Privacy policy

This policy explains what personal data is collected on this website, why, who it is shared with and what your rights are. It is written to be read, not skimmed. Last updated: September 5, 2026. Version 1.0. The Hebrew privacy policy on mrmake.co.il is the binding version; this English text is provided for convenience and describes this site, liorzabari.com.

1. Who we are, and what this document is

This privacy policy describes how we collect, process, store and disclose personal data in connection with your use of the website at https://liorzabari.com (the "site"). The data controller is Lior Zabari Ltd., a private limited company registered in Israel, company number 516967395, of Even Yehuda, Israel (the "company", "we"). The site is the English edition of the company's Hebrew site at https://mrmake.co.il.

One email address serves every request under this policy: privacy questions, access, correction and deletion requests, unsubscribe requests and legal matters. The address is lior@mrmake.co.il. For everything else the site offers WhatsApp and a phone number as well; email is the channel for these requests because it is accessible to screen readers and assistive technology and keeps a full record of the request and the reply. We do not operate premises open to the public. A full postal address for registered mail is available to anyone who asks by email.

Our committed response time is 10 business days at most, for every kind of request. The one exception is a data-security incident (section 15), where the deadline is deliberately shorter.

We collect very little data. The site sells nothing, processes no payments, and trades no data. Beyond reading, the only actions available are opening a WhatsApp conversation, opening an external online calendar to book an introductory call, and following links.

2. Definitions

"Personal data" means information relating to an identified or reasonably identifiable person, including a name, contact details, an online identifier and location data, as defined in the Israeli Protection of Privacy Law, 1981. "Processing" means any operation on personal data. "Processor" means an external provider that processes data on our behalf. "You" means anyone who browses the site, contacts us through it or books a call through it.

3. What data we collect

• Data you send us yourself. This site has no contact form. If you write to us on WhatsApp or by email, we receive what you send: your name, phone number or email address, and the content of your message, including any attachments.
• Booking an introductory call. The site links to an online calendar operated by Calendly. If you book a call, the details you enter there (name, email address, the chosen time and time zone) are collected and stored by Calendly under its own privacy policy, and are passed to us so the call can take place.
• Client data. If we enter into a commercial engagement, we also collect invoicing details, the contact person in your organization and billing details. This data is not collected on the site but in the contractual engagement, and this policy applies to it as well.
• Technical data collected in every case. IP address, browser type and operating system, time of the request and the path requested. This is kept in server and edge logs for security and operations only, even if you declined non-essential cookies, and is never used for marketing measurement, segmentation or advertising.
• Measurement data. Device type, screen resolution, interface language, pages viewed and time on page, referrer, campaign parameters (UTM) and identifiers stored in measurement and advertising cookies. For visitors from the European Economic Area, the United Kingdom and Switzerland this is collected only after you accept in the notice; elsewhere it is collected by default and stops when you decline. Details in section 11.
• Accessibility preferences. The accessibility widget on the site stores your display preferences in your browser so they are restored on the next visit. We classify this storage as essential and it keeps working even if you declined non-essential cookies.

4. Data we do not ask for, and data about third parties

We do not need and do not ask for specially sensitive data. Please do not include medical information, identity numbers, payment details, passwords, API keys or system credentials in an open message. If a consulting project requires sharing sensitive data or system access, this is done under a separate agreement and through a dedicated secure channel, never through the site. Analytics may derive an approximate country or city from your IP address; we never collect precise location, never request browser location permission, and never tie a location to an identified person.

Please do not send us personal data about other people, such as your employees or customers, unless you have a lawful basis to do so. If we receive third-party personal data we do not need, we delete it within 10 business days and make no use of it.

5. Purposes of processing

• Answering messages you send, including clarifying the need, preparing a quote and arranging next steps.
• Arranging, holding and documenting introductory calls and meetings booked through the online calendar.
• Managing inquiries and the history of our correspondence, which lives in our email mailbox.
• Aggregate, statistical measurement of how the site is used, understanding traffic sources and improving the content.
• Measuring the results of our own advertising campaigns that bring visitors to the site (section 11).
• Operating, maintaining and securing the site, including fault detection and abuse prevention.
• Meeting legal obligations, including tax and bookkeeping duties, and answering lawful requests from a competent authority.
• Protecting our legal rights, including handling or defending a claim.

Any other purpose requires new consent from you.

6. Are you obliged to provide data?

No. There is no legal duty to give us personal data; doing so is voluntary. If you do not give us contact details, we cannot reply or arrange a service. If you do not fill in the calendar booking, no call is booked. Declining non-essential cookies does not block access to any content on the site. We do not condition service or content on data that is not needed for that purpose, and never on consent to marketing messages.

