Itutin privacy policy

Last updated: 17 September 2026

What this policy covers

Itutin is a service by Israsky that sends events from a client's website to that client's Meta and Google ad accounts. This page explains what data passes through the service, who is responsible for it, how long it is kept and how to reach us.

There are two kinds of data in the service, and different people are responsible for each:

• Data about the client of the service, meaning the business that signed up for Itutin and the people acting for it. We are the controller of this data, and this policy applies to it in full.
• Data about visitors to the client's website, meaning people who filled in a form or placed an order. The controller here is the client, the website owner. We hold this data for them and act on their instructions, under Regulation 15 of the Protection of Privacy (Data Security) Regulations, 2017. A visitor should first approach the owner of the site where the form was filled in; if they write to us, we help the owner handle the request and answer ourselves on whatever depends on us.

Who is responsible and how to contact us

The service is run by Israsky (Ilia Shuliak, licensed dealer עוסק מורשה 324648047, Petah Tikva, Israel).

For anything to do with data, including access, correction and deletion: it@israsky.com.

What we collect about the client of the service

You give this data voluntarily; no law obliges you to. Without it the account cannot be opened and the service cannot run, and that is the only consequence of refusing.

We do not sell this data and do not pass it to anyone for their own purposes. It only goes to the suppliers without which the service does not work: our servers in Germany, our billing system, the email service we correspond with you through, and the credit card company when you pay by card. If the law requires us to hand data to a competent authority, we comply.

Data about visitors to the client's website

When a visitor submits a form on our client's website or places an order, the site passes the event to us and we send it to that client's ad accounts.

What goes to Meta and Google: hashed values (SHA-256) of the phone number and email, that is a code computed from them that the contact cannot be recovered from; the click identifier received in the page address; the browser and device details the form was submitted from (the User-Agent string), because without them the advertising system does not register a website event; the event itself, its time and an internal event identifier; for a purchase, the order total as well.

What never goes: the name, the text of the enquiry, the list of items purchased and payment details. The IP address is not sent either.

The basis for the transfer is the notice under section 11 of the Protection of Privacy Law shown to the visitor in the form; the basis for the transfer outside Israel is regulation 2(8) of the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 2001. The recipients are Meta Platforms Ireland Limited (Ireland) and Google Ireland Limited (Ireland).

• If a form carries no notice, Itutin sends no events from it.
• Page views are sent only if the visitor accepted marketing cookies. Without consent they are never sent.
• Declining marketing cookies does not cancel the enquiry transfer itself: that rests on the notice in the form.
• A transfer that has gone out is irreversible: what has reached Meta or Google cannot be recalled, and a request about it is made to them directly, through their own forms.
• A visitor may object to the transfer, and we then stop sending events about them.

How long data is kept

• The identifying data needed for the transfer (hashes, click identifier, browser details) is erased once the transfer is finished, and no later than seven days after the event.
• Backup copies live for up to 14 days. If anything is restored from them, the deletion is applied again.
• After deletion a technical marker remains, recording that the event has already been sent, with no contact details. Its only purpose is to keep the same event from going to the same ad account twice. A single event, such as a purchase or an enquiry without a lead number, is marked for 37 days; an enquiry with a lead number and its stages, for 12 months. If the transfer never went out, the marker is removed at once.
• The delivery log records what happened to each event, with no contact details.
• Data about the client of the service is kept while the account is active and deleted within 90 days after it is closed. Billing and accounting documents are kept for as long as the law requires.
• When an account is closed, that client's technical markers are deleted the same day.
• The access log of the service systems, which holds the records of sign-ins to the panel and of actions taken in it, is kept for at least 24 months: Regulation 10(d) of the Protection of Privacy (Data Security) Regulations, 2017 requires that of databases at the medium and high security level. Closing an account and a deletion request do not override that period.

Access to Meta and Google

When you connect your Meta account, we receive permission to see your ad accounts and datasets, so that you can choose where events go, and to send events there. We do not read the content of your campaigns, do not pull audience lists and do not reach into your personal profile beyond the name and picture that Meta's login screen provides.

When you connect your Google Ads account, we ask for one permission: to send conversion events to the account you chose, through the Data Manager API.

Data received through Google APIs is used only to run this service for you. It is not sold, not passed to others for their purposes, not used for advertising and not used to train models. Humans do not read it, except where that is needed to investigate a fault you reported, to keep the service secure, or where the law requires it.

Itutin's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

Access tokens are stored encrypted. You can disconnect Itutin from your Meta or Google account at any time, and the transfers then stop. The steps are on the data deletion page.

Security

The data sits on our own servers in Germany (European Union). Access is limited to those who need it for their work and is written to a log; connections are encrypted and the systems are patched and monitored.

Perfect security does not exist and we will not promise it. What we do promise: a security incident affecting a client's data is reported to that client straight away, and no later than 24 hours.

Your rights under the law

• To see the data held about you (section 13 of the Protection of Privacy Law).
• To demand correction or deletion of data that is incorrect, incomplete, unclear or out of date (section 14). If we refuse, we explain why, and you may apply to the court (section 15).
• To be removed from a direct mailing database (section 17F).
• To object to events about you being transferred to advertising systems.

Write to it@israsky.com. We reply within 30 days, the period set by Regulation 2 of the Protection of Privacy (Conditions for Inspection of Data and Procedure for Appeal against a Refusal of a Request for Inspection) Regulations, 1981. What exactly is deleted and what remains is set out on the data deletion page.

Children

The service is made for businesses. We do not knowingly collect data about children under 16. If such data reaches us, we delete it.

Changes to this policy

If the policy changes, we update the date at the top of the page. A material change is written out here and sent to clients by email, not slipped in quietly.

Governing law

This policy and the service are governed by the law of the State of Israel.