Privacy Policy

This Privacy Policy explains how Kaligon Ltd (“Kaligon”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal data in connection with the kaligon.cloud website and the Kaligon Cloud platform at my.kaligon.cloud (together, the “Services”). It is written to meet the requirements of Israel’s Protection of Privacy Law, 5741-1981 and its regulations, and — for individuals in the European Economic Area (EEA), the United Kingdom, and Switzerland — the EU and UK General Data Protection Regulation (“GDPR”).

1. Who we are (controller)

The controller of your personal data is Kaligon Ltd, a company incorporated in the State of Israel (company no. 515713865), with its registered office at Yaakov St 26, Rehovot, 7626237, Israel. For any privacy matter you can reach us at hello@kaligon.cloud.

2. Scope

This policy covers personal data we process as a controller — about visitors to our website and holders of Kaligon accounts. Where we host content and data inside your cloud resources (virtual machines, storage, databases), we act as a processor on your behalf; that relationship is governed by our Terms of Service and our Data Processing Addendum (“DPA”), which reflects Article 28 of the GDPR. This policy does not change your ownership of that content.

3. Personal data we collect

• Account data — name, email address, hashed password, organization name, role, and preferences.
• Billing data — billing name and address, tax identifiers, payment-method tokens (we do not store full card numbers; payments are handled by our processor, Stripe), and invoice history.
• Usage and service data — resource configurations, project and team membership, API call metadata, and audit logs (retained for 90 days).
• Technical data — IP address, device and browser information, and request timestamps, processed for security and abuse prevention and retained for up to 90 days.
• Communications — support tickets, emails, and other correspondence you send us.

We do not run third-party advertising trackers, cross-site analytics, or session-replay tools on the website or the panel.

4. How we use your data and our legal bases

We process personal data to the extent necessary to:

• Provide the Services — create and manage your account, deploy and meter resources, and provide support (legal basis: performance of a contract).
• Bill and collect payment — issue invoices and process payments (performance of a contract; compliance with tax and accounting law).
• Keep the Services secure — detect, prevent, and investigate fraud, abuse, and security incidents (legitimate interests; legal obligation; and Israel’s data-security requirements).
• Communicate with you — send service, security, and billing notices (performance of a contract / legitimate interests), and product updates where permitted (consent, which you may withdraw at any time).
• Comply with law — respond to lawful requests and meet our legal obligations (legal obligation).

5. Cookies and similar technologies

The panel uses a single first-party cookie strictly necessary to keep you signed in. The marketing website sets no advertising or cross-site tracking cookies. Because we rely only on strictly necessary and first-party functionality, we do not display tracking-consent banners; you can still control cookies through your browser settings.

6. Sharing and sub-processors

We do not sell or rent personal data. We share it only with service providers (“sub-processors”) that help us run the Services under contract and on our instructions, including:

• Payments — Stripe, for payment processing and fraud prevention.
• Infrastructure and hosting — our datacenter and infrastructure partners in the regions we operate (Texas and New York in the United States, London in the United Kingdom, and Amsterdam in the Netherlands).
• Transactional email — an email delivery provider for account, security, and billing messages.

A current list of sub-processors is available on request at hello@kaligon.cloud. We may also disclose data where required by law, to protect our rights or users’ safety, or in connection with a merger or acquisition (with notice).

7. Where your data is stored and international transfers

We process and store account and billing metadata on our infrastructure within the regions in which we operate. Your cloud workloads remain in the region you choose to deploy them, and we do not copy workload data across regions without your action. As an Israeli company, we and some of our providers may access personal data from Israel. Israel benefits from a European Commission adequacy decision, on which we rely for transfers from the EEA to Israel, and we monitor the status of that decision. Before personal data is transferred to a country without an adequacy decision (such as the United States), we assess the transfer and apply appropriate safeguards — including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum — together with supplementary technical and organizational measures.

8. Data retention

We keep personal data only as long as needed for the purposes above: account data for the life of your account; audit and technical logs for 90 days; and billing records for the period required by Israeli tax and accounting law (generally seven years). When data is no longer needed, we delete or anonymize it.

9. How we protect your data

We maintain technical and organizational security measures appropriate to the risk, consistent with Israel’s Protection of Privacy (Data Security) Regulations, 5777-2017, including encryption in transit and at rest, access controls and least-privilege, network segmentation, logging and monitoring, and regular review. No method of transmission or storage is perfectly secure, but we work to protect your data. If a security incident affecting personal data occurs, we will notify the Israeli Privacy Protection Authority and affected individuals where the Data Security Regulations require, and — for personal data of individuals in the EEA or UK — notify the competent supervisory authority within 72 hours and affected individuals without undue delay where the GDPR requires.

10. Your rights

Subject to applicable law, you may ask to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Residents of Israel have rights of access and correction under the Protection of Privacy Law; individuals in the EEA/UK have the rights set out in the GDPR. To exercise any right, email hello@kaligon.cloud. We respond within 30 days and will not discriminate against you for exercising your rights.

If you believe we have mishandled your data, you may lodge a complaint with the Israeli Privacy Protection Authority (PPA) or, in the EEA/UK, with your local data protection supervisory authority.

If you are a resident of a US state with a comprehensive privacy law (such as California), you may also have the right to know about, access, delete, correct, and obtain a copy of your personal data, and to opt out of any “sale” or “sharing” of it. We do not sell or share personal data as those terms are defined. To exercise these rights, email hello@kaligon.cloud.

11. Children

The Services are intended for businesses and adults. We do not knowingly collect personal data from anyone under the age of 16, and you must be at least 18 (or the age of majority where you live) to hold an account.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a revised “Last updated” date and, for material changes, notify account holders by email at least 30 days before the changes take effect.

13. Contact

Questions, requests, or complaints about privacy: hello@kaligon.cloud. General contact: hello@kaligon.cloud.