Privacy policy — HEDD

HEDD is run by Lior Meir, licensed sole trader (Israel) no. 040535239. Privacy requests: lmeir2110@gmail.com.

The PR firm that uses HEDD decides whom to monitor, for which clients, and what they receive, so the firm controls the data; HEDD processes it on the firm’s behalf and on its instructions. [For legal review: the terms under Amendment 13 of Israel’s Privacy Protection Law]

• Firm staff and client contacts: name, email, role, a password stored only as a one-way hash (argon2id), sign-in times and failed attempts, IP address and browser on sign-in and on logged actions, and for client contacts a record of each email sent to them. To sign in securely, apply permissions, keep an audit trail and deliver reports and alerts.
• Phones linked to HEDD’s WhatsApp number: the number, only when its owner linked it by sending a code from that phone; screens always show it masked. To know who sent a message, and to send the weekly report to those who asked.
• Messages staff forward to HEDD’s WhatsApp number: a link, an alert’s text or a photo of a newspaper page, read once. Only facts (client, outlet, day, page) and the link are kept on the item; the message’s words, the photo, the WhatsApp name and the group are not stored. One line per message records when, from whom, what kind, and what was done. HEDD joins no groups.
• Alert emails a firm forwards to HEDD (only if the firm turned it on): read once, only the facts of each appearance are kept, and the email is deleted right after.
• People named in publications (journalists, spokespeople, public figures): the byline and names in a headline, excerpt or quote; for a podcast the firm asked to monitor, the audio for the time of the work only, then just the passage around the client’s name.
• A firm’s list of journalists: the byline and bylined pieces, and the work contacts, beat and notes the firm types in, seen by the firm’s staff only.

Cookies: one sign-in cookie, to keep you signed in. No advertising or tracking cookies.

We do not collect ID numbers, payment details, health data, or profiles of people beyond what the media published.

On HEDD’s servers at Amazon Web Services in the Israel (Tel Aviv) region: server, database, files and backups. Connections are encrypted (HTTPS); access is by role, firms and clients are fully separated, passwords are hashed and an account locks after 8 failed attempts.

• Amazon Web Services and Amazon SES (Israel, Tel Aviv): hosting and email delivery.
• Anthropic (USA): AI analysis of headlines, short excerpts, client names and search terms; a forwarded WhatsApp message or alert email, once.
• Google (Gemini, paid service): transcription of podcasts a firm chose to monitor — the audio and the client names as hints. Under Google’s paid terms the content is not used for training.
• Google (YouTube): search terms only, when YouTube search is on.
• Meta Platforms Ireland (WhatsApp Business Platform): HEDD’s WhatsApp number — forwarded messages and photos, linked phone numbers and the weekly report. Meta keeps message content and media for a limited time under its own terms. [For legal review]

HEDD does not sell the data, share it beyond these sub-processors, or use it to train AI models. Anthropic, Google and Meta may process it outside Israel, each for the purpose above only. [For legal review: the basis for transfers abroad]

• Accounts: until the firm deletes them. Expired sign-ins and email-delivery records are not yet deleted automatically, and the audit log cannot be changed or deleted. [For legal review: retention periods]
• Excerpts and quotes from publications, podcast passages and the journalist list’s pieces: deleted after 90 days.
• WhatsApp: message words and photos are never stored by HEDD; each message’s log line is deleted after 90 days; a linked number stays until it is unlinked or removed.
• Backups: nightly copies are deleted after 30 days.

You may ask to see the data about you and to correct it (sections 13 and 14 of the Privacy Protection Law, 1981). Write to the firm, or to us at lmeir2110@gmail.com, and we will pass the request on and help the firm answer. You can unlink your own phone in “My profile”. For deletion, write to us and we will handle it with the firm. [For legal review: response time and the scope of deletion]