Privacy policy

1. Introduction

Wiply M.E E-Commerce Ltd., together with its affiliates and subsidiaries (collectively, "Wiply," "we," "us," or "our"), is committed to protecting the privacy of individuals who interact with our B2B SaaS platform for gamified marketing experiences (the "Platform"). This Privacy Policy describes how we collect, use, share, and protect Personal Information when you visit our websites at wiply.com and platform.wiply.co (collectively, the "Website") or use the Platform.

As a B2B SaaS provider serving enterprise customers primarily in the European Union, the United States, and Israel, we operate in a multi-jurisdictional regulatory environment. We have designed our privacy practices to comply with applicable data protection laws, including:

• the EU General Data Protection Regulation (GDPR) 2016/679;
• the Israeli Privacy Protection Law, 5741-1981 and its regulations, including Amendment 13 (effective August 2025); and
• applicable U.S. state privacy laws, including the CCPA/CPRA, and similar statutes.

We are committed to providing transparent, user-centric privacy controls that reflect recognized standards of data protection and accountability that are appropriate for entities of our size and type.

Any capitalized terms not defined in this Privacy Policy have the meanings set forth in our Terms of Use. This Privacy Policy is incorporated into and forms part of those Terms. Nothing in this Privacy Policy creates a contractual obligation or private right of action beyond those required under applicable law.

We aim to respond promptly and within all legally required timeframes. For EU/EEA/UK residents, our EU representative details will be provided where required under GDPR Article 27. A list of our subprocessors is available upon request.

2. Scope and our role

We handle personal information in three primary contexts:

• Website visitors: We collect only limited technical and usage data.
• Platform account users (brands, agencies, B2B/B2C customers): We collect account creation, billing, contact, and support-related data strictly necessary to provide and administer the Services. Wiply acts as the data controller for this information.
• End users (people who play games or interact with campaigns built on the Platform): In the vast majority of cases, the Customer, not Wiply, determines the purpose, categories, and means of collecting any End User data (e.g., through custom forms, pixels, or tracking parameters embedded in games).

Wiply generally acts as a data processor (or service provider under U.S. law) for End User data processed on behalf of the Customer, following their instructions.

In such cases, Wiply acts as a Data Processor (GDPR) or Service Provider (U.S. laws), and the customer is the Data Controller or Business. Customers are responsible for providing required notices, establishing lawful bases, and ensuring their campaigns comply with applicable laws. If you are an end-user of a customer campaign, please refer to that customer's privacy policy.

Separately, Wiply acts as controller for limited technical, diagnostic, fraud-prevention, and security-related data required to host, monitor, and protect the Platform (such as IP-derived fraud signals and server performance logs).

3. Information we collect

3.1. Personal information you provide directly

When you interact with our Website or Platform, you may voluntarily provide:

• Identity & contact data: Full name, business name, email address, phone number, job title, country of residence
• Account data: Login credentials, subscription details, account preferences, admin settings
• Billing & payment data: Payment details handled via processors (e.g., Stripe); we store limited tokens only
• Communication data: Support tickets, feedback, inquiries, and correspondence
• Marketing & preference data: Newsletter subscriptions, opt-in/opt-out records
• AI interaction data: Prompts, queries, and feedback submitted to AI-powered features
• Recruitment data: Resume/CV, application materials, and related correspondence (job applicants)

3.2. Automatically collected information

When you visit our Website or use the Platform, we automatically collect:

• Technical data: IP address, device identifiers, browser type/version, operating system, language settings, time zone
• Usage data: Pages visited, features used, navigation paths, timestamps, referral/UTM sources, engagement metrics
• Performance & diagnostic data: Load times, errors, security event logs
• Gamification data: Campaign participation, game performance metrics, rewards earned, challenge completion.

3.3. End user / game interaction data (processed on behalf of customers)

For end users interacting with customer campaigns, we process on behalf of the Customer:

• Session duration, engagement events, and completion status;
• Campaign and referral metadata (QR code, link source);
• Technical identifiers for fraud prevention and abuse detection; and
• Optional Customer-enabled fields such as age range, gender, or location (which may constitute sensitive data in certain jurisdictions).

