Privacy Policy – United Match

Who we are

The website and services are operated by United Match ("United Match", "we", "us") in Israel.

For the purposes of the Israeli Privacy Protection Law, 5741-1981 (the "Privacy Protection Law"), we are the controller of the databases that hold the information described in this policy. For users in the European Union, we are the "controller" within the meaning of the EU General Data Protection Regulation (the "GDPR").

Privacy contact: privacy@united-match.com

Scope of this policy

This policy applies to:

• visitors to the public pages of https://united-match.com (home page, membership, about, events, halacha, contact and similar pages);
• registered members who create a matchmaking profile ("card");
• people whose card is created or managed on their behalf by a family member, a contact person or a matchmaker;
• people who contact us, ask a halachic question, register for an event, or buy a membership;
• staff users of the platform (matchmakers, employees, rabbis and administrators), to the extent their data is processed through the platform.

It does not apply to external websites or services that we link to (for example, WhatsApp when you click our WhatsApp link). Those services have their own privacy policies.

Cards created for someone else: a parent, relative, contact person or matchmaker may create or fill in a card for you. We process that information on their instructions until you complete account registration (claim). When you complete registration you must confirm that you are 18+, accept the terms and this policy, and consent as the data subject.

Is providing information required?

You are not legally obliged to give us any personal information. Everything you provide is given voluntarily and with your consent.

However, some information is needed for the service to work. Without an email address or phone number and a password we cannot open an account. Without the basic profile details (for example name, gender, date of birth, city, marital status, and religious level and community), we cannot suggest suitable matches. Where a field is optional, leaving it empty will not stop you from using the service, but it may make our suggestions less accurate.

The information we collect

4.1 Account and contact details

First and last name, email address, phone number, password (stored only as a one-way cryptographic hash), preferred language, account status and roles, and confirmation of acceptance of our terms and this privacy policy. When you purchase membership or complete registration we ask for an Israeli ID or passport number as your signature on the matchmaking-fee undertaking; the number is stored encrypted (fingerprint and last three digits for display). We keep consent records (time, type, document version, success-fee amount shown, language, IP address and browser string where available). If you enable two-factor authentication, we store the secret needed to verify codes; when 2FA is active on your account, a one-time code is required at login.

4.2 Matchmaking profile ("card")

The profile questionnaire may include:

• personal details: gender, date of birth, city of residence, height, marital status, whether you have children and how many, address and postal code (visible to staff only);
• religion and identity: religious level, community and affiliation, family origin (edah), Shabbat observance, negiah observance, prayer, Torah study, head-covering preference after marriage, whether you are a Kohen, and whether a Dor Yesharim screening is required;
• lifestyle: body type, smoking, alcohol, dress style, type of phone, hobbies;
• family: number of siblings and birth order, parents' names and professions, whether a parent has passed away, and parents' marital status;
• background and education: languages, driving licence, occupation and workplace, military or national service, education and institutions;
• preferences for a spouse: age range, preferred areas, preferred family origin, height range, willingness to relocate, and the preferred values for many of the fields above;
• about you: free-text descriptions of yourself, your values and what you are looking for;
• medical information (staff only): whether you have a medical limitation and its general type (for example, a chronic illness, a disability, mental health, regular medication or a genetic condition);
• premium members only: additional in-depth and situational questions and advanced preferences, some of which are marked for staff use only;
• references ("phones for inquiries"): the name, relationship and phone number of people who can be contacted about you (visible to staff only).

The exact questions may change over time. Questions marked "staff only" are not shown to other members.

4.3 Photos

Profile photos and a separate personal account photo (avatar), which you upload. Photos are reviewed by staff before they are approved. Photos are stored in private storage and are not publicly accessible. Photos are shown to a proposed match only in the photo-exchange process, and only after both sides have approved the exchange.

