Privacy Policy
Last updated: 10 September 2026
1. Who we are
Matat Technologies Ltd. (Company No. 515878072), 13 Hahagana St., Rishon LeZion, Israel ("the Company", "we") operates the mylo.club website ("the Site") and the MYLO loyalty platform ("the Service"). This policy explains what personal information we collect, what it is used for, who it is shared with, and what your rights are - both as a visitor to the Site and as a customer of the Service. For questions, access requests or privacy complaints: support@matat.co.il. Enquiries are handled by the Company's privacy officer. You may also contact the Israeli Privacy Protection Authority.
2. Three roles - worth understanding
Site visitors - technical data and any enquiry you choose to send us. The Company is the controller of this information. Service customers (merchants) - your account, contact and billing details. The Company is the controller of this information. Merchants' loyalty members - the shopper, member, points and purchase data that the merchant manages in the Service. The merchant is the controller of this database, and the Company holds and processes it solely on the merchant's behalf, under their instructions and for the purpose of providing the Service (a "holder" as defined in the Israeli Privacy Protection Law). Requests from loyalty members about their own data should be directed to the merchant whose club they belong to.
3. What information is collected
On the Site Anonymous usage data via Vercel Analytics - no tracking cookies and no personal identification (page views, browser type, country). Details you provide voluntarily: contact form submissions, email, or other channels we offer. In the Service Merchant and user details: business name and registration number, contact person, store address, email and phone, user accounts and permissions, billing details. Data managed on the merchant's behalf: loyalty member details (name, phone, email, date of birth where provided), points balances and earn/redeem history, membership tiers, coupons and rewards, order data required to calculate points, product reviews submitted through the Service, referrals, and marketing consents.
4. Are you required to provide information?
In accordance with section 11 of the Israeli Privacy Protection Law, 5741-1981: you are under no legal obligation to provide us with information, and doing so depends on your will and consent. However, certain details - such as business and contact details - are required in order to open an account and provide the Service, and without them we cannot supply it. Information is collected for the purposes set out in this policy and stored in the Company's databases. Every person has the right to review information held about them and to request its correction or deletion, as detailed in section 9 below.
5. What the information is used for
Providing, operating and improving the Service, including technical support. Running the merchant's loyalty club: earning and redeeming points, tier promotion, issuing coupons and rewards, referral programmes and product reviews. Account management, billing and collection. Information security, fraud prevention and fault detection. Compliance with legal obligations. Sending operational updates. Marketing messages to loyalty members are sent by the merchant and under their responsibility, in accordance with section 30A of the Israeli Communications Law, 5742-1982, with an opt-out in every message.
6. Who the information is shared with
We do not trade in personal information. Information is shared with third parties only as far as required to operate the Service, including: Hosting and cloud infrastructure providers - Vercel (site hosting), Hetzner and Railway (hosting the Service and its databases), and file storage services (product review photos and videos, logos and files uploaded to the Service); Payment and billing providers - Shopify Billing for customers who subscribed through the Shopify App Store, and iCount for all other customers. Payment method details are provided directly to the payment provider and are not stored by us; Commerce platforms the merchant chose to connect: Shopify, WooCommerce - only to the extent required for the connection; Messaging and marketing services the merchant chose to enable: TextMe SMS, Klaviyo, Flashy, Omnisend, InforU; Point-of-sale and management systems the merchant chose to connect, including Popay POS, OTech and Comax; The Company's professional advisers, and competent authorities where the law requires it. Some of our sub-processors operate outside Israel - including in the European Union and the United States. Transfers of information outside Israel are made in accordance with the Privacy Protection Regulations (Transfer of Information to Databases Abroad), 5761-2001 - to countries providing an adequate level of protection or subject to appropriate contractual undertakings.
7. Information security
The Company applies security measures in accordance with the Privacy Protection Regulations (Information Security), 5777-2017, including transport encryption (TLS), access controls and permissions, environment separation, backups and security event logging. A serious security incident will be reported to the Privacy Protection Authority, and where the law or the Authority's guidance requires it, we will also notify the affected data subjects. That said, no security measure guarantees absolute immunity, and account holders are required to keep their access credentials confidential.
8. Retention period
Information is retained as long as it is required for the purposes for which it was collected: account information - for the term of the engagement and thereafter as required for accounting and limitation purposes; accounting data - in accordance with statutory retention obligations; loyalty data of a merchant who has ended the engagement - will be deleted or transferred to the merchant on request, subject to the retention obligations above (see section 13 of the Terms of Use).
9. Your rights
Access: you have the right to review the personal information held about you (section 13 of the Law). Correction and deletion: found that the information is incorrect, incomplete or out of date? You have the right to request its correction or deletion (section 14 of the Law). Opting out of direct mail: you have the right to demand removal from a direct mailing list at any time, and that information about you not be passed on for others' direct marketing. Complaint: you have the right to approach the Privacy Protection Authority with any claim of a breach of the Law. Requests should be directed to support@matat.co.il. Where the information is managed on behalf of a merchant (as holder) - we will refer the request to the relevant merchant or assist them in handling it.
10. Cookies and measurement tools
Essential cookies - required to operate the Site and the Service (sign-in, account security, storing accessibility preferences) and are not subject to consent. Basic usage data on the Site is measured via Vercel Analytics with no tracking cookies and no personal profile. Measurement and marketing cookies - should third-party measurement or advertising tools be enabled on the Site, they will run on entry as is customary, and continued browsing constitutes consent to their use. Anyone who does not want this can block or delete cookies in their browser settings, install a blocking extension, and manage advertising preferences directly with the providers. These providers' use of the information is subject to their own privacy policies. Further detail is in the Cookie Policy.
11. Minors
The Site and the Service are intended for business use and are not directed at minors under 18, and we do not knowingly collect information about minors. Where a merchant enrols minors into its loyalty club, responsibility for obtaining the consents required by law rests with that merchant.
12. Policy updates
This policy will be updated from time to time. A material change will be published on the Site or sent to Service customers a reasonable time in advance. The date of the last update appears at the top of the page.