Data processing terms

You are the controller of that personal data. HOMEMADE ISRAEL, company number 516649076, operating winful (we, us), is your processor. Where we decide how data is used, such as your users' accounts and billing, the privacy policy applies instead.

• Purpose: running, measuring and reporting on your advertising, cutting and publishing your customers' videos, and the other services in the terms.
• Duration: while your subscription or contract runs, and until deletion as described below.
• People: your customers and shoppers, visitors to your sites, people who film videos for you, and your staff who use winful.
• Data: order references, amounts and dates, ad and click identifiers, visitor ids, first names, emails, videos and transcripts, IP addresses and browser details, as the privacy policy lists them.
• Sensitive data: winful is not built for health, biometric, financial account or other special category data. Do not send it to us.

We process the data only on your documented instructions: these terms, your settings and your use of the product. If the law requires other processing, we tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we tell you.

Everyone at winful who can reach the data is bound by confidentiality. Staff open a workspace only to support it, read-only, for a limited time and with a recorded reason.

We keep technical and organizational measures that fit the risk, including encryption in transit, encryption at rest for access tokens and the emails of people who film, separation of each brand's data by database access rules, and an audit log of staff access. We follow Israel's Privacy Protection (Data Security) Regulations.

You authorize the providers listed in the privacy policy to process data for winful. Each is bound by a written contract with data protection duties no weaker than these, and we remain responsible for their work. We email workspace owners before we add or replace one. You can object on reasonable data protection grounds, and if we cannot resolve the objection, you can end your subscription.

Privacy policy

We help you answer requests from people exercising their rights, and with security, impact assessments and consultations with authorities, as far as our role allows. If a person asks us directly about data we hold for you, we pass the request to you.

If we become aware of a security breach that affects your personal data, we tell you without undue delay, with what we know and what we are doing about it.

winful is operated from Israel, which the European Union recognizes as giving adequate protection, and stores data in the United States. Where the law requires a transfer mechanism for data you send us, the EU standard contractual clauses (module 2, controller to processor, or module 3, processor to processor) and the UK International Data Transfer Addendum are incorporated by reference. Where the clauses require the law and courts of an EU member state, those of Ireland apply.

When your subscription or contract ends, you can ask for an export within 30 days. We delete the personal data within 90 days after the end, unless the law requires us to keep it, as the privacy policy describes.

We give you the information you reasonably need to show these terms are met. If that is not enough, or a regulator requires it, you can audit us once a year on 30 days' written notice, at your cost, during business hours and under confidentiality, without access to other clients' data.

The liability limits in the terms of service apply to these terms. On data protection, these terms prevail over the terms of service. A data processing agreement you signed with us prevails over both.

Terms of service

Questions about these terms go to privacy@winful.app.

privacy@winful.app