Privacy Policy

Wider Group is the trading name of the AI and Claude training business run by Shahar Wider, a licensed sole proprietor (עוסק מורשה) registered under 200759850, at 2 Pa'amei Aviv Street, Herzliya. We are the controller of the database this page describes. We're the ones who decide what gets collected, why, and how long it stays.

For anything about this policy, including inspection, correction and deletion requests, write to shahar@wider-group.com. Email is the only channel for those requests.

The Protection of Privacy Law requires certain kinds of organisation to appoint a privacy officer: public bodies, data brokers, and organisations whose core activity involves large-scale systematic monitoring or large-scale processing of sensitive data. Wider Group is none of those. We run a training site with a customer and student database, no systematic monitoring, and no sensitive data at that scale.

In practice, Shahar Wider is where anything privacy-related lands, at shahar@wider-group.com. If what we do changes and the duty attaches, we'll appoint an officer and put their details here.

When you fill out the contact form, we collect your email, your phone number if you choose to add it, the topic you selected, and your message. That's stored in our database for one reason, so we can reply to you.

When you create an account, we collect your email. If you sign up with Google, we also get your name, email, and profile photo from Google. If you sign up directly with an email and password, we ask for your first name, last name, and phone number instead.

Once you have an account, we keep a record of your role, which course modules you've been granted access to, when that access started, and, if it's time-limited, when it expires.

When you buy, we create an order: the offer, the price (VAT included), the email and phone number from your account, when you accepted the Purchase Terms, the time and status of the order and, if you used a partner's link or code, that code. Your name, email and phone number go to Paperless, which clears the card payment and issues the tax receipt. We never see or store your card details.

The site also uses a small number of cookies. You'll find the full list and what each one does in our Cookies Policy. If you accept analytics cookies, we also collect information about how you use the site, as described in the section on analytics and session replay.

Some visitors reach us through a partner's link or discount code. A partner is a person or business that promotes Wider Group for a commission. When you open an active partner link or enter a partner code at checkout, we store a cookie called wider_ref in your browser for 30 days. The cookie is set when the link opens, and checkout shows a notice that the partner code is applied. It carries the link or code you came with, so the discount stays applied until you pay and we can credit the purchase to the partner. It holds no name, email or other personal detail. It is a necessary cookie, and the Cookies Policy has the details.

When you pay, we record on the order which partner it was credited to, so we can apply the discount and work out that partner's commission. If you create an account after arriving through a partner and you chose Accept all cookies in the banner, we also record on your account that you signed up through that partner. The partner sees only a total. Visits to a link are stored as a daily count only.

The partner gets no identifying information about you from us: no name, email, phone, account ID or IP address. They see only a random order reference, the day (no time), the offer, the amount excluding VAT, the commission and its status. A partner has no way to produce a list of buyers. At checkout you can remove the code or continue at the regular price.

A partner is someone we invited to the partner program who has signed the partner agreement. About people we invite, we keep their name, email, country and language until the invitation is accepted or our yearly review. About partners we collect: legal name, phone, address and email; ID or company number and dealer status (Israel), or tax classification, tax residence, where the promotion is performed and a Form W-9 with a taxpayer identification number (United States); bank details; the channels and handles they promote on, whether most of their audience is under 18 and, if they wish, other brands they promote; documents they upload, such as payment demands, invoices, receipts and tax certificates; the record of their signature on the agreement, including the typed name, the time, the IP address, the browser details, the sign-in method and a copy of the text signed; and program activity: links and codes, daily click totals, purchases credited to them, commissions, statements and payouts. Changes to payout and tax details, staff viewing of full numbers, and staff downloading or adding a partner's documents are written to an access log.

We use these to send the invitation, verify identity, sign the agreement, issue links and codes, calculate commission and produce statements, pay and withhold tax, meet tax and bookkeeping law, prevent fraud and self-referral, check that promotion follows the marketing rules in the Partner Program Terms, and handle disputes. We use them for nothing outside the program, and we do not sell them.

A partner's identity, contact, tax and bank details, channels and signature on the agreement are needed so we can enable links, pay them and meet our tax duties. Without them we cannot enable links or pay. Other brands a partner promotes and the optional certificates, such as a withholding-tax certificate or a bookkeeping certificate, are voluntary. Without a withholding-tax certificate we withhold tax at the rate the law sets when there is none.

In the United States, the W-9 is uploaded to private storage. We collect the taxpayer identification number to file information returns with US tax authorities, and may disclose it to the IRS and to state tax agencies. A short version of this notice for partners is at wider-group.com/partner-privacy.

We use contact form details to answer your inquiry. We use account data to let you log in and reach the course modules you're entitled to. If you've allowed analytics, we use it to understand how people use the site and where they get stuck, so we can make it better. If you arrived through a partner, we use the record of that partner to apply your discount and to pay the partner a commission on the purchase. What we do with partners' own data is set out separately, in the section “If You're a Partner”.

