Data processing addendum
How TruePlinth handles a kitchen business's clients' details on the business's behalf: what, why, how it's protected, who else handles it, and what happens at the end.
Last changed October 28, 2026
What this addendum covers
This addendum is part of the terms of use for every business that keeps its clients' details in TruePlinth. For those details the business decides what is kept and why (the controller, בעל השליטה), and TruePlinth handles them on its behalf (the processor, מחזיק). Where this addendum and the terms differ about those details, this addendum applies.
The data, its purpose and how long
- Whose: the business's clients and the people at their homes or sites.
- What: names, phones, emails, addresses, projects, designs, quotes and their approvals, site photos and notes the business writes.
- Why: only to run TruePlinth for the business, as it uses it: storing, showing, printing, sharing the links it creates and emailing what it asks to.
- How: in the systems listed on the processors' page.
- How long: while the business's account is open, then as the privacy policy sets out.
What we undertake
- To process the details only on the business's instructions, as given through the app or in writing, and never for our own purposes; we tell the business if an instruction seems to break the law.
- To keep them confidential, and to have everyone who can reach them bound to confidentiality.
- To protect them as the Privacy Protection (Data Security) Regulations ask: encrypted in transit, kept apart from other businesses by the database's own rules, tested automatically on every change, backed up nightly in encrypted form, every important action logged, and access only for those who need it.
- To help the business answer its clients' requests to see, correct or delete their details, and with the security and assessments the law asks of it.
- To tell the business without undue delay, and within 48 hours of learning of it, of a security incident that affects its data, with what we know and what we're doing.
- To give the business, once a year or when it asks, a short report on how we meet this addendum.
Who else handles them
The business agrees to the processors on the processors' page, each bound in writing to protect the data as we must. We tell businesses 30 days before adding or replacing one, and a business that objects may end its plan with a refund of what's unused.
Some processors are outside Israel and Europe; a transfer is made only with the protection the law asks for, as the processors' page says for each.
At the end
When the business's account is deleted, its data is deleted with it, and from the backups within seven days after that; the business can first download it all on the Your data page in Settings. We confirm the deletion in writing when asked.
Everything else
Liability, law and courts are as in the terms of use. For businesses in Europe, this addendum is also the agreement Article 28 of the GDPR asks for. Questions: support@trueplinth.com.