Privacy policy

Who is responsible for the data

The business is not a public body, is not a data broker and does not process sensitive data about more than ten thousand people, so s.17B does not require appointing a data protection officer. Requests reach the contact below.

What is collected, and for what

This is the register of processing purposes. Each category is collected for the purpose written beside it, and for no other.

Who else holds the data

These are the providers that process data on our behalf. We do not sell data and do not pass it to anyone else.

• Google Cloud (Firebase, Cloud Run)Hosting, database and file storage.Stored in: me-west1 (ישראל); לצוות התמיכה של Google עשויה להיות גישה מחוץ לישראל
• PostmarkTransactional email only, with no marketing mail.Stored in: ארצות הברית
• Cloudflare TurnstileThe human check on forms open to the public.Stored in: שרתי קצה ברחבי העולם
• PaddlePrint shops' subscription payments (Merchant of Record). Card details go straight to Paddle and are never stored by us.Personal Studio subscriptions are processed through Paddle, which already processes the print shops' subscription payments. Credit card details are passed directly to Paddle and are not stored by us.Stored in: בריטניה / האיחוד האירופי
• Google Analytics 4 (Google LLC)Aggregate usage statistics of the public pages of drapress.com, only after you accept in the consent banner. No ad personalization, no Google signals, and no names, email addresses, file names or order content. The Google Ads click identifier (gclid) is kept only to attribute a visit to an ad. Retention: 2 months (Analytics property setting).Stored in: ארצות הברית (שרתי Google)
• Google Ads (Google LLC)Conversion measurement of our Google ads only, and only after you accept in the consent banner (the same answer as usage measurement). When a subscription is bought (a print shop's plan or a personal Studio plan), Google receives the amount, the currency and the Paddle transaction ID; when a print shop opens its trial, the conversion alone; with them, Google's conversion cookies in your browser. No name, email address, phone number or customer ID, no enhanced conversions, no remarketing and no ad personalization.Stored in: ארצות הברית (שרתי Google)
• Meta Pixel (Meta Platforms Ireland Ltd.)Measurement of our ads on Meta (Facebook, Instagram) only, and only after you accept in the consent banner (the same answer as usage measurement, under the text that names Meta). In the browser: a public page viewed and a landing page shown. In addition, the Drapress server reports to Meta a print shop signing up and opening its trial, a customer or designer signing up, a print request sent, and a subscription bought (the amount and currency only, with the Paddle transaction ID so it is not counted twice). With these reports go the values of the _fbp and _fbc cookies, and your email address only as a one-way hash (SHA-256). No name, phone number, address or customer ID; automatic advanced matching in the browser is off, and so is automatic collection of clicks or page content.Meta Platforms Ireland Ltd. receives the data; Meta may transfer it to its parent company Meta Platforms, Inc. in the United States and to other countries, under Meta's terms for its business tools.Stored in: אירלנד (האיחוד האירופי), עם העברה אפשרית לארצות הברית

Some data is stored outside Israel, or reachable from outside Israel for support, as listed above.

Cookies and tracking

• locale — Remembers the language you chose.
• __Host-dp_consent_analytics — Remembers whether you accepted or declined usage and ad measurement (Google and Meta), and which version of the text you answered, for 12 months.
• __Host-dp_acq — Remembers which campaign first brought you to the site (source, campaign name, the kind of landing page and the date), so we know which ads bring sign-ups. No name, email or phone number. The ad's click identifier (gclid or fbclid) is kept in it only after you accept in the consent banner. 90 days from the first visit.
• _ga — Google Analytics: a random identifier that tells browsers apart in the aggregate statistics. Set only after you accept, and kept for up to 12 months from the last visit. (requires consent)
• _ga_9RCK2DVK4N — Google Analytics: keeps the state of the current visit. Set only after you accept, and kept for up to 12 months from the last visit. (requires consent)
• _gcl_au — Google Ads: a random conversion-linker identifier, to match a purchase or a trial start to the ad that brought you. Set only after you accept, and kept for up to 90 days. (requires consent)
• _gcl_aw — Google Ads: keeps the click identifier (gclid) when you came from a Google ad, to match a conversion to it. Set only after you accept, and kept for up to 90 days. (requires consent)
• _fbp — Meta Pixel: a random browser identifier, to match a page view, a sign-up or a purchase to the Meta ad that brought you. Set only after you accept, and kept for up to 90 days from the last visit. (requires consent)
• _fbc — Meta Pixel: keeps the click identifier (fbclid) when you came from a Meta ad, to match a conversion to it. Set only after you accept, and kept for up to 90 days. (requires consent)

We also count visits to the public pages on our own servers, as a daily total per page, market and campaign, with no cookie, identifier, network address or browser details; the count does not depend on the consent banner.