By default, we process only non-identifying, aggregated gameplay metrics. Customers may optionally activate additional data fields subject to their own legal compliance obligations.

3.4. Sensitive personal information

We do not intentionally collect sensitive categories of Personal Information (such as health data, biometric identifiers, genetic data, or precise geolocation) unless voluntarily provided by you or necessary for specific, disclosed purposes with your explicit consent.

How we treat combined data: If Non-Personal Information could reasonably be linked to your Personal Information, we treat that combined data as Personal Information and apply the same protections.

4. How we collect information

4.1. Automated collection

We automatically collect information through cookies, pixels, log files, SDKs, and similar technologies when you visit our Website or use the Platform. This includes browsing behavior, technical information, performance and diagnostic data, and gaming/campaign analytics. See Section 6 (Cookies and tracking technologies) for full details.

4.2. Voluntary submissions

We collect Personal Information you voluntarily provide when you:

• create an account or request a demo;
• subscribe to newsletters or marketing communications;
• register for webinars, reports, or other resources;
• contact us through email, chat, or support tickets;
• participate in events or training sessions;
• apply for employment or contractor opportunities; or
• interact with AI-powered Platform features.

4.3. Third-party sources

We may receive limited information about you from third-party sources such as Single Sign-On (SSO) providers (e.g., Google, LinkedIn) when you use these services to access the Platform. Your use of SSO is governed by the third-party provider's privacy policy.

5. How we use your information

We process Personal Information for the following specific purposes and on the corresponding legal bases:

6. Cookies and tracking technologies

Wiply uses cookies and similar tracking technologies (web beacons, pixels, local storage) to collect information about how you interact with our Platform and Website.

6.1. Categories of cookies

• Strictly necessary cookies: Essential for core Platform functionality including authentication, session management, security, and load balancing. Deployed on the basis of legitimate interests and contractual necessity. No consent required.
• Functional cookies: Enable enhanced features and personalization (language preferences, interface settings). May be set by Wiply or integrated third parties.
• Performance & analytics cookies: Collect aggregated, anonymized data on how users navigate the Platform to monitor performance, diagnose issues, and improve user experience. Require consent where mandated by law.
• Marketing & targeting cookies: Used to deliver relevant content and measure campaign effectiveness. May build interest-based profiles across platforms. Require explicit, informed consent where legally required (including under GDPR and applicable U.S. state laws).
• Third-party cookies: Set by third-party service providers (analytics platforms, hosting providers, integrated marketing tools). Wiply requires such providers to process data only as instructed and in compliance with applicable law.

6.2. Legal basis for cookie use

Strictly necessary cookies are processed on the basis of legitimate interests (GDPR Art. 6(1)(f)) and contractual necessity (Art. 6(1)(b)). All other cookie categories are processed only with your explicit consent (Art. 6(1)(a)), which you may provide or withdraw at any time. Withdrawal does not affect the lawfulness of prior processing.

6.3. Managing your cookie preferences

You may manage or disable cookies through your browser settings or our consent manager (where available). Note that disabling certain cookies may impair Platform functionality. Wiply honors Global Privacy Control (GPC) signals where required by applicable law.

Browser-specific cookie management:

• Google Chrome: support.google.com/chrome/answer/95647
• Firefox: support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
• Safari (Desktop/Mobile): support.apple.com/guide/safari
• Microsoft Edge: support.microsoft.com/en-us/microsoft-edge
• Opera: help.opera.com/en/latest/web-preferences/#cookies

Opt-out tools:

• Interest-based advertising (US): optout.aboutads.info
• EU residents: youronlinechoices.eu

6.4. Do not track

There is currently no uniform industry standard for responding to DNT signals. Wiply does not respond to all DNT signals but does honor GPC signals as described above.

7. Sharing and disclosure of information

We never sell Personal Information for monetary consideration. Any disclosure is limited to what is strictly necessary and subject to appropriate contractual, confidentiality, and security safeguards. Under certain U.S. state laws, limited disclosures associated with analytics or operational technologies may be characterized as a "sale" or "sharing"; where such laws apply, we comply with all applicable notice and opt-out requirements.

