# Privacy policy Draft templates only. Professional legal review under applicable Israeli law is required before binding use. These documents are not legally approved. Draft version: 2026-11-10 / draft-4 How the BTNXIO business website processes inquiries and technical information. This draft describes the inspected implementation, not a certification of legal compliance. ## 1. Operator and contracting parties BTNXIO — Build The Next Experience is the name of an independent digital development activity. As of this draft, the activity has not yet been formally registered as a business; the brand is not represented as an incorporated company. The individual or entity contracting as provider and the customer are identified in the individual quotation and agreement. The business website is btnxio.com and the contact address is btnxio@gmail.com. No registration number, registered office or tax classification is represented by this draft. ## 2. Information supplied in an inquiry Name and email are required to use the inquiry form. Phone, package, service, preferred working method, estimated budget and project description are optional; a selected capability and language may accompany the inquiry. Providing information is voluntary, not a statutory obligation. Without name/email the form cannot process the inquiry; you may instead contact us by email and provide the details necessary for a response. Do not include confidential or sensitive information unrelated to the request, payment-card details or account credentials. ## 3. Technical and security information A request includes an IP address supplied by the hosting context, request metadata and verification tokens. The security workflow derives keyed hashes from normalized email, IP and inquiry content and uses random operation identifiers, state and timestamps to limit abuse and repeated delivery. These are pseudonymous identifiers, not anonymous data. The rate-limit store does not contain the raw inquiry, name, email or IP. Hosting infrastructure may separately process request/security logs; their exact fields and account-level retention are not established by the application code. ## 4. Purposes and limits on use Inquiry details are used to review requirements, communicate with the sender, prepare a quotation and retain appropriate correspondence about the request or an ensuing agreement. Technical information supports secure operation, bot checks, temporary quotas and duplicate prevention. The form does not enrol the sender in marketing, create a customer portal or make an automated eligibility decision about a project. No analytics, advertising pixels or cross-site marketing scripts are installed in the reviewed site. New purposes require the notice and legal basis appropriate to the change. ## 5. Processing and email recipients The prepared production architecture uses a Netlify Function for submission handling, Resend for plain-text email delivery, Upstash Redis for temporary abuse-control records and Cloudflare Turnstile for bot verification. Inquiry email is addressed to btnxio@gmail.com and uses the authenticated sender contact@btnxio.com, with the visitor’s address as Reply-To. The Gmail mailbox, email provider and persons authorized to handle inquiries can process the message and delivery metadata. Provider acceptance is not proof of inbox receipt. BTNXIO has no public inquiry database or CRM in this implementation. ## 6. Verification, browser preferences and embedded content In live mode Turnstile loads a Cloudflare script and verification frame. Cloudflare receives technical browser/network signals and a verification challenge; the server checks the token, origin-related hostname and action. The site stores theme and language preferences in localStorage and does not persist inquiry contents there or in sessionStorage. Fonts are served from local website assets. The Design Lab uses a same-origin site preview, not a third-party social feed. The capability catalog describes potential integrations; it does not itself activate them. Security storage and provider-side behavior are detailed in the cookies and tracking draft. ## 7. International processing and disclosures The named infrastructure, verification and email providers may process information outside Israel, depending on their service arrangements and the selected account region. No particular country, exclusive Israeli hosting or international certification is promised. Transfers and provider engagement must follow applicable Israeli privacy rules and suitable contractual safeguards. Information may also be disclosed where required by law, a competent authority or a lawful defence of rights, limited to what is relevant. Information is not sold through the reviewed inquiry workflow. ## 8. Actual temporary storage and other retention Accepted inquiries count toward rolling email and IP limits for 24 hours and one hour respectively. Expired entries are removed when checked and shared keys expire according to their remaining entries; the end of a counting window does not guarantee immediate deletion of every associated identifier. Verification-attempt counters expire after one minute; accepted-content duplicate pointers expire after five minutes. Operation receipts and uncertain reservations use expiries of approximately 48 hours; some retry aliases receive a fresh bounded expiry, and cleanup may include a short technical margin. These limits apply to security records, not the original email. No universal automatic deletion period is implemented for Gmail correspondence, provider delivery logs, hosting logs or backups. Those records are retained as needed for the inquiry, agreed services, lawful recordkeeping or disputes, subject to applicable law and approved provider/operational arrangements. No indefinite retention or fixed mailbox deletion promise is made. ## 9. Security and confidentiality The implementation separates server credentials from browser code, validates form inputs, limits payloads, uses a honeypot and server-side bot verification, and uses atomic shared rate limits and idempotent delivery handling. User text is sent as plain text rather than interpolated HTML. The handler does not intentionally log raw inquiry bodies; infrastructure/provider logging is separate. Access should be limited to authorized persons for the stated purpose. These safeguards reduce risk but do not guarantee absolute confidentiality or freedom from incidents. Please report suspected exposure through the contact email without sending further sensitive material. ## 10. Access, correction and personal-information requests Israeli privacy law provides rights of access and correction subject to its conditions and exceptions. To request access, correction, deletion where legally available, or information about handling your inquiry, email btnxio@gmail.com and describe the request. Proportionate identity verification may be necessary; do not send an identity document unless a suitable secure method has been agreed. Requests are considered under applicable law, including lawful retention obligations and rights of others; deletion is not an unconditional right over every record. No invented universal response deadline or automatic self-service deletion facility is represented. You may also approach the competent authority or exercise other legal remedies. ## 11. Minors, client projects and changes The inquiry service is intended for people able to enter the relevant business arrangement. A minor should involve a parent or guardian where needed, and unnecessary information about children should not be submitted. For a customer website, the customer’s own privacy notice and any applicable processing appendix govern its separate processing activities; this notice does not automatically describe every client system. Material changes to this website’s processing will be reflected in a dated notice and, where required, appropriate additional information or permission. Privacy contact: btnxio@gmail.com. ## Related drafts - [Cookies, storage and tracking policy](en-cookies-tracking.md) - [Website terms of use](en-website-terms.md) - [Conditional data processing appendix](en-data-processing-appendix.md)