Privacy policy — Garmushka

1. Who we are

The service is operated by Garmushka (“we”). For any privacy question, write to [email protected].

For your account details and for enquiries through the website, we are responsible for the information (the controller). For the information a studio manages in Garmushka about its customers, suppliers and projects, the studio is responsible (the database owner), and we process that information on its behalf and on its instructions, under the data processing agreement for studios.

2. Whose information this covers

Studio people (owners, admins and members); customers whom a studio invites to follow a project; suppliers, contractors and consultants with a supplier account; and visitors to our website. One person may hold several roles with the same account.

3. What information we collect

Account: name, email address, preferred language, time zone and quiet hours, notification preferences, and your roles: the studios you are a member of, the projects you are a customer on, and the supplier companies you belong to.
Signing in without a password: when you ask to sign in we send a link and a 6-digit code, valid for 15 minutes and usable once; only a hashed version is stored. We keep a log of sign-in attempts (email address, IP address, time and outcome, never the code) for 90 days, to block guessing and to answer “I didn’t get the code”.
Devices: each browser you sign in on is remembered with a device cookie, for up to 90 days if you choose to stay signed in on it, otherwise until you close the browser or after 12 hours without use; we keep the browser type, IP address and when it was last used, so you can see your devices and sign them out.
Signing in with Google: if you choose it, Google LLC sends us your name, email address and Google account ID. We never receive your Google password.
A studio’s business information: customers (names, phone, email, company number and billing details), projects (address, location, dates, design fee and milestones, stages, folder links), suppliers and contacts, bills of quantities, quotes, commissions, internal notes and supplier ratings. The studio enters this information.
Project tracking: hired suppliers and contract amounts, instalments, change orders, payments (amount, date, method, cheque dates and who entered them), invoices and receipts, tasks and visits, snags, documents and site photos uploaded by the studio, customers or suppliers (photos may show people or places), and lists of residents’ shares in lobby projects (apartment, resident name, amount, paid).
Imported WhatsApp chats: when a studio uploads a chat exported from WhatsApp, the messages, the participants’ names and phone numbers and the media in it are stored in that project’s archive. By default only the studio sees it; the studio may share single messages with the customer or a supplier.
AI features, when a studio has them on: the document someone chooses to have read (a supplier’s quote, a receipt or an invoice, a plan) and the result read from it, which the person checks before anything is saved; and, for each use, a line in the studio’s AI credit log (who, when, which action, project, pages). We keep no text of the document beyond that result; a document nobody saved is deleted after 30 days, while a saved quote or receipt stays with the bid or payment it belongs to.
Customers: name, email address, role on the project and who invited whom, and what they enter themselves: payments, tasks, snags, photos, documents and preferences between options (with the time, IP address and browser, as a record). Reviews they write about the studio after handover, and about suppliers, go to that studio only and are never published.
Suppliers: company details (name, company number, type, phone, email, address, logo), team members and their roles, quotes (with the time of submission, IP address and browser, as a record), jobs, payment confirmations and, if the supplier adds them, insurance and licence documents with expiry dates.
Public registry information: we copy, every night, the public registers published by the government on data.gov.il — the Registrar of Contractors’ register and the register of licensed asbestos contractors — including business name, company number, address, phone, email, branch and classification. We use them to show “registered contractor” badges and to fill in a supplier’s details when a studio types a company number.
Notifications: the emails and app notifications we send, your choices for each kind, and, if you allow notifications on a device, the push subscription your browser gives us. In-app notices are kept for up to a year.
The activity log: a record of actions in projects and studios (who did what and when, such as moving a stage, adding a payment or confirming receipt), kept for as long as the service runs, as a record for everyone involved and in case of a dispute. When a person deletes their account, their name and identifying details in the log are replaced (anonymised).
Usage analytics, only with your consent: if you agree in the cookie banner, PostHog collects how the service is used (pages, clicks) and may record sessions to help us fix problems. Recordings mask every field you type in, and amounts, names, email addresses and phone numbers. If you decline, nothing is collected and your choice is remembered. Advertising is a separate choice, described next.
Advertising measurement, only with your consent: if you allow “Advertising” in the cookie banner, the website loads the Meta Pixel (Meta Platforms Ireland Ltd.) and the Google Ads tag (Google Ireland Ltd.), which tell us which of our ads brought visitors and sign-ups. When you open a studio’s account, send the contact form or join the waitlist, we also tell Meta from our server that it happened, with your email address only in hashed form (SHA-256, which cannot be turned back into the address), your browser type and the same event id, so it is counted once. No names, phone numbers, messages or anything from inside the service are sent. These tags never load in the studio board, the customer area or the supplier area, and never without your consent. You can change your choice at any time from “Cookie settings” at the bottom of the website.
How you found us: when you visit the website we keep, in a cookie for 90 days, the campaign tags of the link you came through (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the first page you landed on and the name of the website that sent you (its domain only, never the full address), for your first visit and for your latest visit from a campaign; and a promo code from a link, for 30 days. If you open a studio, these are saved with it, together with the choices you made in the cookie banner, to measure which campaigns work and to apply the code.
Cookies: a session cookie and a security (CSRF) cookie that the service needs to work; the device cookie, and a “stay signed in” cookie, for 90 days if you choose to stay signed in, otherwise until you close the browser; cookies remembering your analytics and advertising choices; the “how you found us” cookie (90 days) and the promo-code cookie (30 days) described above; only with your consent, the Meta and Google advertising cookies; a cookie remembering a studio’s referral link for 60 days, if you opened one; and your light or dark mode, kept only in your browser.
Website forms: enquiries (name, email, phone if given, studio name and size, message, preferred language and when you agreed to be contacted); the homeowners’ waitlist (email, name, city, kind of project, language); and invitations to a designer (your name and email, the designer’s name and email and your short note: we send the designer one email in your name and keep the details as a lead). The IP address is used only to limit how often forms are sent, and is kept briefly, separately from what you sent.
Feedback you send from inside the service (the text and the page address), and the mail log: for each email we send, the recipient, the kind of email and whether it was delivered, without its contents, for 180 days.

