Privacy Policy

Last updated: 3 October 2026

1. Controller and contact details

YallaBye operates yallabye.co.il and controls the processing used to provide the service. For privacy, access, correction or deletion requests, email support@yallabye.co.il or message us on WhatsApp only at 055-503-1046.

2. Information we collect

Before payment we collect contact, trip, product and traveller details and the answers required by the destination authority. If you submit a Meta lead ad or Instant Form, we also receive your name, contact details, qualification answers, submission time and campaign, ad and form identifiers. Depending on the destination, the answers collected on our site may include address and emergency contact, occupation, family details, citizenships, travel history, military service, religion, visa refusals or criminal history. After payment, a passport data page and face photo are collected separately. Card data goes directly to Cardcom and is not stored by us. Technical usage data is collected only according to your cookie choice.

3. Purposes and required information

Order data is used to prepare, check and file the visa application, receive the authority's decision, provide support and contact you to complete an application you started, secure the service, prevent fraud, process payment, keep required accounting records and protect legal rights. If you ask us to contact you through a Meta lead form, we use the details to respond to that specific visa enquiry and record its handling. A callback request is not consent to future marketing or to customer-list advertising. Such use takes place only after separate, explicit consent that is not a condition of service and may be withdrawn. Required details and documents are provided voluntarily, but the service cannot be supplied without them. Optional fields are marked. Analytics and advertising are not required and run only after the relevant choice.

4. Recipients and service providers

Information may be transferred to the immigration authority, embassy, consulate or authorised visa centre at the destination. Providers acting for us include Vercel for hosting, Upstash for order and lead data, Resend and email providers for messages and documents, Cardcom for payment, and Google Analytics, Microsoft Clarity or Meta Pixel only with the relevant consent. When an enquiry is submitted inside Facebook or Instagram, Meta collects it and sends it to us under its own terms and privacy policy. If separate advertising consent was given, we may send Meta minimal hashed contact identifiers and commercial lifecycle events to measure lead quality, improve campaigns or create a matched audience. We do not send Meta passport numbers, travel documents, face photographs or sensitive visa-application answers. A WhatsApp link opens Meta's external service at the user's choice. We do not sell or rent personal information.

5. International transfers

Destination authorities and some infrastructure providers are outside Israel. Information may therefore be processed in countries with different privacy standards. Transfers are made to perform the service or through providers subject to appropriate safeguards and the applicable law. A foreign authority then applies its own law and policy.

6. Retention, security and minimisation

We use TLS, limited access permissions, signed links and separation between customer and administration interfaces. Passport scans and face photos go directly to the operations mailbox and are not kept as file storage on the web server. An unconverted lead, including a Meta enquiry, is kept for up to 90 days to answer the enquiry and conduct reasonable follow-up. It is then deleted or anonymised unless there is an order, an active request or a legal duty. Minimal evidence of consent, withdrawal or an opt-out may be retained as required to demonstrate compliance and prevent further contact. Order data is retained only for handling, enquiries and legal or accounting duties. Information no longer required is reviewed and deleted subject to mandatory retention. No system is completely immune from unauthorised access.

7. Cookies and analytics

Essential storage remembers the order stage, restores a draft, protects the service and retains an affiliate referral code. Campaign attribution and our internal funnel measurement, when enabled, require Analytics consent. Internal measurement stores a random visit identifier, acquisition source, product, milestones and server-confirmed payment amount, without traveller details or form contents. Visit records are kept in Upstash for up to 90 days. A visit renews after 30 minutes without measured activity or after 24 hours. Google Analytics and Meta Pixel each require the relevant consent. You may refuse or change your choice through Cookie settings in the footer. Withdrawing Analytics consent removes local tracking storage and requests deletion of the visit data; a failed deletion request is retained only for retry. Operational order records and responses submitted directly through a Meta Instant Form are separate and do not depend on the site's cookie setting. Meta may process interactions that occur inside Facebook or Instagram, including opening or submitting a form, under its own terms and settings. We may use an audience of form submitters only to exclude them from being shown the same acquisition ad again. Feedback to Meta about lead quality, customer-list use or an audience based on contact details we hold occurs only under the separate consent given for that purpose and applicable law. See the Cookie Policy for details. When configured, Microsoft Clarity helps us understand interactions through masked session recordings, heatmaps, clicks and scrolling. It loads only after Analytics consent on selected public content pages. Application, payment, order, document, cancellation and account pages are excluded. URLs with query strings or fragments and unsafe referring URLs are excluded. Page content has explicit masking, and Strict Masking is required in Clarity settings. Recording stops at in-page navigation until a new page is loaded. Clarity analytics storage follows Analytics consent, while advertising storage follows Marketing consent independently. Withdrawing consent updates Clarity and stops further collection; accessible first-party Clarity cookies (_clck and _clsk) are removed when Analytics consent is withdrawn. Clarity is used to understand behaviour and is not our source for purchases or revenue.

8. Your rights

Subject to applicable law, you may request access, correction, deletion where there is no continuing basis for retention, restriction of certain use or withdrawal of non-essential consent. You may withdraw marketing consent at any time, ask us not to contact you again and ask to be excluded from future matched audiences. Email support@yallabye.co.il. Reasonable identity verification may be required. Deletion by us cannot erase information already transferred to a foreign authority or a provider required to retain it by law.

9. Israeli Privacy Protection Law and Amendment 13

Processing is governed by the Israeli Privacy Protection Law, 5741-1981, including Amendment 13 and the Data Security Regulations. We apply purpose limitation, data minimisation, appropriate permissions, accuracy and security. A database that is not subject to registration remains subject to the other duties under the law.

10. GDPR and CCPA

The service is aimed primarily at Israelis and does not expressly target people in the European Union or California. The GDPR may apply if services are intentionally offered to people in the EU or their behaviour there is monitored. Analytics and advertising therefore require consent and privacy requests are supported. The CCPA is not expected to apply at present because the business does not meet its revenue or processing thresholds and does not sell personal information. This will be reviewed if operations change.

11. Updates and contact

We may update this policy when the service, providers or law change. The date appears above and a material change will trigger fresh consent where required. Email support@yallabye.co.il or message us on WhatsApp only at 055-503-1046.