PRIVACY POLICY

Introduction

Adv. Sapir Nadler Hershkovits, a sole proprietor registered for VAT in Israel, operates the Atlas service (hereinafter: “Atlas”, “we”, “us” or the “Service Operator”). We respect the privacy of our users and are committed to protecting the personal information collected in connection with the use of Atlas (hereinafter: the “Website” or the “Service”).

Atlas is a digital service designed to help users choose travel destinations, compare destinations, receive personalised recommendations, and build and save travel plans based on the information and preferences users choose to provide.

This Privacy Policy explains the types of personal information we collect and process, how the information is collected, the purposes for which it is used, the persons or entities to whom it may be disclosed or made accessible, how it is retained, and your rights in relation to such information.

This Privacy Policy has been prepared in accordance with the Israeli Privacy Protection Law, 5741-1981 (the “Privacy Protection Law”), the Privacy Protection Regulations (Data Security), 5777-2017, and other applicable privacy laws and regulations.

You are not legally required to provide us with personal information, and the provision of such information is voluntary. However, failure to provide certain information may prevent us from providing some of the services or may affect our ability to tailor recommendations and travel plans to you. For example, creating an account is required in order to save trips and traveller profiles on an ongoing basis.

Atlas, through Adv. Sapir Nadler Hershkovits, is the controller of the relevant databases used in connection with the Service. For any question or request regarding privacy, you may contact us at: sapir@nhlaw.io.

Types of Information We Collect

We may collect and process personal information depending on how you choose to use the Service, including:

Account information:
When you create an account, we collect your email address and information needed to manage your account and enable sign-in. Authentication credentials are managed through the Service’s authentication provider, and Atlas does not store your password in plain text.

Traveller information and travel preferences:
Information you choose to provide in order to tailor recommendations and your travel plan, including the composition of the travelling party, number of adults, children’s ages, travel month or timing, trip duration, interests, ranked preferences, a preference marked as particularly important, travel pace, driving preferences, spending style, things you prefer to avoid, and information about previous visits to the destination.

If you choose to do so, you may also provide special preferences such as kosher food, Shabbat-friendly travel or the availability of Jewish services.

Information relating to children:
For the purpose of tailoring family trips, you may provide children’s ages in whole years. Atlas does not request children’s names or dates of birth for this purpose. Children’s ages are not provided to the analytics system and are not used for advertising or marketing purposes.

Saved trips:
When a trip is saved to an account, we may retain the selected destination, number of nights, trip details and preferences, as well as changes you made to the plan, such as activities you chose to keep, add or remove, additional nights, adjustments to the pace of the trip, and information regarding a first or repeat visit to the destination. The dates on which a trip was created and updated are also retained.

Scores, calculations and internal supporting data used by Atlas to generate recommendations are not stored as part of a saved trip.

Traveller groups and profiles:
If you choose to save a traveller group, we may retain the group name, traveller type, number of adults, children’s ages and additional preferences or needs you chose to save.

Information stored on your device:
The Service uses browser storage to retain current trip answers, changes made to a trip, your language selection and incomplete save processes. Information waiting for completion of a save process may remain on the device for up to seven days.

Technical information and usage data:
For the purpose of understanding how the Service is used and improving it, predefined usage events are collected, such as opening pages, completing the questionnaire, building a trip, saving a trip and using trip-editing tools. This information may also include basic technical data such as device type, browser, operating system, screen size, Service language and page address after private identifiers have been removed.

How We Collect Information

We collect personal information in the following ways:

1. Information provided by you:
When completing the questionnaire, building a trip, creating an account, saving a trip or traveller group, or changing an existing plan.

2. Information generated through your use of the Service:
For example, selecting activities to keep, add or remove, changing the pace of a trip or adding nights.

3. Information stored in the browser:
For the purpose of operating the Service, maintaining continuity of use and remembering certain preferences.