We may disclose Personal Information only in the following circumstances:

Non-Personal Information (aggregated or anonymized data) may be shared for analytics, research, or business purposes.

8. International data transfers

Wiply is headquartered in Israel and primarily hosts infrastructure in AWS EU (Ireland). Data may also be accessed or processed by authorized personnel or subprocessors in other locations for support and operational purposes.

When Personal Information originating from the EU/EEA, UK, or Israel is transferred to countries not recognized as providing an adequate level of data protection, we implement appropriate safeguards, including:

• European Commission Standard Contractual Clauses (SCCs);
• Additional technical and organizational measures (encryption, access controls); and
• Transferring data only to jurisdictions recognized as providing adequate protection where possible.

We require all affiliates and service providers, regardless of location, to protect Personal Information to a standard at least equivalent to this Privacy Policy and applicable law.

9. Data retention, storage, and deletion

9.1. Retention principles

We retain Personal Information only for as long as reasonably necessary to fulfill the purposes outlined in this Policy, meet legal and regulatory obligations, resolve disputes, and support legitimate business operations (security monitoring, fraud prevention). Once Personal Information is no longer required, we securely delete or anonymize it in accordance with our data retention policies.

We apply a data minimization approach to retention, maintaining Personal Information only for the time needed to: deliver the Platform features and services you have requested or subscribed to; sustain our ongoing business relationship with you; satisfy legal, regulatory, tax, accounting, and audit requirements; resolve disputes, enforce our contractual agreements, and protect our legal rights; and support legitimate business operations, including security monitoring, incident response, and fraud prevention.

Our retention periods depend on the nature of the information collected and the specific purpose for which it was processed. Marketing and communications data, for example, is retained while you remain subscribed to our communications and for a reasonable period thereafter to honor opt-out requests and maintain suppression lists.

Website and Platform usage data, including analytical and technical logs, is typically retained for 12 to 24 months unless extended retention is necessary for security investigations or system integrity purposes.

Account, customer, and transaction data is retained throughout the duration of our business relationship and for applicable statutory limitation periods thereafter as required by law. Legal, compliance, and regulatory records are retained for the periods mandated by applicable laws, regulations, and supervisory authority guidance.

9.2. Storage

Personal Information is stored and processed in the EU (primarily AWS EU-Ireland), Israel, the United States (where permitted by law), and other locations where Wiply or authorized third-party service providers operate, including secure cloud environments.

9.3. Deletion and anonymization

When Personal Information is no longer required and there is no legal obligation to retain it, we take commercially reasonable steps to permanently delete it using secure deletion methods or anonymize it so it can no longer be linked to you. If you request deletion or withdraw consent, we will honor your request except where retention is necessary to:

• comply with legal, regulatory, or tax obligations;
• resolve disputes or enforce our Terms; or
• defend against legal claims or investigations.

In such cases, we retain only the minimum data necessary and restrict its use to those specific purposes.

10. Data security

We implement appropriate technical, organizational, and physical safeguards to protect Personal Information from unauthorized access, loss, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest;
• Secure user authentication and robust access controls;
• Regular security audits and vulnerability assessments;
• Strict internal policies and employee training on data handling; and
• Documented and tested incident response procedures.

In the event of a data breach or security incident, we have established response protocols to assess, contain, and remedy the situation and to notify affected individuals and regulatory authorities in accordance with applicable law (including GDPR, the Israeli Privacy Protection Law, and other relevant statutes). Despite these measures, no transmission or storage method is 100% secure. If you notice suspicious activity or security concerns, please contact us immediately at support@wiply.com.

11. Third-party service providers

Wiply engages third-party service providers to support our Platform, including providers for infrastructure hosting, data analytics, marketing communications, payment processing, security monitoring, and customer engagement tools. When selecting these partners we consider their security measures, privacy practices, and compliance with applicable law.

All third-party providers are contractually obligated to:

• process Personal Information only in accordance with our documented instructions;
• process data only for lawful business purposes specified by Wiply;
• maintain data protection standards no less protective than applicable law requires; and
• maintain confidentiality and implement appropriate technical and organizational safeguards.

Wiply reserves audit and oversight rights over its providers to ensure ongoing compliance. A list of current subprocessors is available upon request.