4.4 Identity and meeting verification

To keep the community safe, we may ask you to verify your identity. This includes an identity document number (Israeli ID or passport), which may also be collected as a record of your consent when you purchase membership or complete registration. We store numbers in encrypted form and use a secure fingerprint to prevent duplicate registrations; only platform administrators can view the full number after audited access with a stated reason; others see only the last three digits. Document images are not required at this stage. Verification may include a meeting with staff (in person or video) without recording unless we tell you otherwise in advance.

4.5 Matching and match-process data

Compatibility scores calculated by our matching rules, match suggestions and their status, your responses (accept or decline), meeting availability (days, hours, areas), scheduled meetings (date, location, notes), and the stage of your matchmaking process.

4.6 Messages and communications

Messages you exchange with other members or with staff through the platform's internal messaging, support tickets, contact-form enquiries, reports about other users, and block requests.

4.7 Staff notes

Our staff and matchmakers may keep internal notes, tasks and call summaries about their work with you (a customer-relationship record).

4.8 Halachic questions

If you ask a halachic question, we collect the question, its category and, if you are not logged in, your name and email address. You can ask anonymously. An answered question may be published on the site in edited and anonymised form if you agreed to publication or asked anonymously.

4.9 Events, membership and payments

Event registrations and tickets, membership plans, subscription status, payment amounts and dates, receipts, coupons and referral codes, and whether you agreed to receive marketing messages. Payments: at the time of this policy update, the site does not use an external payment processor and does not collect credit-card details. This section will be updated when a payment provider is connected.

4.10 Technical and security information

When you log in, give consents (terms, privacy, success fee, age) or perform other sensitive actions, we record security and audit information: date and time, action type, IP address and user-agent string where available. We also use the cookies and local storage described in section 11.

4.11 Browser push notifications

If you enable browser push notifications, we store your browser push subscription details (the push service endpoint and encryption keys) linked to your account. We also store a short device/browser label (for example, "Chrome on Android"), your UI language, and delivery status: last successful send time, last failure time, and a failure count (not the notification content). We use this to send alerts for the categories you turned on. Opening the site on a device where notifications are enabled, and a successful notification delivery, keep the subscription active. This data is removed when you turn notifications off on the device, when the browser revokes the subscription, or during periodic cleanup: subscriptions with repeated failures and no successful delivery for about 7 days, or subscriptions with no use on that device for about 60 days (for example, if you did not open the site in that browser).

4.12 Information we receive from others

Some information may come from other people rather than from you. For example, a parent, relative, contact person or matchmaker may create or manage a card on your behalf, or another member may report you or send you a message. Someone may also list you as a reference. If you give us information about another person, you confirm that you are allowed to do so and that you have told them about this policy.

Sensitive information

Because of the nature of matchmaking, much of the information on a card is highly personal. Some of it is considered "information of special sensitivity" under the Privacy Protection Law (as amended by Amendment 13) and a "special category of data" under the GDPR. This includes, for example, religious beliefs and observance, family origin, health information, intimate and family life (marital status, children, divorce or widowhood), and identity-document details.

We process this information only to provide the matchmaking service you have asked for, and only with your explicit consent. You can decide not to provide optional sensitive details, and you can ask us to delete them at any time. This may affect the quality of suggestions. Access to sensitive information is limited to staff who need it for their role. Health information and contact details are never shown to other members.

Why we use your information (and, for EU users, our legal basis)

