Privacy Policy

Effective date: June 1, 2025
Version: 1.0
Compliance: GDPR (EU) · Israeli Privacy Protection Law

Protecting your personal data is a priority for PKAILA. This policy explains transparently what data we collect, why we collect it, and how you can exercise your rights.

1. Data Controller

WORKIT DOIT
Registered business in Israel (עוסק מורשה)
Rambam 66, 43602 Raanana, Israel
Data contact: privacy@pkaila.com

Delespot SAS — 50 rue Taitbout, 75009 Paris, France — acts as a payment sub-processor on behalf of WORKIT DOIT, under a data processing agreement compliant with GDPR.

2. Data We Collect

Registration Data

• First name, last name, email address
• Company name (if applicable)
• Country of residence and billing
• Password (stored in encrypted form — not readable)

Service Usage Data

• Creative briefs and inputs submitted to AI agents
• Generated content (storyboards, scripts, assets)
• Project history and generation logs
• Credit balance and consumption history

Technical Data

• IP address, browser type, operating system
• Connection and activity logs
• Performance and error data

Payment Data

Payment card and banking data is collected and stored exclusively by Stripe (via Delespot SAS). WORKIT DOIT only has access to the last 4 digits of your payment method and transaction confirmation. Stripe is PCI-DSS Level 1 certified.

3. Purposes and Legal Basis

Account and service management — Legal basis: Performance of contract (Art. 6.1.b GDPR)

Billing and fraud prevention — Legal basis: Performance of contract and legal obligation (Art. 6.1.b/c GDPR)

AI model improvement (anonymized data only) — Legal basis: Legitimate interest (Art. 6.1.f GDPR)

Transactional communications — Legal basis: Performance of contract (Art. 6.1.b GDPR)

Marketing communications — Legal basis: Consent (Art. 6.1.a GDPR) — opt-in only

Compliance with legal obligations — Legal basis: Legal obligation (Art. 6.1.c GDPR)

4. Data Sharing

WORKIT DOIT does not sell your personal data. Your data may be shared with:

Technical Sub-processors

• Stripe / Delespot SAS — payment processing
• Cloud infrastructure providers — under GDPR-compliant data processing agreements
• Third-party AI providers — solely for content generation execution (content data is processed, not retained by providers)

Legal Requirements

We may be required to disclose your data to competent authorities where required by applicable law or in the context of legal proceedings.

Business Transfer

In the event of a merger, acquisition, or asset transfer, your data may be transferred to the successor entity, with the same protections maintained.

5. International Data Transfers

WORKIT DOIT is established in Israel. Your data is therefore processed in Israel. Israel has been granted an adequacy decision by the European Commission (Decision 2011/61/EU), recognizing that Israel provides an equivalent level of data protection to that guaranteed within the European Union. No additional transfer formalities are therefore required.

For data processed by sub-processors located outside the EEA and Israel, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Data Retention

Active account data — Retained for the lifetime of the account

Projects and generated content — Retained for the duration of the account, plus 30 days after termination

Billing data — Retained for 10 years (statutory accounting obligation)

Technical logs — Retained for 12 months

Marketing data (consent-based) — Retained for 3 years after last contact or withdrawal of consent

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — obtain a copy of your data
• Right of rectification — correct inaccurate data
• Right to erasure — request deletion of your data (“right to be forgotten”)
• Right to restriction — restrict certain processing activities
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Withdrawal of consent — for processing activities based on your consent (including marketing)

To exercise these rights: privacy@pkaila.com

We will respond within a maximum of 30 days. If your request is not resolved to your satisfaction, you may lodge a complaint with the data protection authority in your country. In France: the CNIL (www.cnil.fr).

8. Cookies

Essential Cookies (no consent required)

• Maintaining your authenticated session
• Security (CSRF protection)
• Language and interface preferences

Analytics Cookies (consent required)

• Anonymized audience measurement to improve the service
• Navigation path analysis

A cookie consent banner is displayed on your first visit. You can update your preferences at any time from your account settings or your browser settings.

9. Data Security

WORKIT DOIT implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction, including:

• Encryption of data in transit (TLS 1.3) and at rest
• Secure authentication with hashed password storage
• Data access restricted on a least-privilege basis
• Access monitoring and audit logging for sensitive operations

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify you within the timeframes required by the GDPR (72 hours to supervisory authorities, notification to affected individuals without undue delay).

10. Minors

The PKAILA platform is intended for professional use and for adults aged 18 and over. We do not knowingly collect personal data from minors. If you become aware that a minor has created an account, please notify us at privacy@pkaila.com so we can delete the account.

11. Policy Updates

We may update this Privacy Policy from time to time. Material changes will be communicated by email. The updated policy will be published on this page with a revised effective date. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

12. Contact

Data contact / DPO:
WORKIT DOIT — PKAILA
Rambam 66, 43602 Raanana, Israel
privacy@pkaila.com
Response time: up to 30 business days

Supervisory authority (France / EU):
CNIL — Commission Nationale de l’Informatique et des Libertés
3 place de Fontenoy, 75007 Paris, France
www.cnil.fr