12. AI and automated processing

We use artificial intelligence, machine learning, and automated tools to support and enhance the Platform. These technologies may be applied to:

• detect and respond to security incidents and fraudulent or abusive activity;
• identify patterns in technical logs and usage data;
• support product development, feature enhancement, and testing;
• personalize content, campaign recommendations, or communications;
• measure and analyze Platform and marketing campaign performance;
• optimize gamification mechanics and user engagement; and
• provide in-product guidance and customer support.

Where these tools process Personal Information, we limit processing to what is necessary and apply appropriate safeguards, including access controls, encryption, audit logging, and periodic review of system configurations.

No high-risk automated decision-making: We do not rely on solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning you, unless permitted by applicable law, required consent has been obtained, and we have provided meaningful information and an opportunity to exercise your rights (including requesting human review). If any Platform feature involves an AI system, we will clearly disclose this at the point of interaction.

We commit to complying with emerging obligations under the EU AI Act (phased implementation from 2025–2026 onward) and similar frameworks as they become applicable.

13. Children's privacy

Wiply is a B2B platform designed for use by businesses and their authorized personnel. Our Platform and Services are not directed to, and are not intended for use by, children or minors. To access Wiply, you must be at least 18 years of age or the age of legal majority in your jurisdiction, whichever is greater.

Age restrictions under applicable laws:

• COPPA (U.S.): We do not knowingly collect Personal Information from children under 13.
• GDPR (EU/EEA): We do not knowingly collect Personal Information from individuals under 16 (or a lower age established by individual EU Member State law, provided such age is not below 13).
• Israeli law: We do not knowingly collect Personal Information from minors under 18 without verifiable parental or legal guardian consent where required.

Customers who create and publish campaigns bear sole responsibility for ensuring compliance with child-specific privacy laws (including COPPA, GDPR Article 8, and Israeli requirements), implementing appropriate age verification or parental consent mechanisms, and avoiding collection of child data without proper safeguards. If we become aware that a Customer is using the Platform to unlawfully process data from children, we reserve the right to immediately suspend or terminate the relevant campaign(s) and/or account.

If Wiply becomes aware that Personal Information has been collected from a minor in violation of applicable law or this Policy, we will promptly delete such information. If you are a parent or guardian and believe your child has provided Personal Information to Wiply, please contact us immediately at support@wiply.com.

14. Job candidates

When you submit a job application via our Website or authorized third-party platforms (such as LinkedIn), we collect your contact details, resume/CV, and any other materials you choose to provide ("Candidate Information"). Wiply uses Candidate Information solely for internal recruitment purposes, including identifying and evaluating qualified candidates, making hiring decisions, conducting permitted background checks, and communicating about job opportunities.

Retention: We may retain Candidate Information after a position is filled to consider you for future roles. If hired, we retain information for employment-related purposes. Candidate Information is treated as Personal Information subject to applicable data protection laws.

Your rights: Where applicable laws (including GDPR and Israeli Privacy Protection Law) grant you data subject rights, you may request access to, correction, or deletion of your Candidate Information by contacting us at support@wiply.com. Note that in certain circumstances, we may retain some information as required by law or to defend against legal claims.

15. Your privacy rights

Depending on your location and applicable law, you may have the following rights in relation to your Personal Information:

• Right to be informed: To receive clear information about how and why your Personal Information is collected and used.
• Right of access: To request confirmation of whether we process your Personal Information and to obtain a copy of it.
• Right to rectification: To request correction of inaccurate or incomplete Personal Information.
• Right to erasure ("right to be forgotten"): To request deletion in certain circumstances (e.g., data no longer necessary for its original purpose, or consent withdrawn).
• Right to restriction of processing: To request limitation of processing in certain circumstances.
• Right to data portability: To receive certain Personal Information in a structured, machine-readable format and transmit it to another controller.
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing relies on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: To submit a complaint to your competent data protection authority.

How to exercise your rights

Email us at support@wiply.com. We may verify your identity before processing your request. We respond within the timeframes required by applicable law (generally 30–45 days, with possible extensions). We will respond in accordance with legal requirements.

