PureSight Privacy Policy

PureSight Technologies Ltd. (“PureSight”, “we” or “us”), 23 Ha’atas Street, Kfar Saba 4442525, Israel, is responsible as controller for processing where it decides why and how personal data are used. Contact support@puresight.com or info@puresight.com for privacy questions or rights requests.

The Service is available directly from PureSight and through partners, including multi-tier distribution arrangements. A partner is responsible for information it processes for its own purposes, such as purchase, eligibility or billing administration, as explained in its privacy notice. A partner’s involvement in selling the Service does not, by itself, give it access to a child’s monitoring information.

Where PureSight processes information solely on another organisation’s instructions, that organisation is responsible for determining the purpose of that processing and providing the relevant privacy information. You can contact us using the details above for help identifying the organisation responsible for a particular use of your information.

The account holder and the monitored child are different people with separate rights. We may also receive information about people with whom the child communicates. We collect data from information entered in the account, enabled device features, service use and support interactions. Information used to activate a partner-distributed Service can also come from the provider of that offer.

The categories relevant to your product can include:

• Account information: name, email address, telephone number where required, authentication information, subscription or licence/entitlement status, account settings and whether the account uses the Service.
• Child profile information: name or nickname, age or age range, and any optional profile information actually offered by the product. Provide only information needed for the selected features.
• Device and service information: device model, operating system, technical identifiers, permissions, diagnostic events and security logs.
• Web and application activity: visited web addresses, applications installed or used, usage duration and related filtering or time-management settings, where those features are enabled.
• Location information: the device’s location, location history and geofencing events, where available and enabled.
• Communication content and related alerts: the messages, posts or other content supported by the particular monitoring feature, the context necessary to detect potential harm and resulting classifications or alerts.
• Support and transaction information: communications with support and information needed to manage the relevant order or service entitlement. Payment-card handling, if relevant, is described by the actual payment provider.

Collection is limited to the supported features and permissions in your plan. Not every category is collected on every device. The supported platforms and collection scope depend on the selected feature and operating system.

Where enabled and supported by your product, the Service can process content from social and communication platforms, for example TikTok, Instagram, Viber, WhatsApp and LINE, as well as other supported platforms. This may include private messages or chats, not only public posts. Actual collection and analysis depend on the platform, device, operating-system and application versions, enabled features and permissions. Naming a platform does not mean that every type of content or the same functionality is supported on every device.

We use personal data for the purposes described below, subject to applicable data-protection law. References to the GDPR apply where that law governs the processing. Accepting the licence agreement or acknowledging this notice is not blanket consent.

Account and service administration. We use an adult account holder’s information to create and manage the account, provide the service they request, manage entitlement and respond to service requests. Where the adult is a party to our contract and the processing is objectively necessary for that contract, the basis is Article 6(1)(b) GDPR. This basis does not automatically extend to the child’s data or to every optional feature.

Child-protection functions. Enabled functions may process activity, location or communications to filter content, apply agreed controls, assess potential risks and make relevant information available to the authorised parent. The child and other people whose information appears in communications have their own data-protection rights; the parent’s service contract does not remove those rights.

Partner administration and adoption reporting. Relevant partners receive account and licence details and account-linked information indicating whether the Service is used, so they can administer the offer and encourage adoption. This reporting is distinct from disclosing a child’s detailed browsing, location or conversations.

General usage insights. We use general usage information to understand overall patterns and share project-level usage patterns with the relevant partner. These reports concern the project as a whole rather than analysis of an individual customer. Aggregation is not automatically irreversible anonymisation: if information remains identifiable or linkable, the applicable data-protection rules, legal basis and retention limits continue to apply.

Security and prevention of misuse. We process proportionate technical and account information to protect accounts and the Service and investigate misuse. Where applicable, this is based on our legitimate interest in maintaining a secure service under Article 6(1)(f), with safeguards to protect users, particularly children. Where a specific obligation under EU or Member State law requires the processing, Article 6(1)(c) applies.

Support and disputes. Processing needed to answer a contracting adult’s service request is based on Article 6(1)(b). Proportionate processing to investigate complaints, establish facts or defend legal claims may be based on Article 6(1)(f). Information retained to meet an applicable duty under EU or Member State law is processed under Article 6(1)(c). We identify the relevant legal duty where this is the basis. We also retain the limited financial records needed for accurate financial administration and compliance with applicable Israeli bookkeeping requirements, as described in section 7. An Israeli duty does not, by itself, establish an Article 6(1)(c) GDPR basis.

