Privacy policy

Who collects the data

The site is owned and operated by Giraffa Urban Experiences Ltd., company no. 516096815, Hanatziv 41, Tel Aviv, Israel. For any privacy question write to info@biss.tours.

What is stored in your browser

The site has no analytics, advertising or tracking tools, and no third party scripts, external fonts or embedded social media. Simply browsing stores nothing in your browser. The only things stored are ones you switch on yourself, and only so they work: the settings you choose in the accessibility menu, a note that you have already seen a message window, and one chat cookie if you start a conversation. Each is necessary for something you asked for, which is why there is no cookie consent banner here. The full detail is on the cookie policy page.

What we ask for, and when

Only what we need in order to answer you. Personal details are collected only when you choose to contact us:

• Contact form: name, email, your message, and a phone number that is optional
• Creator signup: name, email, phone, city, a link to your work if you have one, and a few words about you
• Chat, when it is available on the site: what you write, the page you wrote from, and an email address only if you choose to leave one to get a reply
• Simply browsing collects nothing about you. On a tour page we count one view of the tour, as a daily number only, with no cookie and nothing about who viewed it

What we use it for

Only to answer that specific enquiry or question, because you asked us to. We do not send marketing email to people who contacted us through the site, and we do not sell, rent or pass the data to third parties for marketing.

Newsletter

If you sign up for the newsletter at the bottom of the site, you get an email with a confirm button, and you join the list only after you click it. People who agreed to hear from us when buying or at the end of a tour join the same list. To learn what interests you and send less of what does not, we see whether a newsletter email was opened (through a small transparent image inside it), which links you clicked, and whether you bought a tour after a click. This stays with us, is not passed to anyone, and has nothing to do with browsing the site itself. If your email app blocks images, the open is simply not counted. You can unsubscribe at any time from the link at the bottom of every message.

Who answers the chat

When the chat is available, a smart assistant based on artificial intelligence (Claude, by Anthropic) answers first, and a human agent joins when you ask or when needed. Your messages are passed to the assistant so it can answer, and the conversation is stored in our customer service system. Your IP address is used only to prevent flooding, and is stored as a one way hash, not as the address itself. Please do not write card details or sensitive information in the chat.

Who receives it

Only our service providers, each only for what it needs:

• Vercel: hosts the site, and sees technical traffic data as any web server does
• Resend: delivers form enquiries to us by email
• Anthropic: the smart assistant in the chat
• Our own system at app.biss.tours: stores chat conversations and counts tour views

Transfers outside Israel

Some of these providers operate outside Israel, mainly in the United States, so the data may be processed there. We work only with providers that commit to protecting it.

Purchases happen elsewhere

This site markets and explains only; no purchase takes place here. Purchases happen in the system at app.biss.tours, which has its own privacy policy, and where payment details are handled by the payment processor. Card details never pass through us and are never stored by us. At checkout, the consents you tick are recorded with a timestamp.

How long we keep it

An email enquiry or a chat conversation is kept as long as it is relevant for handling and record keeping. You can ask us to delete it at any time.

Your rights

Under Israeli privacy law you may review the data we hold about you, ask to correct it if it is wrong, and ask us to delete it. Visitors from the European Union may also, under the GDPR, object to processing, receive a copy of their data in a portable format, and complain to the data protection authority in their country. In Israel you can contact the Privacy Protection Authority. One email is enough, and we will answer within 30 days at most.

Security and incidents

The site is served over HTTPS only. If a severe security incident occurs, we will report it to the Privacy Protection Authority as the law requires, and inform the people whose data was affected.

Changes

If this policy changes, the date at the top will change with it. If we ever add analytics, a tracking cookie or a third party component, we will update this page and ask for consent before switching it on.