מדיניות פרטיות — נדל"ן Online

1. About this policy

This policy explains how ComsignTrust Ltd. ("ComsignTrust", "we") handles personal information in Nadlan Online, the digital-signing service for real-estate agreements at nadlan.comsigntrust.com. It supplements the ComsignTrust general Privacy Policy; where the two differ for Nadlan Online, this policy applies.

2. Who is responsible

ComsignTrust Ltd. is responsible for the account information of the people who use Nadlan Online. The documents, and the details of the clients and participants that an organization (a real-estate agency or a law office) enters into the service, are processed by ComsignTrust on behalf of that organization and according to its instructions.

3. Information we process

• Account information — name, user name, email address, organization, and role.
• Documents — the agreements and other files users upload, fill in and sign, and their signed versions.
• Participants and signatures — details users enter about signers (such as name, ID number, email and phone number), the signatures captured, and lawyers' smart-card signing certificates.
• Remote signing — the signing links sent to participants by email or SMS, their status, and technical details of when a link was opened.
• Video meetings — the participant, time, length, description and link of each meeting a user schedules.
• Connected accounts — when a user connects Google or Zoom: the account's email address and the access tokens for it.
• Video meetings log — for each meeting a user creates with Zoom, Google Meet or ComSign Meet: the tool, the user, the client's name and the scheduled time; for ComSign Meet meetings also each session's start, end and length, the names participants entered with their join and leave times, and whether a recording ran; for Zoom and Google Meet meetings, the times the user opened the meeting from Nadlan Online.
• Technical information — activity records, error reports and connection logs needed to operate, secure and support the service.

4. How we use information

We use this information only to provide Nadlan Online: to present, sign, store and manage documents; to send signing invitations; to create video meetings the user asks for; to keep the service secure; to provide support; and to meet legal obligations. We do not use it for advertising and we do not sell it.

5. Google user data

A user may connect their own Google account (Settings → Video meetings) so that Nadlan Online can create Google Meet meetings for them.

• Data accessed: the calendar.events permission — to create, update and delete events in the user's Google Calendar — and the Google account's email address.
• Use: Nadlan Online creates one calendar event, with a Google Meet link, for each meeting the user schedules in the app, and updates or deletes that event when the user edits or deletes the meeting. The email address is used only to show the user which account is connected.
• Limits: Nadlan Online does not read other calendar events, does not add attendees, and does not send messages or invitations on the user's behalf.
• Sharing: Google user data is not sold, not shared with or transferred to third parties, and not used for advertising. It is not used to train artificial-intelligence or machine-learning models.
• Storage and security: the access tokens are stored encrypted, and are deleted when the user disconnects the account or their Nadlan Online user is deleted.
• Control: users can disconnect at any time in Settings, or revoke access on their Google Account permissions page.

Nadlan Online's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Zoom user data

A user may connect their own Zoom account (Settings → Video meetings) so that Nadlan Online can create Zoom meetings for them. See the Zoom integration guide.

• Data accessed: the meeting:write:meeting, meeting:update:meeting and meeting:delete:meeting permissions — to create, update and delete the meetings the user schedules in the app — and user:read:user, for the Zoom account's email address and user ID.
• Use: Nadlan Online creates one scheduled Zoom meeting for each meeting the user schedules in the app with Zoom, and updates or deletes that meeting when the user edits or deletes it. The email address is used only to show the user which account is connected; the user ID only to recognize Zoom's notice that the user removed the app.
• What is stored: the ID and join link of each meeting the app created, the Zoom account's email address and user ID, and the access tokens.
• Limits: Nadlan Online does not read the user's other meetings, recordings, chats or contacts, and does not invite anyone or send messages on the user's behalf.
• Sharing: Zoom user data is not sold, not shared with or transferred to third parties, and not used for advertising. It is not used to train artificial-intelligence or machine-learning models.
• Storage and security: the access tokens are stored encrypted. They are deleted when the user disconnects Zoom in Settings, when the user removes the app in Zoom (Zoom notifies Nadlan Online, which deletes the connection at once), or when their Nadlan Online user is deleted.
• Control: users can disconnect at any time in Settings, or remove the app in the Zoom App Marketplace under Manage → Added Apps.