7. Legal basis

Israeli law bases lawful processing on informed consent and purpose limitation. For transparency, and for visitors subject to European law, the parallel bases under Article 6 of the GDPR are: replying to you and arranging a call: your consent and pre-contractual steps at your request; marketing messages, if ever sent: explicit prior consent under Section 30A of the Israeli Communications Law (Telecommunications and Broadcasting), 1982, revocable at any time; measurement and advertising cookies: your active consent before they load for visitors from the EEA, the UK and Switzerland, and our legitimate interest in measuring the site elsewhere, with an opt-out that takes effect immediately; essential cookies, server logs and site security: our legitimate interest in running the site securely; carrying out a client engagement: performance of a contract; keeping accounting records: a legal obligation.

8. Who receives the data, and where it is stored

We do not sell, rent or hand personal data to third parties for their own marketing. Data reaches only service providers that process it for us, on our instructions, to the extent needed.

• Hosting and content delivery: Cloudflare, Inc. (United States). The site is a static site served from Cloudflare's global edge network (Cloudflare Workers). Requests may be handled by an edge server outside Israel, depending on your location.
• Email and file storage: Google, through Google Workspace, on servers outside Israel. Messages sent to us arrive in an email mailbox only. No CRM or automation tool is connected to it.
• Booking calls: Calendly, LLC (United States). Data you enter in the booking screen is stored by Calendly under its own privacy policy.
• Messaging: WhatsApp (Meta Platforms). If you choose to write to us on WhatsApp, the conversation is carried by Meta under WhatsApp's own terms and privacy policy.
• Measurement: Google Analytics 4 (property G-YFH0BBFD5K, loaded through the Google tag GT-PZQ7BTGC), stored on Google servers outside Israel. Google Signals and personalized advertising features are switched off. Data retention in the property is set to 14 months at most. Cloudflare may also record cookieless performance measurements (Cloudflare Web Analytics) at the network edge.
• Advertising measurement: Meta Pixel (ID 519604770319378), used to measure the results of our own campaigns on Facebook and Instagram. For visitors from the EEA, the UK and Switzerland it sends nothing until you accept; elsewhere it runs by default and stops when you decline.
• Accessibility widget: Accessible Poetry (AccessibleWP), whose script is served from mrmake.co.il. It stores display preferences only.
• Professional advisers: where required, an accountant, bookkeeper or lawyer, to the extent needed.
• Competent authorities: where required by law, a court order or a lawful demand.
• Business transfer: in a merger, acquisition or transfer of the business, data may pass to the acquiring entity, provided it assumes our commitments under this policy and subject to prior notice on the site.

With every processor we enter into a written agreement covering the scope of processing, the types of data, a prohibition on independent use, security duties and the return or destruction of data at the end of the engagement, in line with Regulation 15 of the Israeli Protection of Privacy Regulations (Data Security), 2017.

9. Transfers outside Israel

Some of our providers store data on servers outside Israel, as listed in section 8. Transfers are made in accordance with the Israeli Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 2001, on one or more of these bases: your consent; transfer to a country party to the Council of Europe Convention 108; transfer to a country that receives data from the European Union on the same terms; and a written undertaking by the recipient to protect the data and not transfer it onward. Israel is recognized by the European Commission as providing an adequate level of data protection. If you want to know where specific data about you is stored, write to us and we will answer within 10 business days.

10. Retention periods

• An inquiry that did not become an engagement: up to 24 months from the last message, then deletion or anonymization.
• An active client: for the term of the engagement and 7 years after it, in line with the limitation period and record-keeping duties.
• Accounting records and invoices: 7 years, as required by Israeli tax law.
• A marketing list, if one is ever operated: until you withdraw consent, or 24 months of complete inactivity, whichever is earlier.
• The unsubscribe list: kept indefinitely, at the minimum needed (the address only), so that you never receive marketing from us again.
• Records of consent: 7 years from withdrawal, as evidence.
• Google Analytics data: 14 months at most.
• Access and server logs: up to 12 months.
• Backups: data deleted from production may remain in backups for up to 90 days.

11. Cookies and similar technologies

The site uses cookies and browser storage. Cookies and online identifiers may count as personal data under Israeli law and therefore require notice and consent.

• Essential: needed for the site to work, for its security and to remember your choice in the consent notice. These load without consent.
• Preferences and accessibility: the display adjustments you make in the accessibility widget are stored locally and classified as essential, so they are not reset when you decline other categories.
• Measurement: Google Analytics 4.
• Advertising measurement: Meta Pixel. We do not run remarketing audiences or behavioral profiling from this site.

How the two categories behave depends on where you are. For visitors from the European Economic Area, the United Kingdom and Switzerland (identified by the network edge from your connection), measurement and advertising cookies are off until you accept in the notice. For visitors from Israel and everywhere else they run by default, which is the common practice in Israel, and one click on "No tracking" switches them off and deletes the cookies they set. The notice offers two buttons of the same size, accept and decline; nothing is pre-selected and declining never blocks content. Your choice is stored in your browser and applied on every later visit through Google Consent Mode and the pixel's consent state. You can change it at any time by clearing the site's data in your browser, and you can also block or delete cookies in the browser settings. We verify on every material technical change, and at least once a year, that this is how the site actually behaves.