4. Technical and usage information:
Through an analytics tool used to measure use of the product, as described below.

Purposes for Which We Use Information

We use personal information for the following purposes:

• providing and operating the Service;
• selecting travel destinations and tailoring them to your preferences;
• building travel plans according to the composition of the travelling party, children’s ages and the preferences provided;
• tailoring activities, trip load and travel pace;
• creating, managing and maintaining user accounts;
• saving trips and traveller groups and enabling users to open, edit or delete them;
• improving the Service and user experience;
• producing aggregated and statistical information regarding use of the Service;
• securing the Service, preventing unauthorised use, handling technical issues and maintaining the proper operation of the systems;
• protecting legal rights, handling disputes and managing legal proceedings;
• complying with legal requirements and requests from competent authorities.

Atlas does not use the information provided for travel planning for personalised advertising purposes.

Personal Accounts and Saved Trips

A significant part of the Service, including destination selection and trip building, may be used without creating an account.

Creating an account is required for the ongoing storage of trips and traveller groups.

A trip saved to an account retains the trip information and preferences as they existed when the trip was saved. Changes to your preferences at a later time do not automatically alter a previously saved trip.

You may independently delete saved trips and traveller groups, as well as delete your entire account.

Analytics

Atlas uses PostHog to analyse use of the product and improve the Service.

Our use of PostHog has been configured in a limited manner. In particular:

• screen recording is not used;
• heatmaps are not used;
• automatic capture of clicks or form content is not used;
• analytics cookies are not used;
• Atlas does not identify users in PostHog by name or email address;
• children’s ages, trip content, preferences, hotels and activities are not provided to PostHog;
• private identifiers are removed from page addresses before they are sent for analytics;
• the PostHog configuration is set so that the user’s IP address is not retained.

In order to connect events occurring during the same visit, a random identifier is created and retained only for the duration of the browser session. This identifier is not linked to the user’s account and is not used to identify the user across separate visits.

Disclosure of Information to Third Parties

We do not sell personal information. We do not disclose information provided for trip planning — such as children’s ages, travel preferences, trip content or account details — to commercial entities for their own independent advertising purposes. However, if you choose to use a partner link, the relevant affiliate network and service provider may collect and process technical and transaction data for referral attribution, measurement, reporting, fraud prevention and operation of the affiliate program, as described below.

Information may be accessible to or disclosed to service providers assisting us in operating the Service, including:

• hosting and technology infrastructure providers;
• database and authentication service providers;
• PostHog, for the purpose of analysing usage data as described above;
• professional service providers, where access is required for the operation of the Service;
• competent authorities or other parties where disclosure is required by law, a court order or another lawful demand;
• relevant parties in connection with a transfer of the activity, a restructuring or a transaction relating to the Service, subject to applicable law and appropriate safeguards.

Access to information will be limited, insofar as possible, to the information required for the relevant service and in accordance with appropriate access permissions.

Partner Links and Booking Services

Atlas may include commercial or affiliate links to booking websites and tourism service providers. If you click a partner link and complete a qualifying transaction, Atlas may receive a commission from the provider or affiliate network.

For referral attribution, performance measurement, reporting, security and fraud prevention, the affiliate network CJ and the relevant provider may process technical information and transaction data, such as device and browser type, tracking identifiers where used, click time, IP address, referring page URL and information relating to a completed transaction.

Atlas does not encode or intentionally transmit through partner links your email address, children’s ages, trip content, travel preferences, information concerning kosher food or Shabbat, or other personal information that is not necessary to operate the partner link.

CJ and the provider to which you are referred may act as independent controllers in relation to data they process, and their processing is subject to their own privacy notices.

Some links are operated through affiliate programs other than CJ. In particular, links to Hotels.com are created through the Expedia Group Travel Creator Program.