7. ComSign Meet video meetings

Nadlan Online can also create video meetings with ComSign Meet. No user account or sign-in is needed: the meetings are created through Nadlan Online's own ComSign Meet organization account.

• Data sent: for each meeting a user schedules with ComSign Meet — its title (which names the participant), description, time and length.
• Joining: anyone with the meeting link can join directly, without a waiting room. Participants enter the name they want to be shown.
• What ComSign Meet stores: the meeting details; the names participants enter; attendance (name, role, join and leave times); chat messages sent in the meeting; whiteboard snapshots; and browser diagnostic logs (errors, connection quality and IP address), which are deleted after 30 days. Audio and video pass through ComSign Meet's server and are not stored there.
• No transcription or AI: transcription, captions and AI summaries are turned off for Nadlan Online's meetings, and no audio or text is sent to any artificial-intelligence provider.
• Recording: a meeting can be recorded only if the user who created it allowed this, and then only by that user, who joins as the meeting's host — participants who join through the meeting link cannot record. The recording is made in the host's browser and, when the meeting ends, the host is offered to save it on their own computer. ComSign Meet also keeps a temporary copy on its server, so that a dropped connection or a closed browser does not lose the recording; that copy is deleted automatically within two days. Nadlan Online does not keep recordings and offers no way to download them. Everyone in the meeting is notified when a recording starts. Nadlan Online cannot prevent a participant from recording their screen by other means.
• Location and retention: ComSign Meet runs on a server in Israel (Amazon Web Services, Tel Aviv region). Meeting details, attendance and chat are kept by ComSign Meet, also after a meeting is cancelled, and are not deleted automatically.
• What Nadlan Online stores: the ID and join link of each meeting it created, and — for the video meetings log (section 3) — each session's times, the names participants entered with their join and leave times, and whether a recording ran. Deleting a meeting in Nadlan Online cancels it in ComSign Meet, and its link stops working; its entries in the log are kept for the log's retention period.

8. Accessibility menu: read-aloud and voice commands

• Read-aloud uses the speech voices of the user's browser and operating system. The text being read is not sent to Nadlan Online; when the voice the browser offers is an online one, the browser may send that text to its provider (such as Google or Microsoft) to speak it.
• Voice commands are off unless the user turns them on in the accessibility menu, and are never turned on again by themselves on a later visit. While they listen — a notice stays on screen the whole time — the browser sends the sound from the microphone to its own speech-recognition service (for example Google in Chrome, Microsoft in Edge, Apple in Safari) to turn it into text. Nadlan Online receives neither the sound nor the recognized text: the commands are carried out in the browser and nothing is stored. The browser asks for permission to use the microphone, and the user can withdraw it in the browser's settings at any time.
• The menu's other choices are kept only in the browser (local storage) and are not sent to Nadlan Online.

9. Sharing information

We share information only with service providers that operate Nadlan Online for us — cloud hosting and storage, and email and SMS delivery for signing invitations — and only as needed for that purpose; with Google or Zoom when a user chooses to connect them; with ComSign Meet for the meetings a user creates with it; and where the law requires it. We do not sell personal information.

10. Retention

Documents and related information are kept for as long as the organization keeps them in the service, and are deleted when the organization deletes them or its account is closed. Connected-account tokens are deleted when the account is disconnected. The video meetings log is kept for the period set by the service's administrators, after which its entries are deleted automatically, and is deleted with the user's or the organization's account. Technical logs are kept only as long as needed for security and support.

11. Security

The service is accessed only over encrypted connections (HTTPS). Access is limited to authorized users of each organization according to their role, connected-account tokens are encrypted at rest, and documents are signed with standard digital signatures so that changes can be detected.

12. Your rights

You may ask to access, correct or delete your personal information, as described in the ComsignTrust general Privacy Policy. To exercise these rights, write to support@comda.co.il. If you are a client or participant of an organization that uses Nadlan Online, please contact that organization first; we will assist it in handling your request.

13. Children

Nadlan Online is a business service and is not intended for children.

14. Changes

We may update this policy. The date at the top shows when it was last changed.

15. Contact us

ComsignTrust Ltd., Kiryat Atidim, Building 4, Tel Aviv, Israel · support@comda.co.il. Contact details of our Data Protection Officer appear in the ComsignTrust general Privacy Policy.