12. Marketing messages

We do not currently operate a mailing list and send no marketing messages from this site. If we ever do, messages will be sent only to those who gave explicit, separate, prior consent through an unticked checkbox; every message will carry the word "Advertisement", our name, address and contact details, and a one-click unsubscribe that works without logging in; an unsubscribe request takes effect immediately and the address goes onto a permanent suppression list; and we will never buy lists, harvest addresses or import lists from others. All of this follows Section 30A of the Israeli Communications Law, 1982.

13. Your rights and how to exercise them

• Access: you may inspect the personal data we hold about you, in Hebrew, Arabic or English, yourself or through a written representative.
• Correction or deletion: if the data is inaccurate, incomplete, unclear or out of date, you may ask for it to be corrected or deleted. If we agree, we make the change and notify anyone who received the data from us. If we refuse, we tell you in writing with reasons and your options.
• Removal from direct mailing and objection to disclosure to specific people.
• Withdrawal of consent at any time, including consent to marketing and to non-essential cookies, without affecting the lawfulness of earlier processing.
• Recourse to the courts against a refusal.

Write to lior@mrmake.co.il, say which request you are making and give the contact details you used with us. We identify you by a reply from the address you used and do not ask for a copy of an ID document. We answer and complete the request within 10 business days; if a complex request needs more, we tell you within those 10 days and finish within 10 more. Exercising your rights is free. Israeli law does not grant a general right to be forgotten; deletion under the law depends on the data being inaccurate, but a request to leave a mailing list is always honored, and we delete data we no longer have a lawful purpose to keep.

14. Data security

We act in accordance with Section 17 of the Israeli Protection of Privacy Law and the Data Security Regulations, 2017, at the basic security level that fits the characteristics of our database, and we review that classification yearly. Our measures include HTTPS/TLS on every page, filtering of malicious traffic at the edge, least-privilege access, two-factor authentication on every central account (domain, hosting, cloud, measurement), routine security updates, periodic backups with restore tests, and processing agreements with providers. No online system is completely immune. If you become aware of a possible security problem, please report it to the address above; such reports are handled urgently.

15. Security incidents

We document security incidents as the regulations require and report serious incidents to the Israeli Privacy Protection Authority. Whenever an incident may affect you, we notify you directly, without waiting for the authority and no later than 72 hours after we learn of it. The notice covers what happened, which data was exposed, what we did, what you should do, and how to reach us.

16. Minors

The site and the services are intended for adults acting for a business or organization, not for minors. We do not knowingly collect personal data about anyone under 16. If you learn that a minor gave us personal data, write to us; we delete it and reply within 10 business days at most.

17. Visitors from the European Union and the EEA

Our activity is aimed at the Israeli market and at business clients abroad who approach us. We do not monitor the behavior of people in the EU and have not appointed an EU representative. If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability, objection (including to direct marketing) and not to be subject to a decision based solely on automated processing, and the right to lodge a complaint with your supervisory authority. Write to the address above and we reply within 10 business days.

18. Content made with AI, and external links

Some content on the site is written or edited with the help of AI tools and reviewed by a person before publication. These tools are used for content creation only; personal data of people who contact us is never fed into them, and your messages are never handed to anyone as training material. If a chatbot is ever added to the site, it will say clearly that you are talking to a system. The site links to third-party services, including social networks, WhatsApp and the booking calendar; we do not control their privacy practices, and you should read their policies before sharing data with them.

19. Accessibility

Accessibility is handled in the separate accessibility statement, linked from the bottom of every page.

20. Changes to this policy

We may update this policy when the law, the technology or our activity changes. Every update gets a version number and a date shown at the top. A material change in the purposes or scope of processing does not apply to data already collected without your renewed consent, and does not take effect until 30 days after a prominent notice on the site. We keep a dated copy of every published version and provide it on request.

21. Governing law

This policy is governed by the laws of the State of Israel. Nothing in it sets exclusive jurisdiction or limits your right to apply to any competent court, and nothing in it waives rights you have under mandatory law, including the Protection of Privacy Law, the Consumer Protection Law and the Communications Law. Where a signed client agreement conflicts with this policy, the agreement prevails on commercial matters only; on data-subject rights the text more favorable to you always prevails.

22. Contact and complaints

Controller: Lior Zabari Ltd., company number 516967395, Even Yehuda, Israel.
Email for privacy, legal and accessibility requests: lior@mrmake.co.il.
Response time: 10 business days at most, except a security-incident notice, which is faster.

If you are not satisfied with our reply, you may complain to the Privacy Protection Authority at the Israeli Ministry of Justice, free of charge, and you may apply to a competent court. Neither step limits your right to contact us directly.