In the same way we count the steps of a print shop sign-up (page shown, form started, sent or refused and why, account opened, email verified, trial started) as a daily total per step, market and campaign — with nothing you typed and no identifier.

The public pages of drapress.com run three third-party tools, all requiring prior consent: Google Analytics 4 (Google LLC) for usage measurement, Google Ads (Google LLC) for measuring our Google ads' conversions, and the Meta Pixel (Meta Platforms Ireland Ltd.) for measuring our ads on Facebook and Instagram. One answer in the consent banner covers all three; they load only after you accept, and not at all if you decline or have not chosen yet. Only after that same answer, our server also reports a sign-up, a print request and a purchase to Meta, as described below; without it, it reports nothing. An acceptance given under an earlier text keeps covering only what that text named (usage measurement alone; usage measurement and Google Ads; or also the Meta Pixel and a print shop's three events without the hashed email), until you accept the new text. The signed-in work screens send no page views; only two events are counted there, with no other detail — a print shop completing its sign-up and a print shop creating its first job — and they are sent with the generic address drapress.com/app, never the screen's own address; Google Ads conversions are sent with the same generic address, as described below. The print shops' stores and systems on their own subdomains are not measured at all. You can change your answer at any time.

What is measured: which public pages were viewed (the page address without identifiers), which site or approved campaign brought you, and the time spent; and two events with no details — a print shop completing its sign-up (shop_signup_completed) and a print shop's first job (first_job_created) — sent with nothing but the event name and the generic address drapress.com/app, never the name of the business, the customer or the job. On the landing pages, the demo and the sign-up form the funnel steps are counted too — a landing page shown (landing_view), a start button pressed (cta_click), the demo opened and used (demo_open, demo_interaction), the sign-up form shown (signup_start) and the steps inside that form (onboarding_step: an address suggested from the business name, the address found free, the form sent) — with the cleaned page address and at most one word from a closed list (which page, which button, which part of the demo or which step of the form), never the business name or the chosen address, and no detail about you. From the visit Google also derives an approximate location from the IP address, the language, screen size, browser and device; the IP address reaches Google, and Google says it does not store it. If you came from a Google ad, the click identifier (gclid) is kept too — only to attribute the visit to the ad, with no ad personalization. What is never sent: names, email addresses, file names, order or request content, and identifiers in the page address — they are replaced before sending. Google signals and ad personalization are off. The _ga and _ga_* cookies stay in your browser for up to 12 months from the last visit, and Google keeps the measurement data for 2 months (Analytics property setting). Declining or withdrawing consent deletes these cookies. In exactly the same way — the event name and the generic address drapress.com/app only, no detail at all — the sign-up, trial, subscription and first-use events of each product are sent (publisher_signup_completed, account_signup_completed, shop_trial_started, publisher_trial_started, subscription_started, onboarding_complete_shop, onboarding_complete_publisher, onboarding_complete_account, first_upload, first_pdf_check_complete, first_edition_published, first_rfq_submitted), each once per account. On the sign-up forms, "sign-up started" (signup_start) is counted only at the first use of the form, once per visit, with one word from a closed list saying which form (signup_door) — never what was typed.

Ad measurement (Google Ads): when a subscription is bought — a personal Studio plan on drapress.com, or a print shop's plan (the message is sent from the confirmation page on drapress.com that the buyer passes through right after paying) — a conversion message goes to Google with the amount, the currency and the Paddle transaction ID, and nothing else (the ID keeps the same purchase from being counted twice). When a print shop signs up and opens its trial, a conversion message goes with no detail at all. Google matches the conversion to the ad that brought you using the _gcl_au and _gcl_aw cookies in your browser, kept for up to 90 days; while sending, Google may also read its own cookies on Google's domains. What is never sent: a name, email address, phone number, customer ID or content — enhanced conversions are off. There is no remarketing and no ad personalization. Declining or withdrawing consent deletes these cookies too.