Authorized agents: Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require verification of identity and confirmation of the agent's authority.

Appeals and complaints: If you believe a request has been improperly denied, you may submit an appeal by contacting us at support@wiply.com or lodge a complaint with your competent data protection authority.

16. Rights under U.S. state privacy laws

Residents of California, Virginia, Colorado, Connecticut, Utah, and other U.S. states with comprehensive privacy laws may have rights similar to those described above, subject to applicable statutory conditions, exceptions, and limitations. Depending on your state of residence, these rights may include:

• the right to confirm whether we process your Personal Information;
• the right to access your Personal Information;
• the right to request correction of inaccurate Personal Information;
• the right to request deletion of Personal Information, subject to applicable legal exceptions;
• the right to obtain a copy of certain Personal Information in a portable format, where required by law; and
• the right to opt out of certain processing activities, such as targeted advertising, the sale or statutory "sharing" of Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects, as defined under applicable law.

The availability and scope of these rights may vary based on your jurisdiction and the nature of our processing activities.

California-specific terms (CCPA/CPRA)

Wiply does not sell Personal Information for monetary consideration and does not engage in cross-context behavioral advertising as defined under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA").

For purposes of this section, the terms "personal information," "business purpose," "commercial purpose," "sale," "sharing," "service provider," and "sensitive personal information" have the meanings assigned to them under the CCPA and CPRA. In the event of any inconsistency between this section and other provisions of this Privacy Policy, this section governs with respect to California residents.

Subject to applicable conditions, exceptions, and verification requirements under California law, California residents may have the following rights:

• Right to know/access: Disclosure of categories and specific pieces of Personal Information collected, sources, business/commercial purposes, and categories of third parties to whom Personal Information is disclosed.
• Right to delete: The right to request deletion of Personal Information, subject to statutory exceptions that permit retention, including for legal compliance, security, and business operations.
• Right to correct: Correction of inaccurate Personal Information.
• Right to opt out of sale or sharing: Wiply does not sell or share Personal Information for such purposes. We honor valid opt-out signals including GPC.
• Right to limit use of sensitive personal information: Wiply does not use or disclose sensitive Personal Information except as permitted under the CPRA.
• Right to non-discrimination: You will not receive discriminatory treatment for exercising any rights under California privacy law.

We comply with enhanced auto-renewal subscription disclosure and easy cancellation requirements.

The availability and scope of these rights may vary based on your jurisdiction and the nature of our processing activities.

17. Israeli law compliance

In addition to our obligations under the GDPR, CCPA, and other applicable global privacy laws, we comply with the Israeli Privacy Protection Law, 5741-1981 (the "Israeli PPL") and applicable regulations, including the Privacy Protection Regulations (Data Security), 2017, and Amendment 13 (effective August 2025). These laws govern our approach to database security, access controls, and incident response.

Under the Israeli PPL and Amendment 13, Israeli residents have the following rights:

• Right to access: Request access to your Personal Information held in our databases and information about how we use it.
• Right to correction: Request correction of inaccurate or incomplete Personal Information.
• Right to deletion: Request deletion of your Personal Information in certain circumstances, subject to legal retention obligations.
• Right to object: Object to certain types of processing, including direct marketing.
• Right to withdraw consent: Withdraw consent at any time by contacting us at support@wiply.com (noting that withdrawal may limit certain services).

Databases

Where required under Amendment 13, we will maintain databases in connection with our business activities. To the extent mandated by Israeli law, these databases are managed in compliance with the Israeli PPL and applicable regulations, and are protected by appropriate technical and organizational safeguards, which may include:

• Role-based access controls restricting access to authorized personnel only
• Encryption of sensitive Personal Information in transit and at rest
• Regular security audits and vulnerability assessments
• Ongoing employee training on data security and privacy obligations
• Documented and tested incident response procedures

These databases may be used for purposes such as customer relationship management, customer support, marketing (where explicit consent is obtained), and recruitment.

You acknowledge that your Personal Information may be included in one or more databases registered in accordance with Israeli law and that you have been informed of the purposes for which the information is collected, used, and stored.