Protection analysis and detection systems. Detailed child activity data are used for the child-protection Service, not for an unrelated purpose or an external service’s own use. Account-level adoption reporting and general project-level insights are described separately above. Pseudonymised or coded information remains personal data where it can be linked to someone. The retention limits in section 7, including the 30-day active-system limit and the separate backup period, are not extended by describing a dataset as training or evaluation data.

Optional communications and website technologies. Where we send optional promotional communications or use non-essential cookies or similar technologies, we obtain consent when required and provide an effective way to refuse or withdraw it. Service notices necessary to operate an account are distinct from marketing.

Child-protection features require particular care because information may be highly private and may reveal health, religion, ethnicity, sexuality or other special-category information. Merely encountering this information does not remove the need to assess Article 9 GDPR and any other applicable restrictions. We process this information only where the applicable legal basis and any required additional condition permit it.

A parent’s permission is not a substitute for evaluating the child’s rights, necessity, proportionality and best interests. Children are entitled to age-appropriate information and safeguards suited to the feature and their circumstances. The adult must explain monitoring appropriately and must not use the Service for unauthorised surveillance.

Where a service is offered directly to a child and processing relies on consent, the applicable local age threshold and parental-authorisation rules apply. These rules do not automatically authorise every form of parent-directed monitoring.

Communications can contain information about other people. We limit collection, access and disclosure to what is necessary for the approved protection purpose and apply the transparency obligations that are relevant to information not obtained directly from the person concerned.

Information for children should be read and explained in a language and manner they can understand before monitoring is enabled.

The authorised parent can receive information and alerts made available by the enabled features. Account access is limited to properly authorised people. Parents should explain what is visible before activating a feature.

Technical service providers may process information on our instructions where necessary to operate the Service, including AWS hosting. We require contractual and security safeguards appropriate to their role. They are not permitted to use activity data for their own independent services or purposes. This is different from making protection information available to the authorised parent within the Service.

For a partner-distributed offer, sharing is limited to the relevant service-administration and reporting purposes. A commercial relationship does not give a bank, insurer or distributor unrestricted access to a child’s location, messages or activity.

The relevant partner receives account and licence details, account-linked used/not-used status for adoption, and general project-level usage patterns. Account-linked adoption reporting and project-level reporting are different disclosures. The latter is not an individual-customer analysis; neither is described as anonymous merely because it is called a statistic. The relevant partner is the organisation involved in supplying or administering your offer.

Children’s detailed activity data are used for child protection and are not supplied to external services for their own use. Technical hosting and access by the authorised parent are part of operating the Service, not independent external uses.

We may disclose information where required by applicable law or a valid legal process, or where necessary and lawful to establish or defend legal claims. A corporate transaction does not remove data-protection obligations: any transfer must have a lawful basis, appropriate safeguards and the notices required by law.

We do not sell personal data or use children’s monitoring information for targeted advertising.

PureSight is based in Israel. European customer data are hosted on AWS servers in Europe. PureSight also uses servers in the United States for other purposes; that fact does not mean European customer data are hosted there. Hosting within the EEA does not by itself exclude transfers arising from remote access or other processing. Processing outside your country remains subject to the safeguards required by applicable law.

Where the European Commission has recognised an adequate level of protection, we may rely on that decision within its scope. For a transfer not covered by an adequacy decision, we use an applicable Chapter V GDPR mechanism, such as the European Commission’s standard contractual clauses, together with any necessary assessment and supplementary measures. The location of a provider’s headquarters alone does not establish where data are processed or remotely accessed.

You may contact us using section 1 to request information about applicable transfer safeguards and how to obtain a copy.

We keep identifiable data only for as long as necessary for the stated purpose and any applicable legal requirement. A retention period is measured from the relevant event, such as collection, account closure or resolution of a support request.

Activity data collected by the Service, including websites visited, locations, conversations on supported social platforms, screen usage and application usage, are kept in our active systems for no more than 30 days from collection and then automatically deleted. Leaving the Service does not restart or extend this cycle; any remaining activity data in active systems are therefore deleted within 30 days after you leave. These data are used only to provide the child-protection Service.

