Last updated: November 1, 2026
In plain words, this is how we treat your data: • Only what the service needs. We never ask for your date of birth: at sign-up you choose an age range, and the range is all we keep. • Protecting young workers. You must be 15 or older to register. People aged 15–17 register only with the agreement of a parent or guardian, and employers they apply to are told about their legal duties toward minors. • Proof of what you agreed to. When you confirm your age or agree to identity verification, we record which version of the text you saw. • Deletion. You can delete your account and data at any time. If we learn that someone under 15 has registered, we delete the account and its data. • We do not sell your personal data.
Workes (workes.co.il) is a job search platform in Israel. We respect your privacy and are committed to protecting your personal data. This Privacy Policy describes what data we collect, how we use it, and what rights you have. By using the platform, you agree to the terms of this Privacy Policy. This Policy is governed by and construed in accordance with the laws of the State of Israel.
When using our platform, we may collect the following information: • Name, email address, and phone number — when registering on the platform. • City of residence — provided optionally in your profile. • Identity documents (ID card, passport) — may be uploaded voluntarily for identity verification. Processing of such documents is carried out exclusively for the purpose of identity verification. Documents may be deleted at the user's request, except in cases where their retention is required under the laws of the State of Israel. Documents are retained no longer than necessary for verification purposes. • Visit data — cookies, IP address, browser type and version, operating system, pages visited, and visit times. • Job and application information — data you provide when applying for jobs. • Sign-in and account security records — your phone number is how you sign in (for employers: the second sign-in factor, together with the password). To protect accounts we keep records of the sign-in codes we create (only in coded form, deleted shortly after the code expires), of wrong attempts (deleted after a short period) and, for employer accounts, previous phone numbers for 90 days after a change. Sign-in codes sent to workers by SMS are created and kept by our sign-in service provider (Supabase, section 4) under its own rules. Security notices about an employer account are sent to its email address. If someone tries to register an employer account with an email address that is already in use, we send a notice to that address. We do NOT collect or store: • Bank details and bank account information. • Credit and debit card numbers. All financial transactions, if required, are processed by third-party payment providers; we do not receive or store card numbers.
Collected data is used exclusively for the following purposes: • Providing platform services — displaying jobs, processing applications, managing your account. • Job-related communication — notifications about application status, new matching vacancies. • Improving the website — analyzing usage to optimize functionality and user experience. • Legal compliance — fulfilling requirements of applicable law. Personalised vacancy suggestions ("Vacancies for you"). Only if you switch this on in your notification settings (/notifications/settings), which is your consent, we build an interest profile from the vacancies you applied to, saved or viewed in the last 180 days, their categories, and the city in your profile, and once a day show you up to five new matching vacancies as an in-app notification. This is profiling, but it leads to no decision with legal or similarly significant effect on you: it only chooses which vacancies to suggest. It is off by default. You can withdraw your consent at any time on the same page, and suggestions stop immediately. Notifications are kept 90 days after you read them and at most 180 days, and are deleted together with your account. Email digest. If you switch it on, we send a daily summary of unread notifications to the confirmed email address of your account only. You can switch it off in the same settings.
We do not sell, rent, or share your personal data with third parties for commercial purposes. Your data may be shared with third parties only in the following cases: • Service providers — companies providing hosting, analytics, and technical support for the platform, subject to their confidentiality obligations. • Vercel Inc. — anonymous analytics and performance monitoring. • Google (Google Analytics, Google Ads) — traffic statistics and advertising performance measurement. Only de-identified on-site behaviour data and an advertising click identifier are shared. We do NOT send Google your name, phone number, email address, or hashed versions of them. Loaded only after your consent via the cookie banner. • Translation services — vacancy descriptions may be processed by third-party translation services to provide multilingual support. • Employers and partners (including recruitment agencies) — when you apply for a job or otherwise interact with a vacancy (e.g., submitting an application, viewing employer contacts, or other actions indicating interest in a vacancy), your data (including contact information and profile data) may be shared with the relevant employer or partner for the purpose of considering your candidacy. Data is shared to the extent necessary for these purposes. • Legal requirements — government authorities. • With your explicit consent — in cases where you have given direct consent to data sharing. • Resend, Inc. (United States): delivers the optional daily notification email digest and service emails. It processes your email address and the content of those emails. This data is processed in the United States. • Supabase, Inc. — hosts our database, file storage and sign-in service, and processes all account data on our behalf. • Twilio Inc. (United States) — delivers SMS sign-in codes. It processes your phone number and the text of the message, which contains the code. • Cloudflare, Inc. (Turnstile) — the automatic check that a person, not a program, is using a sign-in or registration form. It processes your IP address and technical information from your browser at that moment. • Upstash, Inc. — stores counters that limit how often a request can be made. Your IP address or phone number reaches it only in coded form, made with a secret key that Upstash does not hold. • Meta Platforms (WhatsApp) — only when a sign-in code is delivered by WhatsApp: it processes your phone number and the message. • Zoho Corporation (Zoho Mail) — hosts our mailbox: it processes the emails you send us and our replies. • MyMemory (Translated srl) — translates vacancy texts; it receives the vacancy text only. • Cloudflare, Inc. — also delivers the vacancy map from our own map service on its network; it processes your IP address when you view the map. • OpenStreetMap Foundation (Nominatim) — turns vacancy addresses into map positions; it receives the vacancy address only, never data about you. • Google — when an employer enters the company website during registration, the browser loads that site's icon (favicon) from Google, which receives the website address and your IP address.