4. Why we use it

To provide the service: signing you in, showing and keeping each studio’s and project’s information, and sending the invitations, codes and notifications you asked for (performing our agreement with you).
To keep the service secure and prevent abuse, such as guessing codes or flooding forms (legitimate interest).
To keep a record of quotes, payments, confirmations and decisions, in case of a dispute (the legitimate interest of the studio and of everyone on the project).
To give support, and to answer people who wrote to us (legitimate interest; consent for website enquiries, which you can withdraw at any time).
To understand how the service is used and improve it: only with your consent.
To measure which of our ads and campaigns bring visitors and studios, and to apply promo codes: the campaign tags and the promo code (legitimate interest); the advertising tags and the reports to Meta and Google only with your consent.
To meet legal requirements.

We do not sell personal information, show no advertising inside the service, never share what is inside the service with advertisers and do not make automated decisions about anyone.

5. Who can see what

A studio’s information is seen by the studio’s people, according to their role; a member sees the projects they are assigned to.
Customers see only what the studio shares with them on their own projects. They never see commissions, internal notes or ratings.
Suppliers see only their own quotes, jobs, tasks, snags and payments, and what a studio shared with them. They never see other suppliers’ prices. The full site address and on-site contact are shown only after they are hired. Commission terms appear only on the supplier’s own page with that studio.
Our support staff: a small number of authorised Garmushka staff can access an account, including signing in as the person (impersonation), only to give support, investigate a problem or keep the service secure. Every such access is recorded in an internal log that only they can see, and is reported to the other administrators. The person is not notified each time.

