Privacy notice

לוח הנדרים

Who we are

Luah Hanedarim helps synagogue staff scan pledge boards, review OCR results, and export dues data. The synagogue operating this installation is the data controller. Contact details should be added here by the synagogue (e.g. gabbai or privacy officer email).

What personal data we process

Pledger names — read from board photos via OCR and shown in the review UI.
Pledge amounts — financial details associated with each row.
Board photographs — captured on the phone camera and sent to the server for OCR.
Staff account data — username and email (stored in Supabase Auth; email is not stored in the profiles table).
Technical data — IP addresses, session identifiers, and security audit events (login, capture, export).

Why we process it

To manage synagogue dues on Shabbat and holidays: scanning luah hanedarim boards, correcting OCR results, and exporting data to accounting systems.

Processors and cross-border transfer

Depending on your configuration, data may be processed by:

Google Cloud Vision — OCR on board images (may process data outside Israel).
Supabase — authentication and user profiles (hosting region depends on your project).
Auth0 — optional staff sign-in (OIDC identity provider).

Cross-border transfers require a legal basis under Israeli Transfer Regulations. Ensure contracts and data-processing agreements are in place with each vendor.

Retention

Pledge edits in the browser may remain in localStorage until cleared by the user.
Security audit logs are retained per synagogue policy (recommended: at least two years).
Exported files are stored wherever the synagogue saves them.

Security measures

HTTPS with NIST SP 800-52-aligned TLS (self-signed on LAN; accept the browser warning on phones).
HttpOnly, Secure session cookies after sign-in.
Append-only audit log of sign-in, capture, OCR, and export events (no pledge content in logs).

Your rights

Under the Israeli Protection of Privacy Law (including Amendment 13), individuals may have rights to access, correct, or request deletion of their personal data. Contact the synagogue privacy officer to exercise these rights.