Identity verification is optional and happens only if you choose to start it. • Who performs it: verification is carried out by Didit Inc., a third-party processor. We do not receive or store your document images, selfie or biometric templates — they go from your browser directly to Didit. • What Didit collects: an image of your identity document, a selfie, and a liveness check. A selfie and a liveness check are biometric data. • Camera access: verification opens on the Didit page (verify.didit.me), and the camera permission is requested there, by Didit. Workes never switches your camera on, records no video and stores no image. The document photo and the liveness check are captured by Didit. • Purpose and legal basis: meeting identity-verification obligations under Israeli law (Privacy Protection Law, Amendment 13) and anti-money-laundering requirements. Verification is carried out on the basis of your explicit consent, which we record so that we can demonstrate it was given. • Retention: verification records are kept for 24 hours after approval. Declined sessions are kept for up to 90 days for review. • International transfer: data is transferred to Didit in the United States under standard contractual clauses (SCCs). • Withdrawing consent: you may withdraw consent at any time and ask us to delete your verification data, except where the law requires us to keep it.
We use cookies for the following purposes: • Ensuring proper website operation — remembering settings, authorization. • Analytics — collecting anonymous data about traffic and user behavior. Analytics cookies are loaded only after your explicit consent via the cookie banner. • Advertising — measuring the effectiveness of our advertising campaigns. If you arrived via an advertisement, we store an identifier for that click so we can tell which advertising brings candidates. This identifier contains no personal data and is kept for no more than 90 days. Advertising cookies are loaded only after your explicit consent via the cookie banner; if you decline, they are not set. • Improving user experience — personalizing content and recommendations. You can disable cookies in your browser settings. You can manage cookie settings via the banner on your first visit to the site.
How we protect your data: • Our site tells browsers to connect to it only over an encrypted connection (HTTPS). • Access to account data is checked by the database itself: a worker account reaches only its own profile, documents, applications and notifications, and employer data opens only after the employer signs in with a password and an SMS code. • Sign-in codes that we create are never stored in readable form in our systems, and the number of attempts to enter a code is limited. What exactly we guarantee about account security, how we check it, and what we do not guarantee is described on our Account security page: workes.co.il/security. No system for transmitting or storing data can be completely secure. We commit to notifying you within a reasonable timeframe in the event of a data breach. We retain personal data only for the period necessary to provide platform services, or until the user deletes their account, unless otherwise required by law. Personal data may be processed and stored on servers outside the State of Israel. Section 4 names the providers that process it and, where stated, the country.
In accordance with applicable law, you have the following rights: • Right of access — request a copy of the personal data we hold about you. • Right to rectification — request correction of inaccurate or incomplete data. • Right to erasure — request deletion of your personal data. • Right to data export — download a copy of all your personal data. We process such requests within a reasonable timeframe in accordance with the law. To exercise any of these rights, contact us at: info@workes.co.il
• Minimum age: workers must be at least 15 years old to register on Workes. Employers must be at least 18. • How we ask: at registration you choose an age range (under 15, 15–17, or 18 or older). We do not ask for your date of birth and we do not check your age against documents. • What we keep: your age range, whether you declared the agreement of a parent or guardian, the language and version of the question, and when you answered. If you answer “under 15”, no account is created and we keep no personal data about the answer; your browser keeps a note for 30 days so the question is not offered again. • Workers aged 15–17 may register only if a parent or guardian agrees, and confirm this when they register. Employers who receive their application are told that the candidate is a minor and what the Youth Employment Law requires. • If we learn that a person under 15 has registered, we delete the account and its data. A parent or guardian can ask us to delete a minor’s account by writing to info@workes.co.il.
We reserve the right to update this Privacy Policy at any time. The date of the last update is indicated at the top of this page. We will notify you of changes by posting the updated Privacy Policy on this page. Continued use of the platform after changes are made constitutes your agreement to the updated Policy.
If you have any questions or concerns about this Privacy Policy, please contact us: • Privacy email: info@workes.co.il • Phone: +972 534-621482 • Website: workes.co.il