Privacy policy

Last updated 1 November 2026 · https://yeshavoda.co.il

This is a translation for convenience. The Hebrew version is the binding one; if the two differ, the Hebrew text prevails.

1. General

Yesh Avoda ("the service", "we") is operated by Maor Idi (ID number, address and phone: see section 12), who is also the database owner and the one responsible for the information collected in the service. Yesh Avoda is an online service that finds job openings in Israel that match the roles and preferences you pick and, at your request, applies to them on your behalf. This policy explains what information is collected, why, who receives it, how long it is kept and what your rights are. It covers the website, the installed app and every service provided through them.

This policy follows the Israeli Protection of Privacy Law, 5741–1981, and the regulations under it. Using the service requires agreeing to this policy and to the terms of service.

2. What we collect

• Account details: your email address, name and profile picture from your Google account.
• What you enter: your profile details (for example phone, city, experience, education, links), resumes, cover letters, job-search settings (including companies you ask us never to apply to, such as your current employer) and, if you choose to add it, your ID number.
• What the service produces: the jobs found and applied to and their status, run logs, browser data (cookies and sign-ins) for career sites where an account was opened for you, and the password the service created for you on those sites.
• Your Yesh Avoda email address and the mail sent to it: see section 4.
• Feedback: messages you send us with "Send feedback" (bug reports, suggestions, questions), any screenshots you attach, the page you sent them from and your device details (device and browser type, screen size, light or dark mode, app version). They are kept until you delete your account.
• Email to our business addresses: emails you send to [email protected] or [email protected] and our answers, kept encrypted so we can answer you and keep business records. Only the service operator reads them.
• Payments: when you buy Pro, PayPal tells us whether each payment (renewals included) went through, its amount and PayPal's subscription, order and payment numbers. What you type on PayPal's page (card, name, address) stays with PayPal; we don't receive your card details.
• Coupons and invites: which coupon codes you used, who invited you or whom you invited, and the free days given. To stop one person from inviting themselves, every sign-in also keeps a one-way code made from your network address and from a random device cookie (aa_dev); these codes cannot be turned back into the address.
• Notifications: if you turn notifications on, your browser's or device's push subscription address.
• Technical information: IP address and request details, for security and abuse prevention (rate limits, sign-in checks), and a record of account actions (for example sign-in, settings changes) without personal content.

You are under no legal obligation to give us information. Giving it depends on your will and consent, but without your account details, profile and resume the service cannot apply on your behalf.

3. How it is used

• To find jobs that match you and apply to them, never to the companies you listed to skip: filling in application forms, attaching your resume and sending your cover letter (unless you chose to send none).
• To write or tailor cover letters, fill in your profile from your resume and suggest roles (and name the current employer your resume shows, so you can choose to skip it), when you ask the AI assistant.
• To suggest more roles to search: the service counts the jobs it saw for you that a role you did not pick would have found, and counts across all accounts how often roles are picked together (totals only, never who picked what). Such a share is shown only once at least 10 accounts picked the role.
• To receive mail sent to your Yesh Avoda address, show employers' replies to you and forward mail to your email.
• To send you email and notification updates about what the service did, a weekly summary and reminders, according to your settings.
• Only if you agreed: to send you tips, news and offers (advertisements) by email. We keep a record of when you agreed or withdrew, and which of these emails were sent to you (without their content).
• To read and answer the feedback you send, and to improve the service with it. The service operator reads it and it is emailed to them.
• To give coupon discounts and invite rewards, and to prevent their abuse (for example one person inviting their own second account). Whoever invited you sees only how many friends joined, and is told when a friend's Pro purchase earned (or, after a refund, took back) their free days; never your name or details.
• To run your account and plan, secure the service, fix problems and comply with the law.
• From 16 October 2026, to give support and check that the service works properly: the service operator can see the list of jobs the service applied to for you (job title, company, date, status and how it was sent). Your resume, profile, cover letters and mail are not shown there, and every viewing is recorded.

We do not sell personal information, use it for advertising or build marketing profiles from it.

4. Your Yesh Avoda email address

When you sign in with Google we ask only for your basic profile (name, email address, picture). We have no access to your Gmail, Drive, contacts, calendar or any other Google data.

• Your address: every account gets its own address on the service's domain (for example [email protected]), made from your name. Email applications are sent from it and career sites get it instead of your personal email. The address is never given to anyone else, even after your account is deleted.
• Mail sent to it is received by the service and kept encrypted (see section 8): mail is shown on the Inbox page, and employers' answers to your applications are forwarded to the email of your Google account. Verification codes and other mail not about your applications are read by the service only to apply for you, and are deleted after 10 days. Mailing lists that send to this address without being asked (for example a site's newsletter) are unsubscribed automatically. An email is shown as its sender made it: its pictures load from the sender's servers when you open it, as in any email app, so the sender may learn that it was opened.
• Answers: you answer employers from your own email (replying to the forwarded copy); the service does not send mail you write.
• Mail is sent and received through Resend (see section 6).

5. AI

• Job pages, the profile facts needed to fill application forms, and your resume (when you use the AI assistant) are sent for processing to one or more cloud AI providers: Google (Gemini), Groq, OpenRouter (which passes the request on to the company that runs the chosen model), Cerebras or GitHub Models (Microsoft). They work under their own terms, mostly in the United States. Under those terms, especially on free plans, a provider may keep the information for a limited time and use it to improve its services.
• An employer's answer that looks like an interview invitation is also read by the AI, to check that it really is one before it is marked "Interview".
• Your ID number is never sent to an AI provider: it is typed only into application forms that ask for it.
• AI answers can be wrong. Check a profile or letter the assistant wrote before you use it.

