מדיניות פרטיות

Privacy Policy (English)

Last updated: 6 September 2026

1. Who we are

Mitzi Pro is a production, client and social-content management system operated by EDY Production, Israel. Privacy enquiries: info@mitzi.pro.

2. Our role

Mitzi is sold to businesses. The business that licenses it is the controller of the data it enters — its own clients, projects, media and content. We act as its processor, storing and processing that data on its instructions and only to operate the service. If you are a client of a business that uses Mitzi, address requests about your data to that business. For the staff user accounts and our own commercial relationship with the business, we are the controller.

3. What we process

• Staff: name, email, role and permissions, credentials (passwords are stored as one-way hashes and are not visible to us), and an audit record of actions.
• The business’s clients: name, email, phone, company details, projects, documents, financial records and uploaded material.
• Uploaded content: video and images, which routinely contain identifiable people and are therefore personal data in their own right.
• Client approvals: comments, drawings and decisions submitted on a review page, and the email address used to verify that session.

We do not collect IP addresses. The application records no IP address and no user-agent anywhere. Our infrastructure providers log IP addresses at their own layer in the ordinary course of running a web service, under their own retention policies.

4. Instagram connection

A business using Mitzi may connect an Instagram professional account in order to schedule and publish its own content. The connection is made through Instagram’s official permissions screen, and only by an administrator of that business.

What we receive: the account id, username and account type, so we can show which account a post will go out from; an access token, so a post you scheduled can be published at the time you chose without anyone present; and, only if you granted the comments permission, the comments on your own posts together with the commenter’s username and timestamp, so they can be read and answered inside Mitzi.

What we do not do: we publish nothing that you did not create and schedule in Mitzi. We do not read direct messages, follower lists or any other account’s data. We do not sell Instagram data, do not use it for advertising, and do not pass it to any third party.

Tokens are stored encrypted (AES-GCM) in that business’s own dedicated database, with the encryption key held in a separate environment from the database. A token is refreshed automatically for as long as the connection remains active.

You can disconnect at any time from inside Mitzi (Settings → Social integration), or by removing Mitzi in your Instagram settings. Either deletes the access token immediately and ends our ability to publish on your behalf. See Data deletion.

5. Why we use it

• To provide the service the business licensed and to manage that relationship.
• To send operational email — approvals, reminders, review links.
• To secure the system, diagnose faults and prevent misuse.
• To meet legal obligations, including record-keeping.

We do not profile, do not show advertising, and do not sell data to anyone.

6. Sub-processors

7. Where data is stored

Each business is given a separate, isolated database; data belonging to different businesses is never pooled. The hosting region is set per deployment and stated in that customer’s agreement. Regions currently in use are Frankfurt (EU) and Sydney (Australia).

8. Cookies and local storage

There are no advertising cookies, no analytics cookies, no tracking pixels and no marketing tags in Mitzi. Browser storage is strictly functional: a staff member’s signed-in session and display preferences. A client review session is cleared when the browser tab closes.

9. Security

• Transport encryption (HTTPS/TLS) on every connection. This is not end-to-end encryption.
• Row-level access control in the database, so a user sees only what they are entitled to.
• Social tokens encrypted at rest under a key held outside the database.
• An audit log of significant actions.

10. Retention and deletion

We retain data for as long as it is needed for the engagement and for statutory record-keeping periods. The system does not delete media automatically; deletion is initiated by the business. On termination, a business’s data is deleted or returned at its request. For Instagram data specifically, see Data deletion.

11. Your rights

Under Israeli privacy law and, where it applies, the GDPR, you may access, correct, request deletion of, and object to the processing of your personal data. We respond within 30 days. Some requests are fulfilled manually rather than through the product. If the data belongs to a business using Mitzi, we will direct you to that business.

12. Changes

We update this page when things change, and the date at the top changes with it. Material changes are also communicated directly to businesses using the system.

13. Contact

info@mitzi.pro · EDY Production, Israel