Skip to content
Haflaga
Legal

Privacy Policy

Last updated: October 11, 2026

1. Who we are

Haflaga is operated by Hahami Connect Ltd. (Company No. 517144812), 7 Rahav St., Bat Yam, Israel. Contact: info@haflaga.co.il · +972-72-200-0007. We are the data controller for the personal information described in this policy.

2. Scope

This policy applies to all Haflaga services (accounts, browsing, bookings, listings, in-app communications, document uploads, payments, and customer support) across the web, iOS, and Android apps.

3. Categories of data we process

  • Account & contact: name, email, phone number, language.
  • Identity verification: where required, government ID details for safety and compliance.
  • Profile content: photos, descriptions, vessel information, preferences.
  • Bookings and transactions: experience details, dates, pricing, and ratings.
  • Communications: in-app messages, support tickets, email correspondence.
  • Device & usage: IP address (anonymized for analytics), device type, app version, page views.
  • Security & fraud-prevention signals: login attempts, abuse reports, risk indicators.

We do not store full credit-card numbers or CVV codes. Only limited payment records that we are legally required to retain (e.g. invoice references) are kept.

4. App permissions

The mobile app requests the following device permissions, only when needed and only for the purposes described:

  • Camera — to take photos for your profile or to upload pictures of a boat you list.
  • Photos / Files — to attach existing images to a listing, message, or support ticket.
  • Calendar — to add a confirmed booking to your device calendar (only after you tap "Add to calendar").
  • Notifications: to send booking confirmations and host messages.

We do not capture microphone audio, contacts, health data, or location. The app does not request device location (GPS) permission, does not collect precise or continuous location, and there is no "near me" search. On iOS, we do not request the IDFA / App Tracking Transparency permission because we do not track you across other apps and websites.

5. Why we process data

  • Operate the Haflaga service and your account.
  • Authenticate you and protect your account.
  • Process bookings and payments end-to-end.
  • Maintain safety, prevent fraud, and enforce community guidelines.
  • Comply with legal, tax, and accounting obligations.
  • Improve the product (analytics, A/B tests, customer-research interviews you opt into).

6. Platform role and enforcement

Haflaga reserves the right to review complaints regarding users or posted content, request additional verification, suspend accounts upon reasonable suspicion of violations or fraud, and retain records as required by law.

7. Data sharing & subprocessors

We share personal data only with: (a) service providers acting on our instructions, (b) payment partners as needed to process and reconcile transactions, and (c) public authorities where required by law. We do not sell personal data.

Current categories of processors we rely on (the specific vendors may change as we evolve the service):

  • Hosting & infrastructure — Google Cloud Platform / Firebase (Cloud Run, Cloud Functions, Firestore, Cloud Storage, Firebase Authentication).
  • Analytics — Google Analytics, configured with anonymized IPs and no advertising features.
  • Advertising — Google Ads conversion tracking and the Meta (Facebook), TikTok and OpenAI (ChatGPT) pixels, loaded on the website according to your cookie choice (see the Cookies section below), to measure our ad campaigns and show you relevant ads. They report your visit to Google, Meta, TikTok and OpenAI respectively, and can be used to build advertising audiences. When you submit a form on the site, the Google Ads tag and the OpenAI pixel also send a hashed (SHA-256) version of the email address or phone number you entered, never the plain value, so that your enquiry can be matched to the ad that brought you here.
  • Sign-in providers — Apple, Google and Meta (Facebook), used only if you choose that sign-in method; they confirm your identity and share your name, email address and profile picture.
  • Payments — a regulated payment processor that handles cards directly; full card numbers and CVV never reach our servers.
  • Email & SMS delivery — transactional providers used to send booking confirmations and reminders.
  • Guest support — a help-desk tool used to track and respond to tickets.
  • Crash and error reporting — limited diagnostic information from the apps so we can fix bugs.

8. International transfers

Some of our processors are based outside Israel. When we transfer personal data abroad, we apply appropriate safeguards (contractual clauses, adequacy where applicable).

9. Retention

We keep personal data only as long as reasonably necessary for the purposes above and for the time required by tax, accounting, anti-fraud, and other legal obligations. When you delete your account we follow the process described in our Data Deletion page.

10. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You can delete your account directly in the app (Account → Edit Profile → Delete Account) or by contacting info@haflaga.co.il.

11. Children's privacy

Haflaga is intended for adults (18+) and is not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, please contact info@haflaga.co.il and we will promptly delete it.

12. Security

We apply administrative, technical, and organizational measures to protect personal data, including encryption in transit, access controls, and regular review of our practices. No system is risk-free, but we work continuously to reduce that risk.

13. Cookies, analytics & advertising

We use a small number of cookies to keep the site working and, depending on your cookie choice, Google Analytics with anonymized IP addresses to understand how visitors use the site, and Google Ads conversion tracking plus the Meta (Facebook), TikTok and OpenAI (ChatGPT) pixels to measure and target our advertising. Where the law requires prior consent — the European Economic Area, the United Kingdom, Switzerland and other consent-first regions, and whenever we cannot tell where you are — none of them load until you accept. Elsewhere, including Israel, they start when you arrive and the banner lets you turn them off; we also treat the Global Privacy Control browser signal as a request to turn them off. We tell the regions apart by your device's time zone, which never leaves your browser. Declining or turning them off deletes the identifiers they already stored (_ga, _gcl_au, _fbp, _fbc, _ttp, ttcsid, __obref). You can change your choice at any time from the Cookie settings link in the footer, or by clearing the haflaga.cookie-consent item in your browser storage.

14. Updates

We may update this policy from time to time. Material changes will be reflected in the app and on this page, with the "Last updated" date refreshed.

15. Contact

Questions about this policy or your data? Reach us at info@haflaga.co.il, +972-72-200-0007, or 7 Rahav St., Bat Yam, Israel.

This Privacy Policy is provided in several languages for your convenience. In the event of any discrepancy, the English version prevails.