We back up our databases daily. Routine backups are retained for 14 days and then deleted. Copies of activity data may remain in those backups for up to 14 additional days after deletion from active systems.

Account-level information, including account and licence records, policies and policy settings, is retained while the account exists. Leaving the Service does not automatically delete account details or configuration: under the current process, those records remain unless you expressly request deletion. This does not authorise retention beyond what is necessary and lawful. Specific financial or accounting records may remain subject to a separate legal retention obligation; that does not, by itself, justify keeping all account configuration or activity data.

Where Israeli bookkeeping requirements apply, we retain the accounting records needed to meet them, such as invoices, receipts and related payment and billing details, until the later of seven years after the end of the relevant tax year or six years after the income-tax return for that year was filed. These periods apply to the relevant accounting records, not automatically to your full service account, parental-control settings or monitored content. A further retention period requires a specific applicable legal requirement or a necessary legal-claims purpose, not a general extension of all data retention.

Financial backups are retained for seven years. This backup period is separate from, and does not replace or shorten, the legal retention period for accounting records described above.

Account closure and app removal are different actions. Uninstalling software may stop future collection from that installation but does not by itself erase information already held, close a subscription or necessarily stop collection from other linked devices.

You can request deletion through support@puresight.com. Where we must keep limited data for a legal obligation or a valid legal claim, we explain the relevant exception and restrict the retained data to that purpose. Anonymisation must make re-identification no longer reasonably possible; merely removing a name is not enough.

We apply technical and organisational measures appropriate to the risks, with particular attention to children’s communications and location information. These measures address access controls, authentication, secure transmission and storage, monitoring, incident response and supplier management as appropriate to the processing.

No service can promise absolute security. This does not reduce our legal duties to protect personal data or to notify a supervisory authority and affected individuals when the legal notification conditions are met.

Depending on the law that applies and its conditions, you may request access and a copy of personal data; correction; erasure; restriction of processing; and portability of data. The following rights and response periods apply under the GDPR where it governs the processing; other applicable local rights remain available. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object at any time to direct marketing, including related profiling.

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Withdrawal must be as easy as giving consent. We explain the practical effect on the relevant feature; withdrawal does not require giving up unrelated functions.

You also have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, except where law permits and requires appropriate safeguards.

Use the contacts in section 1 to make a request. We verify identity and authority proportionately and do not request excessive identity documents. A parent may act for a child where legally appropriate, but the child’s rights do not belong exclusively to the parent. We consider age, maturity, parental authority and any conflict of interests.

You can use available account controls or contact support@puresight.com to make a request. The absence of a particular export feature does not limit applicable access or portability rights.

We normally respond within one month of receiving a request. Where the law permits an extension because of complexity or number of requests, we will explain it within that first month. We will explain any refusal or lawful charge and the available complaint and judicial remedies.

You may complain to a competent supervisory authority, including in the EEA country where you habitually reside, work or where an alleged infringement occurred. You need not complain to us first and you retain the right to seek a judicial remedy.

Where enabled, automated tools may assess supported content or activity to identify potential risks and generate classifications, blocking actions or alerts. Results can be wrong or incomplete. A parent should consider context and discuss concerns appropriately rather than treating an alert as proof.

Essential technologies may be needed to operate a requested service. Non-essential cookies, SDKs and similar access to or storage on a device require the choices and consent required by applicable law. A device permission is not necessarily consent for every subsequent use of the collected information.

If you do not provide information or permissions necessary for a particular feature, that feature may not work. You are entitled to know which information is required and the consequences of not providing it. Optional information and optional consent must not be made a condition of unrelated services without a valid legal reason.

You can manage enabled features and child profiles through the controls made available in your account. Contact support for help with a privacy request or if a control is unavailable. A child’s direct controls and a parent’s access remain subject to the person’s legal rights.

We will update this notice when processing changes and identify the effective date. We will give appropriate advance or timely notice of material changes through a suitable channel. If a new purpose requires a new legal basis or consent, a notice update alone does not provide it.

This notice may be provided in different languages. No language version limits your rights under applicable law. If versions differ, we will correct the discrepancy; it cannot be used to reduce your statutory protections.

If another privacy law applies to you, you retain the rights and protections it provides. Contact us using section 1 so we can address your request under the applicable law.

Any additional privacy information supplied for your country or state explains the local provisions relevant to your use of the Service. Mandatory local protections prevail over any inconsistent statement in this notice.