Purpose	What this means	Legal basis under the GDPR (for EU users)
Creating and running your account	Registration, login, session management, account switching, password reset, email verification	Performance of a contract (Art. 6(1)(b))
Providing the matchmaking service	Building your card, calculating compatibility, suggesting matches, photo exchange, scheduling meetings, following up	Contract (Art. 6(1)(b)); for sensitive information, explicit consent (Art. 9(2)(a))
Safety and trust	Reviewing cards and photos, identity and meeting verification, handling reports and blocks, preventing fraud and abuse	Legitimate interests in keeping members safe (Art. 6(1)(f)); for sensitive information, explicit consent (Art. 9(2)(a))
Communication	Messages between members and staff, service emails (verification, password reset, match updates, receipts), answering enquiries	Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))
Halachic questions and events	Answering and, where applicable, publishing anonymised questions; managing event registration	Contract or consent (Art. 6(1)(b) / (a))
Membership and billing	Plans, subscriptions, receipts, referral rewards	Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c))
Marketing messages	Newsletters or offers, only if you agreed	Consent (Art. 6(1)(a)); in Israel, also section 30A of the Communications Law
Security and audit	Audit logs, detecting misuse, securing systems	Legitimate interests (Art. 6(1)(f)); legal obligation under data-security rules (Art. 6(1)(c))
Site statistics	Aggregated page-view and performance statistics through Cloudflare Web Analytics, and behavioural analytics (heatmaps and session replays) through Microsoft Clarity, only if you allow the "Statistics" category	Consent (Art. 6(1)(a))
Legal compliance and claims	Complying with the law, responding to authorities, establishing or defending legal claims	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

We do not sell your personal information, and we do not use it for third-party advertising.

Automated matching

Our system uses rules to calculate compatibility scores between cards. These rules use your answers and preferences, and include rules that prevent suggestions that are not compatible under Jewish law. Our staff or matchmakers review suggestions before they are sent to members. No decision that has a legal or similarly significant effect on you is made by automated means alone. You can ask us to explain how a suggestion was made, or to have a person review it.

Who receives your information

We share information only as needed for the purposes above:

• Other members: the parts of your card that are not marked "staff only" may be shown to members to whom you are proposed. Photos are shown under the photo-exchange process. Your phone number, email, address, references and medical information are not shown to other members.
• People who manage your card: if a family member, contact person or matchmaker manages your card, they can see and edit it.
• Our staff: employees, matchmakers, rabbis (for halachic questions) and administrators. Each sees only what their role requires, under our instructions and confidentiality duties.
• Cloudflare, Inc.: website hosting and delivery (Cloudflare Workers), private storage of photos and documents (Cloudflare R2), database connection service (Hyperdrive), sending service emails (Cloudflare Email Service), and, only with your consent, website statistics (Cloudflare Web Analytics).
• Microsoft Corporation (Clarity): only with your consent under the "Statistics" category — heatmaps, aggregated usage insights and session replays of how visitors use public pages of the site.
• Supabase, Inc.: hosting of our main database (PostgreSQL).
  These providers process information only on our instructions and under agreements that require them to protect it.
• Authorities and legal proceedings: where required by law or a court order, or where needed to protect the rights, safety or property of our members, the public or ourselves.
• Business transfers: if our business or its assets are sold or merged, the information may be transferred to the new owner, who will be bound by this policy.

International transfers

Our service providers may store or process information outside Israel. In particular:

• Cloudflare operates a global network. Its headquarters are in the United States.
• Microsoft Clarity may process analytics data in the United States and other Microsoft regions.
• Our database is hosted by Supabase in the EU (Ireland, eu-west-1).
• Photos and documents are stored in Cloudflare R2.

Transfers out of Israel are made in accordance with applicable law and, where required, contractual safeguards or recognised frameworks. Details about transfers and safeguards are available on request at privacy@united-match.com.

For EU users: the European Commission has recognised Israel as providing an adequate level of protection (Decision 2011/61/EU). Where information is transferred to a country without an adequacy decision (for example, the United States), we use appropriate safeguards such as the EU–US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. You can ask us for details about safeguards for a specific provider.

How long we keep information

We keep personal information only as long as needed for the purposes it was collected for, or as required by law. Then we delete or anonymise it.

