Privacy Policy

1. Who we are and who is responsible

The service is operated by Asher Bukshpan ("Bima", "we"), Israel. Contact for anything privacy-related: main@bscale.co.il.

Two roles: for staff accounts and site visitors, Bima is the data controller. For viewers and each organization's viewer lists, the organization is the controller and Bima processes on its behalf under our Data Processing Agreement. If you are a viewer with a question about your data, the first address is the organization that invited you; we will assist both of you.

2. What we actually collect

Only what the service needs. The full list, by who you are:

• Organization staff: email, name, language, password (one-way hash only), two-factor settings (TOTP secret encrypted AES-256-GCM, recovery codes hashed), last login, role per organization.
• Sign in with Google (staff): account id, verified email and name - openid, email, profile only. We get no access to your mail, files or contacts.
• Viewers: display name and group as entered by the organization, sometimes the last four digits of a phone number (shown on the watermark). The viewing code is stored only as a keyed hash; it cannot be recovered.
• Viewing session: watermark reference (8 characters, unique), device fingerprint (keyed one-way hash - the device cannot be reconstructed from it), browser string (User-Agent), entry and activity times. Used for single-session enforcement and leak forensics.
• Viewer lists (the organization's address book): name, phone, email, external reference - as the organization entered them. This is the organization's data; we only store it for them.
• Audit log: for every action - who (email), when, from which IP address, which browser, and what changed (before/after). The IP address is kept in clear only in this log.
• Recordings: video and audio of the broadcast, if the organization enabled recording. The recording itself carries no watermark; the watermark is applied only at viewing time.
• Technical server logs: request id, path, method, user id and email, organization and broadcast ids, response code - for operations and troubleshooting.

3. What we do not do

• No analytics, no Google Analytics, no Tag Manager, no advertising pixels - on any page. Hence no cookie banner: we use strictly necessary cookies only (see the Cookies Policy).
• We do not sell data and do not share it with third parties for their purposes. No advertising.
• We do not send broadcast content to AI models and do not generate content with them. Forbidden-topic screening (section 9) is text matching against an operator-defined list, not AI analysis.
• We never lock a viewing code because of wrong attempts - only the attempting source is limited, so the legitimate viewer is not harmed.

4. Why, and on what legal basis

• Running the service you ordered (contract): accounts, sign-in, broadcasts, codes, player.
• Security and prevention of unauthorized redistribution (legitimate interest of the organization and ours, and the terms): personal watermark, single session, watermark forensics, rate limits, audit log.
• Legal obligations and platform policy enforcement: recording blocked content, keeping the audit log as evidence.
• Consent: when an organization chooses to record, and when a viewer enters a code into a watermarked broadcast (section 5).

5. The watermark - explicit notice to viewers

Every viewer's screen in a protected broadcast carries a semi-transparent mark: the name the organization entered (personal code), an 8-character reference, sometimes the last four phone digits, and the time. The mark moves. Its purpose is to prevent redistribution outside the invited audience: a leaked screenshot identifies which viewing code it came from.

Meaning: if you photograph or record the screen and distribute it, the organization can tell it came from your code. Entering the broadcast with a code is consent to this, and a notice appears on the entry screen.

6. How long we keep data

Honestly, as of today: most data is kept while the organization is active and deleted with the organization (section 8). The audit log deliberately survives organization deletion - it is the evidence that the organization existed and what was done in it - and is kept for up to 24 months from the entry, after which it may be deleted. Recordings are kept until the organization deletes them or the organization closes. Ended viewing sessions are kept for leak forensics for up to 24 months.

We are building an automatic deletion job for this schedule; until it runs, deletion happens on request (section 8) and proactively by us.

7. Where the data is, and who the providers are

The service runs on Google Cloud. Application servers and the database are in the Tel Aviv region (me-west1). Recordings are stored in Google Cloud Storage. The media server is currently in Europe (Netherlands, europe-west4). Server logs are in Google Cloud Logging. The full sub-processor list is published on a separate page and updated there.

International transfers: Israel holds an EU adequacy decision (reaffirmed January 2024). Transfers to Google Cloud in the EU and other regions are covered by Google Cloud's standard contractual clauses.

8. Your rights and how to exercise them

Anyone whose data we hold may: know what data exists (access), correct, delete, receive a copy (portability), object to processing, and lodge a complaint with the Privacy Protection Authority at Israel's Ministry of Justice or with the authority in your country.

Organization staff: from your account - export your data and delete your account (deletion removes your identity; audit rows in which you appear as the actor are kept as an email snapshot under GDPR Art. 17(3) and Israeli law, as evidence of actions taken).

Viewers: contact the organization that invited you - it can delete your details from viewer lists and codes. You may also contact us directly through the privacy request form on the site; we will handle it with the organization within 30 days.

Every request is answered within 30 days. No fee, except for repeated and unreasonable requests.

9. Platform content policy

The platform has a list of forbidden topics set by the operator. Organization names and broadcast titles are screened automatically against it (text matching, not AI). A match may cause the action to be refused or flagged for the operator's review. The check, the match and the decision are recorded in the log. We do not analyze the video or audio content of the broadcast itself.

10. Security

Passwords one-way hashed; two-factor secrets encrypted; viewing codes and stream keys stored only as keyed hashes; playback tokens live 120 seconds; permissions checked on every request; tenant isolation enforced at the database layer; the audit log cannot be altered or deleted from the application; support access to an organization is written to that organization's log before it happens.

A security incident affecting personal data will be reported to affected organizations without undue delay, and to the Privacy Protection Authority and data subjects as required by law (in Israel under the Data Security Regulations and Amendment 13 to the Privacy Protection Law; in the EU within 72 hours).

11. Minors

The service is intended for organizations and their staff, who are adults. Minor viewers may watch a broadcast to which the organization (for example an educational institution) invited them; the organization is then responsible for parental consent as required. We do not knowingly collect data from minors beyond the display name the organization entered.

12. Governing law and authorities

This policy is subject to Israel's Protection of Privacy Law 5741-1981, the Protection of Privacy Regulations (Data Security) 5777-2017, and Amendment 13 to the Law (in force since August 2025). For users in the EU and UK the GDPR and UK GDPR also apply; in California the CCPA/CPRA (we do not sell or share personal data for advertising); in Brazil the LGPD; in Canada PIPEDA.

Supervisory authority in Israel: the Privacy Protection Authority, Ministry of Justice.

13. Changes

We update this document when the product changes - for example when we add automated email, transcription, or new providers. The update date is at the top, and the document's history is kept in our code repository.