Ad measurement on Meta (the Meta Pixel and server reports): all of it only after you accept in the banner. In the browser, and only on public pages whose address carries no identifier, Meta receives that a page was viewed (PageView) and which landing page was shown (ViewContent, with one word: home, start, for_print_shops or for_publishers). In addition to the tracking code in the browser, the Drapress server reports to Meta (Conversions API): a print shop signing up and opening its trial (CompleteRegistration, StartTrial), a customer or designer signing up (CompleteRegistration), a print request sent (Lead), and a subscription bought (Purchase, with the amount and the currency only, and the Paddle transaction ID so the same purchase is not counted twice). An event sent both from the browser and from the server carries the same ID, and Meta counts it once. With the server's reports go only the values of the _fbp and _fbc cookies, and your email address as a one-way hash (SHA-256): Meta uses it only to match the event to an existing Meta account, and never receives the address itself. The server never sends a name, phone number, postal address, an ID of ours, an IP address or browser details. A print shop's purchase reaches us from Paddle with no browser involved, so to report it we keep the _fbp and _fbc values with the print shop from its sign-up; if you did not accept, they are not kept, and you can ask us to delete them. With each event from the browser Meta also receives what any website visit carries — the page address, the IP address and browser details — and it matches the event to the ad that brought you using the _fbp and _fbc cookies in your browser (kept for up to 90 days), and its own cookies if you are signed in to Facebook or Instagram in the same browser. Automatic advanced matching in the browser is off, and so is automatic collection of clicks and page content; the server sends only the hashed email. We build no remarketing audiences from it. Under Meta's terms for its business tools, Meta may also use this data to deliver and improve ads, as described in its own privacy policy. The data goes to Meta Platforms Ireland Ltd. and may be transferred to Meta Platforms, Inc. in the United States. The hashed email, a customer's or designer's sign-up and a print request are sent only if you accepted the banner's current text. Declining or withdrawing consent stops, from then on, the reports that come from your browsing, the server's included, and deletes the _fbp and _fbc cookies; to stop a print shop's purchase report too, which relies on the values kept at its sign-up, write to us and we will delete them.

Mail

We send transactional messages only: orders, approvals and account notices. There is no marketing mail, so there is no list to unsubscribe from. On the day a first marketing message is sent, it will go only to someone who ticked a separate, explicit opt-in, will carry the sender's identity and will include a working opt-out, as s.30A requires.

Inspection, correction and deletion

Anyone has the right to inspect the data held about them (s.13) and to ask for it to be corrected or deleted (s.14).

Send a request by email or phone, giving the name and the email address you used with the service. We will identify you, handle the request and answer within 30 days.

If the data was collected through a print shop's store, the print shop is the controller and we are its processor. In that case we pass the request to them and help them handle it within the same window, rather than deciding in their place.

How long the data is kept

How long each kind of data is kept. Orders and their files are never deleted on a schedule — only when someone deletes them deliberately. Everything else is kept up to 90 days, as listed:

Orders

כל עוד החשבון פעיל, או עד שהלקוח או בית הדפוס מוחקים אותן ביוזמתם

Accounts

כל עוד החשבון פעיל; 90 יום לאחר שהפך לא פעיל

System logs

עד 90 יום

Print requests

עד 90 יום לאחר שהבקשה נסגרה בלי שנבחר ספק

Data security

• Role-scoped permissions: every read and write is checked on the server, and direct writes from the browser to the database are blocked.
• Data travels over an encrypted channel, and access to files is re-checked on every request.
• Significant actions are written to an audit log: who did what, and when.
• The measures are assessed against the Privacy Protection Regulations (Data Security) 5777-2017 and updated as the system changes.

Changes to this policy

This policy may be updated. A material change will be announced in the system, and the date above will change.

See also: Accessibility statement · Terms of use