Type of information	Retention period
Account, card, photos and match data	While your account is active; after a deletion request — a grace period of 30 days then anonymisation of identifying details, except as below
Cards and photos that were rejected in review	Up to 90 days, then deleted
Identity document numbers (verification)	While the account is active or needed for verification; rejected verification records — up to 90 days
Matchmaking-fee signature (encrypted document number)	After anonymisation — up to 7 years, as needed for accounting records and legal claims
Consent records (terms, privacy, success fee)	Time, kind, version and amount are kept; IP address and browser string are removed at anonymisation
Messages	While at least one party to the conversation remains active; after account deletion, message text you sent may remain visible to the other party and the sender is shown as "Deleted user"
Reports, blocks and safety records	As long as needed to protect members and prevent banned users from returning
Payment and receipt records	As required by tax and accounting law (7 years)
Audit and security logs	24 months
Login sessions	Up to 14 days, or until you log out
Anonymous cookie-consent records	24 months
Outbound notification delivery records (email/SMS/WhatsApp send log)	90 days
Browser push subscriptions	Until you turn notifications off or the browser revokes the subscription; periodic cleanup removes subscriptions with repeated failures and no successful delivery for about 7 days, or no use on the device for about 60 days
Unpublished halachic questions	Up to 24 months; published anonymised answers may remain on the site

Messages you sent to other members may remain visible to them after you delete your account, with the sender shown as "Deleted user".

Cookies and local storage

Cookies are small text files that a website stores in your browser. Local storage and session storage are similar browser features. We use only a small number of them, in two categories that match the options in our cookie banner.

Strictly necessary: always active. These are needed for the site to work and for security, or they remember a setting you actively chose. They cannot be switched off.

Statistics: off unless you allow it. This category may load:

• Cloudflare Web Analytics, which gives us aggregated information about page views and loading speed. According to Cloudflare, it does not use cookies or local storage and does not track you across websites. It runs a script in your browser and sends technical information to Cloudflare, such as the page address, referring page, browser type and performance measurements.
• Microsoft Clarity, which records session replays and heatmaps on public pages (for example clicks, scrolls and mouse movement), with masking of many form fields, so we can see how visitors use the site and fix usability problems. Clarity sets first-party cookies and sends interaction data to Microsoft. We configure Clarity so advertising storage stays denied. We do not run Clarity on signed-in member or staff areas.

We load these tools only after you consent. We do not use advertising or marketing cookies, and we do not use Google Analytics, Google Tag Manager, Meta (Facebook) Pixel or similar advertising trackers. Fonts are fetched from Google Fonts at site build time and served to your browser from our domain, so during normal browsing no external font service receives your IP address.

Name	Type	Purpose	Duration	Category
um_session	Cookie (first-party, HttpOnly, Secure)	Keeps you logged in	Up to 14 days, or until logout	Strictly necessary
um_accounts	Cookie (first-party, HttpOnly, Secure)	Lets you switch between several accounts logged in on the same browser	Up to 14 days	Strictly necessary
um_consent	Cookie (first-party)	Remembers your cookie choice and the policy version you agreed to	6 months	Strictly necessary
nuxt-color-mode	Local storage	Remembers dark or light display mode	Until you clear it	Strictly necessary
NegishutPos	Local storage	Remembers the position and settings of the accessibility menu	Until you clear it	Strictly necessary
messages-inbox-collapsed	Local storage (logged-in area)	Remembers the layout of your message inbox	Until you clear it	Strictly necessary
luxury-table:*	Local storage (staff area)	Remembers which table columns a staff user chose to show	Until you clear it	Strictly necessary
inline-edit-table:*	Session storage (staff area)	Remembers table layout during the current browser tab	Until the tab is closed	Strictly necessary
Profile-card session storage keys	Session storage (logged-in area)	Temporary state while working with profile cards	Until the tab is closed	Strictly necessary
Cloudflare Web Analytics (static.cloudflareinsights.com)	Script, no cookies	Aggregated page-view and performance statistics	No data stored in your browser	Statistics
_clck	Cookie (first-party, Microsoft Clarity)	Persists a Clarity visitor id and preferences	Up to 1 year	Statistics
_clsk	Cookie (first-party, Microsoft Clarity)	Connects page views into one Clarity session	1 day	Statistics
Microsoft Clarity (clarity.ms)	Script	Heatmaps and session replays of site usage	See _clck / _clsk	Statistics

