Privacy Policy

Last Updated: September 2026

1. General

This privacy policy describes how CrossFit Afula ("we", "our", "the gym") collects, uses, and protects your personal information. We are committed to protecting your privacy and complying with the Israeli Privacy Protection Law, 5741-1981 (including Amendment 13) and the Communications Law (Bezeq and Broadcasts), 5742-1982 (Amendment 40 — the anti-spam law). Providing information through this site is voluntary, and you do not have to provide any information in order to browse the site. If you choose not to provide it, we will not be able to get back to you, handle your request, or deliver the service you asked for. One exception: under section 14I of the Consumer Protection Law, a cancellation notice must include a name and ID number. Using the online form itself is not mandatory — you may also cancel by phone or email — but a cancellation notice without those details does not allow us to identify who is cancelling or to process the cancellation.

2. Information We Collect

We collect the following information: • Personal details: Full name, phone number, email address, city • A health confirmation (when booking a trial): a tick-box stating your health permits participation. We do not collect a detailed health questionnaire through this website • Israeli ID number — on the cancellation form only, to identify the person requesting cancellation as required by law • Child details on the kids/youth registration form: name and age • Review content submitted through the site: your rating and the text you wrote, for publication after approval • Training preferences: fitness level, preferred times, personal goals • The content of your enquiry on the contact forms: the enquiry type and any notes you write • Details you leave in the “Can we help?” panel: your name, phone, and the message you write • A stored payment credential (token): when you buy on the site, the payment processor creates a secure identifier for your card. We store that identifier with the order and pass it to OnTrack Hub so a future charge is possible — for example converting a trial into a membership — without re-entering the card. We do not store the full card number • Technical information: IP address, browser type, pages viewed, session and cookie identifiers • Attribution data stored with your form: campaign parameters (UTM), the site you arrived from, and the URL of the page where you filled the form in • Transaction details for purchases on the site: the plan bought, the amount, a promo code if one was used, and the payment status The health confirmation and the ID number are stored as part of the inquiry record, and access to them is restricted to relevant staff.

3. Purpose of Information Use

We use the information for: • Scheduling and managing trial workouts, memberships, and club activities • Contacting you about workouts, schedule changes, and operational updates • Improving and personalizing the service • Sending marketing updates and offers — only if you actively ticked a consent checkbox • Complying with legal requirements

4. Sharing with Service Providers (Third Parties)

We rely on third-party providers to operate the service. Some of them process personal data on our behalf: • Supabase — secure data storage (forms, leads, registrations) • Vercel — website hosting and server infrastructure (including access logs and IP address) • PayPlus — payment processing and payment methods • Sumit — invoice and receipt generation • Green API — infrastructure for sending and receiving WhatsApp messages • Telegram — internal staff alerts about inquiries and new reviews, including the details submitted • Meta / WhatsApp — operating the WhatsApp channel you choose to contact us through from the site • Anthropic — processing of WhatsApp conversations with the gym using AI (Claude model) • Cloudflare Stream — hosting and delivery of the members’ film. The player loads ONLY after you press “Watch the film”; until then your browser makes no request to it at all • Google Tag Manager / Google Analytics — site usage analytics (loaded only after consent via the cookie banner) • Microsoft Clarity — UX analysis and session recordings. Recordings are field-masked but not anonymous: Clarity stores a unique identifier linking views from the same browser (loaded only after consent) • Meta / Facebook Pixel — advertising measurement and remarketing (loaded only after marketing consent) • OnTrack Hub — customer management system (CRM) for leads, memberships, and workouts. It also receives the stored payment credential, for future charges • Resend — transactional email delivery (confirmations, updates) • Law enforcement authorities — when required by law We do not sell or rent your personal information to third parties.

5. Information Security

We implement appropriate security measures, including: • Data encryption in transit (HTTPS/TLS) and at rest • Access restricted to authorized staff on a need-to-know basis • Additional access restrictions on sensitive (health) data • Backup and security systems • Periodic security reviews

6. Your Rights

Under the Privacy Protection Law, you have the following rights: • Right to access information stored about you • Right to request correction of incorrect information • Right to request deletion of information ("right to be forgotten"), subject to legal limits • Right to object to use of your information for direct marketing • Right to withdraw consent for marketing communications at any time (immediate, free removal) To exercise your rights, contact us using the details below.

7. Cookies and Measurement Tools

The website uses cookies, browser local storage (localStorage) and measurement tools. Your consent choice is stored in the browser's local storage rather than in a cookie, so we can remember it on your next visit. Analytics and marketing cookies load ONLY after you grant consent via the cookie banner. Tools activated after consent: • Google Tag Manager and Google Analytics — analytics • Microsoft Clarity — UX analysis and session recordings • Meta / Facebook Pixel — ad measurement and remarketing You can change your cookie preferences at any time via the banner or clear cookies via your browser settings.

8. Inquiries via the Site and WhatsApp

There is no chatbot on this site. The “Can we help?” panel offers two ways to reach us: a link to the gym’s WhatsApp, and a form for leaving your name, phone and a message — the form details are stored so we can get back to you and track the inquiry. WhatsApp conversations with the gym are answered with the help of an automated system based on AI (Claude, by Anthropic), under staff supervision, and are stored to provide and improve the service. We recommend avoiding sensitive medical information or unnecessary personal details in messages, and phoning us for any sensitive matter.

9. Data Retention

We retain your information as long as it is needed for the purposes for which it was collected, or as required by law. After the end of the relationship, we will keep the information for a reasonable period for administrative and legal purposes.

10. Policy Changes

We may update this policy from time to time. Material changes will be published on the website and you will be notified accordingly. Continued use of the site after publication of changes constitutes consent to the updated policy.

11. Contact Us

For questions, requests, or complaints regarding privacy: CrossFit Afula — Tzor Strength & Movement LTD Address: Kidron 14, Afula Phone: 04-6920555 Email: info@tzorsm.com