Privacy Policy

1. What information we collect

1.1. Signing up for the waiting list on the website:

• Full name;
• Email address;
• Legal practice area (from a closed list);
• Firm size (optional);
• Information about the AI tools you currently use (optional, free text).
• Non-identifying information such as usage times, connection data, IP address, device identifiers, browser type and additional technical information.

The information submitted in the registration form is stored in a dedicated database serving the website. See the sub-processors appendix at the end of this document.

1.2. Service access account (beta):

Sign-in to the Service is performed through an external identity provider (WorkOS), after authentication via Google, Microsoft or email. Two separate layers should be distinguished:

• With WorkOS: during authentication via Google or Microsoft, those providers may pass WorkOS additional details beyond the email address (such as full name or profile picture), depending on the sign-in configuration of WorkOS and those providers. Such details, to the extent they exist, are held and processed by WorkOS as an independent identity provider, not by Judaro. For further details, see the WorkOS privacy policy.
• With Judaro: the Service itself, in practice, requests and receives back from WorkOS only a verified email address, used to locate your entitlements, and a usage-entitlements record: which "packages" are associated with the account and whether it is active. We do not request or store a full name, profile picture, phone number or IP address.

1.3. Voluntary feedback during the beta:

If you choose to submit feedback about the Service, the link to the feedback form may pre-fill your registered email address in a hidden field. Submitting the form always requires your explicit action and is never automatic, and any free-text content you choose to include (for example a bug description) is transferred to Google upon submission.

1.4. Cookies and similar technologies:

As set out in the website's cookies notice.

1.5. Additional communication:

Correspondence, support requests and additional feedback you choose to send us.

Logs and API call retention: we collect and retain the history of the user's API calls to the server for 90 days from their creation. The logs contain no personal information except: the user's email address, IP address, and the name of the skill, file or list of domains requested, or search terms entered into the server.

2. Purposes of processing

We process the information for the following purposes:

• Managing the product access list;
• Providing, operating and improving the Service, including managing usage entitlements for the content and domains included in your package;
• Communicating with users (updates, support, collecting voluntary feedback);
• Information security, preventing unauthorized use of the access account and complying with legal requirements;
• Sending marketing updates, subject to your consent and your right to withdraw it.

As of the date of this policy update, no analytics component is active on the website or the Service; if and when such a component is deployed, this policy will be updated accordingly and will include an accurate description of the data collected.

3. Legal basis and consent

3.1. Providing the information is voluntary and with your consent. You are not legally required to provide information, but without the registration details we cannot add you to the waiting list, and we cannot provide you access to the Service without verified authentication.

3.2. Processing is based on your consent, on the necessity of performing our engagement with you, and on MANDA INTELLIGENCE's legitimate interest in operating, securing and improving the Service.

3.3. Your consent to marketing communications may be withdrawn at any time.

4. Client data - not collected (Read-only)

4.1. The Service is designed so that the user's client data and documents remain solely within the user's working environment. The Service's MCP tools (such as retrieving a list of domains, a skill, a playbook, knowledge or a reference document) accept as input only a catalog identifier of content prepared in advance by MANDA INTELLIGENCE, and do not allow uploading a user document, free text or file.

4.2. Judaro does not transmit, collect or store the firm's client data on its servers, and does not record documents, free text or the content of prompts you entered into your AI tool. The Service logs retain only time-limited operational metadata (see section 1.6), not the content of your work.

4.3. Accordingly, responsibility for processing client data, including database obligations under the Israeli Protection of Privacy Law and Amendment 13, remains with the lawyer using the Service as the database owner / holder.

4.4. The Service does not make automated decisions affecting your rights as a data subject; the output provided is intended to serve the lawyer as an auxiliary tool only, and is in any event subject to the lawyer's independent professional judgment.

5. Sharing information with third parties

5.1. We do not sell personal information. We share information with the sub-processors listed in the appendix at the end of this document, which provide us infrastructure, hosting, identity/authentication and feedback-form services, solely for operating the Service.