6. Who receives it

• Employers, job boards and career sites you apply to on your behalf: your profile, resume and cover letter. That is the purpose of the service. Once they receive it, it is subject to their own privacy policies.
• Google: sign-in.
• AI providers listed in section 5: the information needed for the action you or the service asked for.
• Resend: sending and receiving the mail of your Yesh Avoda address (servers in Ireland, in the European Union).
• Cloudflare: access to the site goes through Cloudflare's network (security and traffic encryption). The bot's searches on job boards also go through it, so the boards see Cloudflare's address instead of our server's; that traffic stays encrypted between the bot and the board.
• PayPal: payment for Pro and its renewals. We send PayPal only the plan and its price; PayPal handles what you give it on its own page under its own privacy policy, and keeps your means of payment to charge the subscription until you cancel it.
• EZcount (Israel): the operator's invoicing system, which issues and emails the receipt for each payment and refund. It gets your name, email address, the plan, the amount and the date.
• Push services of your browser or device maker (Apple, Google, Mozilla, Microsoft), if you turn notifications on. Notification content is encrypted so only your device can read it.
• Authorities, when the law requires it, or to protect rights, safety or the service.

The service's servers are in Israel. Some of the providers above process information outside Israel, subject to the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761–2001.

7. Security

Your personal information is encrypted at rest (AES-256-GCM) with a key that belongs to your account alone. It is decrypted only while an action for you is in progress, on the server that performs it, and the working copy is deleted when the action ends. From 16 October 2026, the list of your applications is also decrypted when the service operator views it for support (section 3); every viewing is recorded. Traffic to the site is encrypted (HTTPS) and access to the servers is restricted. No system is completely secure; if a security incident affects your information, we will act and notify as the law requires.

8. Retention

• Account and profile information: while your account exists.
• Run logs: the last 60 runs. A summary of each run (when it ran, its result and how many jobs it handled, without the jobs themselves): 13 months.
• Mail sent to your address: 180 days; verification codes and other mail not about your applications: 10 days.
• Which summaries, reminders and offers were emailed to you (kind and date only): 13 months.
• Payment records (amount, date, plan and PayPal's numbers): 7 years, as the tax and bookkeeping laws require. After an account is deleted they are no longer linked to a name or an email address, except the receipts and credit receipts (your name, email, amount and date), which the same laws require keeping for 7 years in the operator's invoicing system.
• Encrypted database backups: 14 days.
• IP addresses: in abuse-prevention records for up to a day, and in server logs for a short time. The one-way codes of sign-ins (network address and device cookie): 90 days.
• Invites and coupon uses: while your account exists. A coupon use stays linked to the one-way code of your email after the account is deleted, so a code can't be used twice.
• Records of account actions (for example sign-in or a plan change), without personal content: kept for security and accounting. After an account is deleted they are no longer linked to a name or an email address.

When an account is deleted, its information and its encryption key are erased permanently, so backups cannot be read either. Apart from the records of account actions above, only a one-way code made from your email address is kept (it cannot be turned back into the address), so that signing up again starts without a new free trial and can't use a coupon or an invite again. Accounts opened for you on career sites, and applications already sent to employers, remain with them.

9. Your rights

• Access: review your information. You can download all of it from the Account page at any time.
• Correction: correct information on the Profile and Settings pages, or ask us to correct or delete information that is not correct, complete, clear or up to date.
• Deletion: delete your account from the Account page at any time.
• Stopping updates and offers: turn off email and notification updates on the Settings page. Summaries, reminders and offers also have a one-click unsubscribe link in every email, and you can withdraw your consent to offers at any time.

Send requests to the address in section 12. We answer within 30 days. If a request was not handled properly, you may contact the Israeli Privacy Protection Authority.

10. Cookies and browser storage

The service uses only necessary cookies. There are no third-party advertising, tracking or analytics cookies.

• Session (aa_session): keeps you signed in, for up to 7 days.
• Language and appearance (aa_lang, aa_theme): the language and theme you chose, for a year.
• Messages (aa_flash): a confirmation or error message after an action, for a minute.
• Sign-in with Google (aa_gstate): protects the sign-in flow, for 10 minutes.
• Invite link (aa_ref): the friend's invite link you opened, until you sign up, for up to 30 days.
• Device marker (aa_dev): a random code, for about a year, used only to spot one person inviting themselves (section 2).
• Page after sign-in (aa_next): the app page you opened while signed out (for example from a notification), so signing in takes you back to it, for 15 minutes.

The installed app keeps display files in the browser so it opens fast and works offline, and remembers whether you dismissed an install or notifications prompt.

11. Minors

The service is for people aged 18 and over. If we learn that an account was opened for a minor without a parent's or guardian's consent, we will delete it.

12. Changes and contact

We may update this policy from time to time. We will announce a material change on the site or by email before it takes effect. The date of the last update is at the top of this page.

Privacy questions, requests and complaints, to Maor Idi: [email protected], or by phone and post. The ID number, address and phone are shown when you press the button and are not printed in the page, so that automated tools do not collect them.