Your choice and how to change it. On your first visit, a banner lets you "Accept all", "Reject all" or "Customize". You can change your choice at any time by clicking "Cookie settings" at the bottom of every page. If you withdraw consent, we stop statistics scripts, tell Clarity that consent was withdrawn (which erases its cookies for this site), and reload the page so recording cannot continue. Your choice is stored only on the device and browser you are using. It is not linked to your account, so you may be asked again on another device. We ask again after 6 months or when this policy's version changes.

Consent records. To be able to show that consent was given, we keep an anonymous record of each choice: a random identifier, the date and time, the policy version, the choices made and your language. It does not include your IP address, name or account. We keep these records for 24 months.

You can also block or delete cookies through your browser settings. If you block strictly necessary cookies, you will not be able to log in.

How we protect your information

We apply security measures appropriate to the sensitivity of the information, in line with the Privacy Protection (Data Security) Regulations, 5777-2017. They include:

• encrypted connections (HTTPS) for all traffic;
• passwords stored using a strong one-way hash (scrypt), and session tokens stored only in hashed form;
• login cookies that cannot be read by page scripts;
• two-factor authentication (when enabled — required at each login);
• role-based access so that staff see only what they need;
• private storage for photos and documents, served only after an access check;
• audit logs of sensitive actions.

No system is completely secure. Cloud providers (Cloudflare, Supabase) offer encryption in transit and at rest under their terms. If a serious security incident occurs, we will act as required by law, including notifying the Privacy Protection Authority and, where required, affected users.

Your rights

Under Israeli law, you have the right to:

• access the information about you held in our databases (section 13 of the Privacy Protection Law). You can do this yourself, through a representative authorised in writing, or through a guardian;
• ask us to correct or delete information that is inaccurate, incomplete, unclear or out of date (section 14);
• ask to be removed from any direct-marketing list (section 17F), and withdraw consent to marketing messages at any time.

If you are in the European Union, you also have the right to:

• access a copy of your data;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw consent at any time (this does not affect processing carried out before withdrawal);
• lodge a complaint with the data protection supervisory authority in your country of residence or work.

How to exercise your rights. You can view and edit most of your card in your account. In account settings you can request account deletion (after a grace period) and download a copy of your data as JSON. For other requests contact privacy@united-match.com or united4match@gmail.com. We may ask you to verify your identity. We will respond within the time set by law (generally 30 days).

Complaints in Israel. You may contact the Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority).

Children and minimum age

The service is intended only for people aged 18 or over. We do not knowingly collect information about minors. If we learn that a card belongs to a minor, we will delete it. Cards created by a parent or matchmaker require 18+ confirmation when the data subject completes registration. If you believe a minor is using the service, please contact us.

Service messages and marketing

We send service messages that relate to your account and the service. These include email verification, password reset, match and meeting updates, answers to halachic questions, and payment receipts (you can turn off receipt emails in your billing settings). We send marketing messages only if you have agreed. You can withdraw consent at any time in account settings or by contacting privacy@united-match.com.

Registration of databases and Data Protection Officer

We follow registration and notification requirements under the Privacy Protection Law as amended. Details about database registration or appointment of a privacy officer, if applicable, will be published in this policy or provided on request at privacy@united-match.com.

For users in the European Union: if an EU representative is required under Article 27 of the GDPR, their details will be published here or provided on request at privacy@united-match.com.

Contact us

For any question about this policy or your information:

• Email: united4match@gmail.com
• Phone: 0555709347

Changes to this policy

We may update this policy from time to time. The version number and "last updated" date at the top show the current version. If we make a material change, especially one about new uses of your information or new categories of cookies, we will tell you on the site or by email. We will also ask for your cookie consent again, because changing the policy version shows the cookie banner again.