5.2. With sub-processors that process personal information we work to put in place a data processing agreement (DPA) or an equivalent contractual undertaking, binding them to confidentiality and security standards no lower than required under Israeli law.

5.3. We may disclose information to a third party in one or more of the following cases:

• To external service providers required for our operations, including for payment processing;
• Where the user has authorized transferring details to third parties;
• Where the user breaches the terms of use or attempts actions contrary to law;
• In order to enforce the terms of use or other agreements or policies;
• In response to a subpoena or other investigative demand, a court order, or a request for cooperation from a law enforcement or other governmental authority;
• In order to establish or exercise our legal rights;
• In order to defend against legal claims as required by law. In such cases, we may raise or waive any objection or right available to us, at our sole discretion;
• Where we decide to collect an unpaid debt through a third party specializing in debt collection, including law firms;
• Where we believe disclosure is appropriate in connection with efforts to investigate, prevent, report or take other action regarding illegal activity, suspected fraud or other wrongdoing;
• To protect our rights, property or safety, or those of our employees, our users or others;
• In connection with a material corporate transaction, such as a sale of business, investment, merger, consolidation, asset sale, or in the event of dissolution.

6. Transfer of data abroad

Some of our sub-processors operate and/or store information outside Israel (including in Germany and the United States - see appendix). Such transfers rely on Regulation 2(4) of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001: on the basis of your consent (for example, when signing up for the waiting list or signing in to the Service) and/or a contractual undertaking by the provider to afford data subjects a level of protection no lower than that provided under Israeli law, mutatis mutandis.

7. Data subject rights

Under the Israeli Protection of Privacy Law and Amendment 13, you have the following rights:

• Access to information about you;
• Correction of information that is inaccurate, incomplete or outdated;
• Withdrawal of consent to marketing communications;
• Submitting an inquiry or complaint, including to the Privacy Protection Authority.

To exercise your rights, contact: lapidot@judaro.com. We will handle your inquiry within the period prescribed by law.

8. Data security

We apply reasonable organizational and technological security measures to protect the information, including in accordance with the Privacy Protection (Data Security) Regulations, 5777-2017. Among other things, access to the Service is authentication-based (OAuth) and access keys are stored in encrypted (hashed) form only, never as plain text. That said, absolute security cannot be guaranteed.

9. Data retention

9.1. Waiting-list data: retained as long as access for your practice area has not opened in the beta and as long as you have not requested removal; if you do not join the beta within a reasonable period from registration, the information will be deleted or anonymized, unless you request otherwise.

9.2. Service access account data: retained as long as the account is active. After termination or cancellation of the account, the information will be deleted or anonymized within a reasonable period, unless retention for a further period is required by law.

API call logs: retained for 90 days from creation, then deleted automatically.

9.3. Voluntary feedback: retained within MANDA INTELLIGENCE's Google Forms account until reviewed and for a reasonable further period for product improvement purposes; you may request its deletion at any time.

10. Minors

The Service is intended for lawyers and professionals only, and is not intended for minors. We do not knowingly collect information about minors.

11. Changes to this policy

We may update this policy from time to time. An updated version will be published with an update date. Following the opening of the Service to the general public, we intend to expand the scope of access-account details retained (for example access expiry date, an audit log of administrator actions, and later also subscription/billing details) - any such material change to the scope of information collected will be updated in this policy before it takes effect, and notice will be given to the user's registered email and/or by a notice on the website.

12. Contact us

For any privacy question or inquiry:

Email: lapidot@judaro.com

Address: MANDA INTELLIGENCE LTD, 3 Navon St., Jerusalem, Israel

Appendix - Sub-processors

This list may be updated. We work to put in place a contractual undertaking (DPA / data processing agreement) with every provider that processes personal information, in accordance with the requirements of Regulation 2(4) of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.