RightFlow Privacy Policy
RightFlow is built for sensitive employment and payroll workflows. This page explains what we collect, why we collect it, how we protect it, and how we handle privacy obligations under applicable Israeli privacy law.
Privacy approach
This policy is designed to stay legible: what enters the workflow, why it is processed, who helps deliver the service, how long information is retained, and what rights you can exercise in relation to your personal data.
Data sales
Never sold
Processing
Only for requested workflows
Deletion
Support-assisted requests
Controller identity and policy status
Controller/contracting entity: [Pending counsel-approved legal entity name]; registration number: [Pending counsel-approved registration number]; address: [Pending counsel-approved business address]. Privacy contact: privacy@right-flow.com. Policy version 2026-07-02-draft is a launch draft pending counsel approval.
What we collect
We process documents and information you upload or provide through the service, such as employment contracts, payslips, pension statements, Keren Hishtalmut statements, account details, contact details, and workspace activity needed to operate the service securely and reliably.
Why we process it
We use your data only to extract contract terms, compare payroll obligations against actual contributions, generate discrepancy reports, support the workflows you explicitly request, secure the platform, troubleshoot issues, and maintain service quality.
Data sharing
We do not sell your data. We share it only with infrastructure, hosting, storage, security, analytics, and processing providers needed to deliver the service securely and reliably, and only under contractual, technical, and organizational safeguards appropriate to the sensitivity of the data.
Retention and deletion
Documents and extracted data are retained while your workspace is active and for a limited period afterward where needed for backup recovery, security monitoring, legal compliance, fraud prevention, or dispute handling. You can request deletion through support, subject to legal, security, and operational retention requirements.
Legal basis, database duties, and Israeli law
The applicable legal basis for each processing purpose, database registration or notification duties, security classification, direct-mail rules, and cross-border safeguards must be confirmed by Israeli counsel against the final business model and data volumes. Product configuration does not itself establish legal compliance.
Your rights
You may request access to personal data about you, ask us to correct inaccurate or incomplete information, and request deletion where legally and operationally possible. We may retain information where required to comply with law, protect legitimate interests, maintain security, or resolve disputes. Requests can be submitted through support.
International processing and cross-border transfers
Hosting, authentication, OCR, AI, email, monitoring, abuse-prevention, analytics (after choice), and payment providers may process data outside Israel. The final provider list, regions, transfer mechanism, and contract/DPA review status must match the processor register before launch.
Cookies, analytics, and marketing choices
Essential storage supports authentication, security, consent proof, and core workflows. Analytics, marketing/advertising, and optional functional integrations default to off and can be changed through the permanent privacy-preferences control. Declining optional categories does not block the core service.
Data controller details and contact
If you have questions about this policy, want to exercise a privacy right, or need help with a deletion or correction request, you can contact us using the support and security channels listed below. If RightFlow operates through a specific legal entity for your workspace or contract, that entity will be the relevant contracting party and controller for the applicable processing relationship.