Privacy Policy

This policy explains what personal information levabear.com collects, why, who receives it and what your rights are. It describes the site as it works today.

Who is responsible

The controller of the database: [to be completed], company no. [to be completed], [to be completed]. For anything to do with privacy: the contact form (levabear.com/contact).

What we collect, and why

· When you order: name, email, phone, delivery address, the items and the amount. There is no legal duty to give them, but without them we cannot send the order or contact you about it. Card details are typed on the payment provider's secure page; we never see or store them. · When you sign in with Google: the name, email and account id Google passes on. Signing in is optional, and you can order without an account. · Children's details, optional: name, date of birth and height, if you choose to add them to your account. They are used only to suggest a size. Without them the site works as usual, just without the size suggestion. · In the contact form: name, email and your message, so we can answer. · On the waiting list, the updates sign-up and "tell me when this size is back": your email, and sometimes the size you asked about. Without an email we cannot let you know. · While browsing, only after you accept cookies: anonymous events, such as which pages were seen and what went into the bag, under a random visit id that is deleted when the tab closes. No name and no email. · If you message us on WhatsApp: your phone number and the conversation.

Children's information

The shop sells children's clothing to parents and adults; it is not meant to be used by children themselves. Children's details a parent chooses to add are kept in that parent's account, seen only by them and the shop's staff, and never passed to any third party. They can be deleted from the account at any time.

How we use it

· To fulfil orders, send confirmations and shipping updates, and handle returns. · To answer messages. · To suggest a size from your children's details, if you added them. · To send promotional emails and updates, only to people who signed up for them. · To measure how the site is used and improve it, only after you accept cookies. · To meet legal duties, such as keeping accounting records.

We use the information for nothing else, and we do not sell personal information.

Who receives it

· Supabase (USA): hosts the database, images and sign-in. · Lovable (Sweden) and Cloudflare (USA): host the site and carry its traffic. · Cloudflare Turnstile (USA), when switched on: checks on forms and at checkout that a person, not a program, is sending. It receives browser details and your IP address, not what you typed in the form. · Cardcom (Israel): processes payment, by card or PayPal, on its own page. · Resend (USA): sends the shop's emails, such as order confirmations and mailings. · Google (USA): only if you signed in with Google. · Meta (Facebook and Instagram, Ireland and USA): only after you accept cookies. It receives browsing and purchase events, and from our server also your email and phone in hashed form. If you declined, nothing is sent. · Further pixels, such as Google's or TikTok's, load only if switched on and only after you accept. The cookies page lists what is active. · Couriers, including UPS for shipments abroad: name, address and phone, to deliver the parcel. · The domain's mail provider (Vangus, Israel): receives the emails you send us.

Inside the shop, only the owner and authorised staff see this information, through a closed admin panel. Each customer sees only her own.

Transfers abroad

Some providers store or process information outside Israel, as listed above. Transfers are made under the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, on the basis of each provider's data-processing terms.

Security

Database access is limited by permission, and traffic to the site is encrypted (HTTPS). Card details are never stored by us. If a security incident is found, we investigate it at once, act to limit the harm, and report it to the Privacy Protection Authority and to anyone affected where the law requires.

How long we keep it

· Orders and invoice details: for as long as the law requires accounting records to be kept. · Your account and children's details: until you delete them or ask us to. · The mailing list: until you unsubscribe. After that we keep only a mark that the address must not be mailed. · Messages: as long as needed to deal with them. · Browsing events: kept without a name or email.

Your rights

You can ask to see the information we hold about you, correct it, delete it, or stop receiving mailings. Contact us at the contact form (levabear.com/contact). We answer a request to see your information within 30 days. If we cannot meet a request, we will explain why in writing.

Mailings

Promotional emails go only to people who signed up for them. Each one opens with the word "Advertisement" in Hebrew ("פרסומת"), includes the sender's details, and offers one-click unsubscribe. Sometimes a mailing is tailored to what you bought or asked about, such as a size back in stock. That is direct mailing: the information behind it is what you gave us when signing up or ordering, and you may ask at any time to be removed from the list.

Cookies

The full list of what is stored in your browser is on the cookies page (levabear.com/cookies).

Artificial intelligence

The site has no chat or bot, and no personal information is sent to AI services.

Customers in the EU and the UK

If you live in the European Union or the United Kingdom, the GDPR and UK GDPR also apply. The legal basis for each use: performing your order (contract); consent, for mailings, advertising cookies and children's details; legal obligation, for accounting records; and legitimate interest, for site security and fraud prevention.

In addition to the rights above, you can receive your information in a portable format, restrict or object to processing, and withdraw consent at any time. Withdrawing consent does not affect what was done before. You may also complain to the data protection authority in your country.

The EU and the UK recognise Israel as providing adequate protection for personal data. Transfers to providers in the USA rely on the transfer mechanisms those providers apply, such as standard contractual clauses or the EU-US Data Privacy Framework.

Data protection officer

No officer has been appointed, as the business is not required to have one. Every request reaches us directly.

Changes

When this policy changes, the date below is updated. A material change is posted on the site before it takes effect.

Last updated: 8 October 2026.