International transfers from Israel

When we transfer Personal Information from Israel to other jurisdictions, we implement measures to ensure compliance with the Israeli PPL. These measures may include transferring data only to jurisdictions recognized as providing an adequate level of protection, entering into appropriate contractual arrangements that include safeguards for the protection of Personal Information and obtaining your explicit, informed consent where required for transfers to jurisdictions without an adequacy determination. These steps help ensure that your Personal Information remains protected regardless of where it is processed.

If you are an Israeli resident and have concerns regarding your rights under Israeli privacy law, you may contact us at: support@wiply.com.

You may also contact the Israeli Privacy Protection Authority:

• https://www.gov.il/en/departments/privacy_protection
• https://www.gov.il/he/departments/privacy_protection

We may update this section from time to time to reflect changes in Israeli privacy law or our data protection practices. Material updates will be communicated in accordance with applicable legal requirements, and we encourage you to review this Privacy Policy periodically.

Where required under applicable law, including Amendment 13 to the Israeli PPL, we will have appointed a Data Protection Officer responsible for overseeing our data protection strategy, ensuring compliance with Israeli privacy requirements, and serving as the primary contact for data subjects and the Israeli Privacy Protection Authority.

How to exercise your rights

To exercise any rights available to you under applicable privacy laws, you may contact us at support@wiply.com. We may require additional information, as permitted by law, to verify your identity and process your request.

Limitations and exceptions

• Requests to access, delete, or otherwise restrict processing of Personal Information are subject to applicable legal conditions and exceptions.
• We may retain or continue to process Personal Information where permitted or required by law, including to comply with legal obligations, resolve disputes, enforce our agreements, or establish, exercise, or defend legal claims.
• Where a request cannot be fully honored, we will respond in accordance with applicable legal requirements.

Authorized agents

Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require verification of your identity and confirmation of the agent's authority before processing such requests.

Appeals and complaints

If you believe a request has been improperly denied or restricted, you may submit an appeal or follow-up request by contacting us at support@wiply.com, subject to applicable law. You may also have the right to lodge a complaint with your competent data protection authority.

Response timing and fees

Requests are reviewed and responded to within the timeframes required by applicable law. Where permitted, response periods may be extended, and fees may be charged, or requests declined, if a request is manifestly unfounded, excessive, or repetitive.

18. Changes to this privacy policy

We may revise this Privacy Policy from time to time to reflect changes in our practices, technology, legal obligations, or service offerings. The updated version will be posted here with a revised "Last updated" date. Unless otherwise required by law, changes become effective as of that date.

For material changes that affect how we process your Personal Information, we will make reasonable efforts to notify account holders via email, in-app message, or prominent notice on the Website/Platform. We encourage you to review this Policy periodically. Continued use of the Website or Services after changes constitutes your acceptance of the updated Policy.

19. Governing law

Your statutory rights under applicable data protection and privacy laws are governed by the mandatory laws of your jurisdiction of residence and are not affected by this section.

To the extent permitted by applicable law, and solely with respect to the contractual interpretation and enforcement of this Privacy Policy (excluding statutory privacy rights), this Privacy Policy and any non-statutory claims arising out of or relating to it shall be governed by the laws of the State of Israel, without regard to its conflict of law principles. Subject to mandatory local law, any disputes arising out of or relating to this Privacy Policy shall be submitted to the exclusive jurisdiction of the competent courts of Tel Aviv, Israel.

20. Contact us

We strive to respond to all privacy-related inquiries within a reasonable timeframe and in accordance with applicable legal requirements.

For any questions about this Privacy Policy or our privacy practices, please contact us:

For Israeli privacy matters

Israeli Privacy Protection Authority: gov.il/en/departments/privacy_protection

For EU/EEA/UK residents

Wiply is not currently required to appoint an EU or UK representative under GDPR Article 27, based on the nature, scope, and risk profile of its processing activities. If and to the extent that applicable law requires Wiply to appoint an EU or UK representative in the future, Wiply will do so and update this Privacy Policy accordingly. In the meantime, EU, EEA, and UK residents may contact Wiply directly using the contact details above.

Thank you for trusting Wiply with your privacy. We value your feedback; if anything in this Policy is unclear or if you have suggestions, please reach out at support@wiply.com.