This is a translation provided for convenience. For Offices in Israel, the Hebrew version is binding.

Privacy Policy — CPAADV Flow

Version 1.0 · Last updated: 12 October 2026

This Policy explains what personal data is processed in CPAADV Flow (the "Service"), for what purposes, with whom it is shared, how long it is kept and what rights you have. The Service is operated by HI ACCOUNT LTD (היי אקאונט בע״מ), Israeli company no. 516598737, business address: 11 HaTzanchanim Street, Apartment 6, Holon 5827513, Israel (the "Operator", "we", "us"). Privacy enquiries: [email protected].

1. Who is responsible for the data

1.1. Data about Offices and their Users — data about office users, account management, subscription, billing, security and support: the Operator is responsible for this data.

1.2. End Client data and documents — documents and information an Office collects from its clients through the Service: the Office decides what to request and for what purpose, and is responsible for this data. The Operator processes it only on the Office's behalf, under the Data Processing Agreement. If you provided documents to an Office, please contact that Office with any question about their use; we can help route your request to the Office.

2. What data we process

Office users

• Sign-in data from your Google account: email address, a unique account identifier, and your name as shown in your Google account.
• The office name, your role and permissions in the office, invitations sent and accepted, and the email addresses of invitees.
• The office logo, if uploaded.

Billing details

• Customer type (individual, company or non-profit), legal name, Israeli ID or company/non-profit number, invoice email address and mobile number.
• Payment method: a token issued by the payment provider, card brand, last four digits and expiry date. The full card number and security code never reach us and are not stored by us.
• Charge history, amounts, VAT, transaction references and invoice numbers.
• Where the billing customer is an individual, the ID number they gave is passed to Cardcom to verify the cardholder on its payment page.

End Clients and Content

• The End Client's name and phone number, if the Office entered them.
• Uploaded documents, file names, types and sizes, and upload and download times.
• Messages the Office wrote to the client and lists of requested documents.
• Portal access data: timestamps and technical identifiers of the link and the access session (stored as hashes, never as the link itself).

Activity log

• We keep a log of significant actions in the Service (for example: creating a client, uploading a file, downloading, changing a permission, billing actions), with the time, the office, the type of actor (user, End Client or system) and limited technical details. The log does not include document content, file names or IP addresses.

Technical data

• The application itself does not store IP addresses or browser details in its database. Our hosting and network providers (see section 5) process IP addresses and request logs as part of providing and protecting the infrastructure, under their own policies.
• The application's operational logs automatically filter sensitive values such as passwords, tokens, cookies, file names and card details.

3. Purposes and legal basis

We process data to: provide the Service under the contract with the Office; identify users and enforce permissions; collect payment and issue tax documents; send service messages (such as team invitations); give support; secure the Service, prevent misuse and fix faults; and comply with legal obligations, including tax law. The legal basis is performance of the contract with the Office, our legitimate interest in securing and operating the Service, and compliance with legal obligations. We do not sell personal data or use it for advertising.

4. Cookies and browser storage

The Service uses only the cookies and storage needed for it to work. It has no advertising cookies, tracking pixels or third-party analytics, so no cookie consent is requested.

All cookies are marked HttpOnly and Secure and are sent only to the Service's site. Google's and Cardcom's pages are also subject to those companies' cookie policies.

5. Providers and sharing

We share data only with providers needed to operate the Service, and only to the extent necessary:

• Supabase — database and user authentication, in the European Union (Frankfurt).
• Railway — application hosting, in the European Union (Amsterdam).
• Cloudflare — document storage (R2) under the European Union jurisdiction, and domain name services, traffic delivery and protection on a global network.
• Resend — sending operational emails, such as team invitations, from its infrastructure in the European Union (Ireland).
• Google — sign-in with a Google account.
• Cardcom — payment processing and invoice issuing; also acts as an independent party under law and its own terms.

A detailed, current list is in the Subprocessor List. We will also disclose data where required by law or by a competent authority, or as part of a merger or transfer of business subject to the commitments in this Policy.

6. Operator access to data

Access to data in the Service by the Operator, and by technical service providers acting for it and under its supervision, is limited to operation, support, security, billing, fault fixing and legal compliance. The Operator's administration console shows administrative information about offices, users and billing, cannot change data, and does not show documents, file names or End Clients' phone numbers.

7. Transfers outside Israel

The Service is hosted mainly in the European Union. Some providers are international companies (including in the United States) and may process data outside Israel and the European Union as part of their services, for example to protect network traffic or deliver email. We contract with these providers on terms that include data protection commitments.

8. Retention and deletion

8.1. Account and Content — account data and Content are kept while the Office workspace exists. After cancellation or non-payment, the workspace becomes read-only and the data remains available to view and download.

8.2. Documents — the approved retention policy provides that a document the Office has downloaded is deleted 30 days after the first download, and a document moved to the recycle bin is deleted 30 days later. As of the date of this Policy, automatic deletion is not active, and documents are kept until it is activated or until they are deleted otherwise. We will update this Policy before activating it.

8.3. Office workspace — the approved policy is controlled deletion of an Office workspace 90 days after the subscription ends, with advance notices and the opportunity to renew and to download documents. As of the date of this Policy, this deletion is not active. Before activating it we will update this Policy and give Account Owners advance notice.

8.4. Billing — billing details, charge history and invoices are kept after the subscription ends and after the workspace is deleted, for the period required by tax and accounting law.

8.5. Activity log — kept as an unchangeable record for security and investigation purposes. Our retention target is 24 months, after which records are to be removed unless they are needed for longer under law, for an investigation or as evidence. As of the date of this Policy, this removal is not yet implemented and records are kept; we will update this Policy when it is.

8.6. Backups — our database provider automatically keeps backups of the database as part of its service, for a limited period. The documents themselves are not included in these backups. Data deleted from the Service may remain in these backups until they expire. We do not currently commit to any further backup of documents or to recovery times.

9. Security

We use technical and organisational measures designed to protect data, including: enforced separation between offices at the database level; role-based permissions; private document storage with no public links, every download passing through the server after a permission check; random Portal links stored only as hashes and revocable; encrypted transport; and filtering of sensitive data from operational logs. No system is completely immune, and we cannot guarantee absolute security. If a security incident affects personal data, we will act as required by law and by our commitments to Offices.

10. Your rights

Subject to applicable law, including the Israeli Protection of Privacy Law, 5741-1981, you may ask to access data about you, ask to correct or delete data that is incorrect, incomplete, unclear or out of date, and exercise further rights the law gives you. Requests about data the Operator is responsible for should be sent to [email protected]. Requests about documents you gave to an Office should go to that Office. We may ask you to verify your identity before handling a request. If you are not satisfied, you may contact the Israeli Privacy Protection Authority or the competent authority where you live.

11. Minors

The Service is not intended for accounts opened by minors. An Office that requests documents of or about a minor is responsible for obtaining the required authorisations.

12. Changes and language

We will update this Policy from time to time; the current version and its date are shown on this page. Material changes will be notified to Account Owners in advance. This Policy is published in Hebrew and English; for users in Israel the Hebrew version prevails to the extent permitted by law.