you send us.
- Authorities, where the law requires.
Transfers abroad
Some providers are outside Israel. Transfers follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001:
- UK and EU countries: laws giving protection not lower than Israeli law Business details are provided with your order confirmation · [email protected].
- US: the provider's written commitment to protect the data and not pass it on Business details are provided with your order confirmation · [email protected].
How long we keep data
See the retention table Business details are provided with your order confirmation · [email protected]. Order and tax records: .
| Data | Kept for |
|---|---|
| Sign-in codes | 30 days |
| Ended sessions | 90 days |
| Thumbnails, the album and the story | While the workspace is active |
| Originals of selected photos | 90 days after the story's last order ships. If no album was ordered: 180 days after the last activity. A notice goes out 14 days before. |
| Print PDFs | 730 days |
| Print provider events, without recipient details | 90 days |
| Email send log, without recipient or content | 365 days |
| Audit log, without content | 730 days |
| Support attachments | 180 days after the case closes |
| A deleted workspace | Purged 30 days after deletion |
| Backups | 7 days of point-in-time recovery, plus 30 days of weekly backups. A deletion reaches the backups when they expire. |
Your rights
- See your data (s.13 of the Law) and download a copy from settings.
- Ask us to correct or delete data that is wrong, incomplete, unclear or out of date (s.14).
- Delete a workspace. Deletion happens after 30 days.
- Opt out of marketing. We send no marketing email.
- Write to [email protected]. We answer within Business details are provided with your order confirmation · [email protected] days. If we don't, you can contact the Israeli Privacy Protection Authority.
- EU visitors also have GDPR rights, including to object and restrict processing, and to complain to your local authority. Business details are provided with your order confirmation · [email protected]
Measurement and cookies
The rega.work site sets no cookies. Only if you agree in the banner, we count visits and clicks with PostHog (EU region), without cookies, without storing your IP address and without a personal profile. Your browser sends PostHog technical data such as device and browser type. You can change your choice any time ("Cookie settings" in the footer). The app uses essential cookies only. Details are in the Cookie statement.
Children
You must be 18 or older to use Rega. Photos of children stay private by default and are not indexed by search engines.
Security and incidents
We protect data under the Privacy Protection (Data Security) Regulations, 2017. Delivery addresses are stored encrypted. If a severe security incident happens, we report it to the Authority and tell you where the law requires. Found a problem? Write to [email protected].
Changes
We email you about material changes. Last updated: Business details are provided with your order confirmation · [email protected].