6. Who we share it with

We use service providers (sub-processors) that process information on our behalf, only as far as needed:

Hetzner Online GmbH (Germany, European Union): servers, database, file storage and backups. The service and its data are hosted in the EU.
Postmark, operated by ActiveCampaign, LLC (USA): sending emails (sign-in codes, invitations and notifications).
PostHog Inc., on its EU cloud (Germany): usage analytics and session recordings, only with consent.
Meta Platforms Ireland Ltd. (Ireland; its parent, Meta Platforms, Inc., is in the USA) and Google Ireland Ltd. (Ireland; Google LLC, USA): measuring our advertising, only with your consent for advertising, as described above.
Laravel Nightwatch, operated by Laravel Holdings Inc. (USA): monitoring errors and performance. Error reports may include an IP address and an account ID. [to be completed]
Anthropic, PBC (USA): reading documents and writing suggestions for the AI features (supplier quotes, receipts and invoices, BoQ drafts from a description or plan, explanations of quote differences), only when someone uses them and the studio has them on. Only what the action needs is sent: the document and the BoQ’s own lines, or for an explanation that BoQ’s quotes with suppliers by letter and the studio’s usual prices; never commissions, never other studios’ or other suppliers’ information. Under its commercial terms Anthropic does not use this information to train its models.
Google LLC (USA): signing in with Google, for those who choose it.
Push services run by browser makers (such as Apple, Google and Mozilla): delivering app notifications to a device that allowed them. The notification text passes through them.
Finding addresses on the map: when a studio saves a project address, only the address text is sent to the Photon service of komoot GmbH (Germany), or, if set otherwise, to OpenStreetMap Nominatim (OpenStreetMap Foundation, UK) or the Google Geocoding API (Google LLC, USA). Nothing else about the customer is sent.

WhatsApp invitations and messages are sent from the studio’s own phone; we do not send WhatsApp messages. We disclose information to authorities only when the law requires it.

7. Transfers outside Israel

The service is hosted in the European Union, which has adequate data protection. Some providers operate in the United Kingdom and the United States; we transfer information to them only under suitable contractual commitments, as required by the Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

8. How long we keep it

A deleted account is kept for thirty days so that it can be restored by signing in again. After that, identifying details are deleted or anonymised. A customer’s or supplier’s entries in projects stay with the project, under “former customer” or the company name.
A deleted studio is kept for thirty days. When the studio’s plan includes it, customers on its projects are offered to keep a read-only copy of their project, which becomes theirs; otherwise it is deleted or anonymised with the studio.
Sign-in links and codes are deleted a day after they expire; the sign-in log after 90 days; devices 90 days after they were last used, or 12 hours after if you did not choose to stay signed in.
The activity log is kept for as long as the service runs, with people anonymised as described above.
Website enquiries, waitlist entries and designer invitations are deleted 24 months after they were last handled, or sooner if you ask.
A studio’s business information is kept while the studio is active, or until the studio deletes it.
Backups are deleted on their regular cycle: [to be completed].

9. Security

Each studio’s information is kept apart from every other studio’s, and every screen for customers and suppliers is limited to what they are entitled to. Connections are encrypted, sign-in codes are stored hashed and are limited in attempts, queued emails about people are encrypted, and the admin area is protected by a separate password. No system is completely immune; if there is a breach, we will report it as the law requires.

10. Your rights

Under the Protection of Privacy Law, 5741-1981, you have the right to see your information and to ask for information that is not correct, complete, clear or up to date to be corrected or deleted. In the spirit of the European GDPR, we also let you ask for a copy of your information in a convenient format (export), have it deleted, restrict or object to its use, and withdraw consent you gave.

Send requests to [email protected]; we will answer within 30 days. You can delete your account yourself from your account page and download a copy of your account data there; studio owners can download all the studio’s data from the studio settings. If you are a customer or supplier of a studio, first ask the studio, which is responsible for that information — and we will help it.

You can also complain to the Privacy Protection Authority, or to the supervisory authority in the EU country where you live.

11. Minors

The service is intended for adults and is not intended for anyone under 18.

12. Changes to this policy

If we change this policy materially, we will tell you by email or in the service before the change takes effect.