Hotels.com links: Hotels.com is an external booking website that Atlas does not operate. Atlas does not book accommodation or collect payment for it; the booking and related matters are handled through Hotels.com under the terms shown there. Each Hotels.com link on Atlas is a fixed web address. Atlas does not add your account details, questionnaire answers, itinerary content, travel dates or other personal information to it. When you click the link, your browser connects directly to an external service. From that point, Hotels.com and parties involved in operating the affiliate link may collect technical information, such as your IP address, device and browser details, cookies and referral-tracking identifiers, and any information you choose to submit on the Hotels.com site. That information is processed under their own privacy notices, which may involve processing outside Israel. Please read the Hotels.com privacy policy before submitting personal information.

If Atlas later deploys cookies, pixels, SDKs or other device-tracking technologies of an affiliate network on Atlas itself, those technologies will be deployed only subject to any notice, consent and preference-management mechanisms required by applicable law.

Information Security

We use reasonable and appropriate organisational and technological measures to protect personal information, including access-control and authorisation mechanisms.

Access to trips, profiles and traveller groups saved in an account is restricted to the user who created them.

Nevertheless, no technological system can provide absolute protection. In the event of an information-security incident, we will act in accordance with our obligations under applicable law and take appropriate measures to minimise the impact.

International Transfers of Information

The Service uses international infrastructure providers, and personal information may therefore be stored or processed outside Israel.

Information stored in user accounts, trips and traveller groups is stored in a database located in Ireland, within the European Union.

The authentication service operates on the same infrastructure and in the same region.

The Website itself operates using global hosting infrastructure. Accordingly, requests relating to use of the Service may pass through servers located in different countries depending on the user’s location and the available infrastructure, even though persistent account data is stored in the database in Ireland.

The PostHog service used for analytics operates in the European Union region.

Some infrastructure providers are international companies. Accordingly, technical processing, support or access to systems may also occur from additional countries, subject to the arrangements applicable to those service providers.

Any transfer of personal information outside Israel will be carried out in accordance with applicable law.

Retention and Deletion of Information

Information in a user account will be retained for as long as the account or relevant record exists, or for as long as the information is required in order to provide the Service, comply with a legal obligation or protect legal rights.

Users may independently delete:

• a saved trip;
• a traveller group;
• their entire account.

Deleting an account results in deletion of the account and information stored in it from Atlas’s active systems, including trips, profiles and groups belonging to that user.

Deleting an account does not necessarily remove information stored locally in the browser and not linked to the account, such as answers relating to the current trip or the selected language. Such information may be removed through the browser settings or by clearing site data.

Usage events already sent to PostHog may remain in the analytics system. Such information is not linked to the user’s account or email address.

Certain copies of information may also remain for an additional period in service providers’ backup systems, in accordance with their backup mechanisms and retention policies.

Your Rights in Relation to Personal Information

In accordance with the Privacy Protection Law and subject to the conditions provided by law, you have the right to review personal information held about you and to request correction of information that is inaccurate, incomplete, unclear or not up to date.

In addition to rights provided by law, the Service allows you to independently delete trips, traveller groups and your entire account.

To exercise your rights or for any question regarding your personal information, you may contact us at sapir@nhlaw.io.

We may request additional information in order to verify the identity of the person making the request, in order to protect the information from disclosure or alteration by an unauthorised person.

Third-Party Websites and Services

The Service may contain links to websites and services operated by third parties, such as tourism websites, attractions, transportation providers or booking services.

This Privacy Policy does not apply to the activities of such third parties. Your use of a linked website or service is subject to that third party’s terms and privacy policy.

The inclusion of a link through Atlas does not constitute a representation or undertaking regarding the manner in which the relevant third party handles personal information.

Contact Us

For questions, enquiries or requests relating to this Privacy Policy or your personal information, please contact:

Controller of the relevant databases: Adv. Sapir Nadler Hershkovits, a sole proprietor registered for VAT in Israel
Service: Atlas
Privacy email: sapir@nhlaw.io

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including as a result of changes to the Service, technology, our processing of information or applicable legal requirements.

In the event of a material change, we will publish an appropriate notice on the Website or take another notification measure where required.

The date of the most recent update will be displayed at the bottom of this Privacy Policy.

Last updated: October 2026