Giving us your information is your choice, but without it we can't do much for you. No email or phone number means we can't reply to your message, and no account details mean we can't give you access to the courses you're entitled to. For partners, see “If You're a Partner”, which says what is required and what is voluntary.

We process your information based on the consent you give when you submit a form or sign up, and based on our legitimate need to run the course modules you're enrolled in.

Analytics and recordings are processed on the basis of the consent you give in the banner, and you can withdraw it at any time.

We process partners' data to carry out the partner agreement and to meet our tax and bookkeeping duties. Details given voluntarily, such as the optional certificates, are given with consent. Crediting a purchase to a partner serves the discount you asked for and the commission owed on that purchase.

We work with a small number of providers to run the site. Supabase handles our database and login system. Vercel hosts the site. Resend sends our emails. Soniox turns the instructor's recordings into captions for the course videos. It receives only the instructor's audio track, never anything about students. PostHog, hosted in the United States, handles analytics and visit recordings, and Google Analytics measures the public pages. Both run only with your consent.

PostHog stores its data in the United States, outside Israel. We have a data processing agreement with PostHog. It sets out how PostHog may use the data and requires it to process the data only on our instructions. We only send it data after you accept analytics cookies. You can withdraw that consent at any time, as the Cookies Policy explains. Once you do, the transfer stops and the ph_ cookies and stored identifier are deleted from your browser.

Paperless clears card payments and issues invoices. It receives your name, email and phone number, the order details and, if you used a partner code, that code so the discount applies.

For the partner program, the database and the private storage for partner documents are with Supabase, on servers in Frankfurt, Germany, outside Israel. We transfer data there to run the program. Partner data also reaches our accountant, the bank that carries the payment, and tax authorities where the law requires. In the United States that includes the IRS and state tax agencies, with the taxpayer identification number. Partners get no identifying information about buyers from us, and we do not pass one partner's data to other partners.

We never sell your data to anyone. We don't share it beyond these providers and the recipients named above, except where the law requires us to.

PostHog is the product-analytics tool that helps us see where visitors drop off between landing on the site and getting in touch or signing up and what they click, and lets us watch recordings of real visits. It runs alongside Google Analytics, not instead of it.

It switches on only after you accept analytics cookies in the banner. Until then the library isn't even downloaded to your browser, so there's no ph_ cookie and no data. If you chose necessary only, it stays off, and if you withdraw consent later, it stops capturing and the ph_ cookies and stored identifier are deleted.

When it's running, PostHog records which pages you visit and what you click, and builds click heatmaps from that. It also records the visit itself, and the recording shows what's on screen, not just where the mouse went. Typed fields, such as a password, an email, a message or an exercise answer, are masked in the recording, so what you type into them doesn't appear in it. Any area we've marked is hidden the same way. The account, checkout and private-proposal pages are never recorded at all, though clicks there are still counted.

PostHog receives your IP address but does not save it with your events, because our project discards client IP data. PostHog uses the address only while it processes the event, to work out a rough location (country and city). That location is saved with the event and kept for as long as that event is kept. PostHog also receives your browser and device type, the page URL and the referring site.

PostHog also receives page-speed measurements (LCP, INP and CLS) and unhandled errors, including operations that failed in the background, with the error message and the line of code where it happened. It doesn't collect console output or the contents of the fields you type in, but an error message can still include text from the page or a value that was entered, and if it contains an email address or phone number, that detail is removed before anything is sent. Like everything else here, this runs only after consent, never in the admin area or the partner portal.

If you're signed in, PostHog labels you with your Supabase account ID. That ID is pseudonymous. It holds no name or email, but it does link the activity to your account. Your email, name and phone number are never sent to PostHog, neither as event data nor as profile properties. When you log out, the ID is detached from the visit.

The data goes to PostHog's servers in the United States and is stored there. PostHog runs on the public pages and in the course area too, so it's there while you learn, unlike Google Analytics, which is limited to the public pages. The admin area and the partner portal are excluded entirely, replay included. Automated browsers are skipped, so only real people are recorded.

For the full list of cookies we use and what each does, see our Cookies Policy. One of them, wider_ref, relates to partners and is explained in the section on purchases through a partner.

Contact form messages stay with us for two years from the last time we spoke, then they're deleted. That window exists so we still know what you asked about if you come back to us.

Account data stays with us while the account is active, plus four years after the last sign-in. If you close the account, or ask us to, we delete or anonymise it sooner than that.

Server logs, which include IP addresses among other things, are kept for 30 days and then deleted.

PostHog analytics events are kept for a year and session recordings for 30 days, then deleted.

Accounting records, invoices and receipts are kept for seven years from the end of the tax year, or six years from filing that year's return, whichever is later. Tax law requires this, and it overrides a deletion request.

For the partner program: commission records, statements, payments and accounting documents, including the invoices, receipts, tax certificates and Form W-9 a partner uploaded, are kept for seven years from the end of the tax year, or six years from filing that year's return, whichever is later, as tax law requires. The signature record is kept for the same period so we can prove the agreement. A partner's details, including encrypted ID numbers and bank details, are kept while the partner is active, and then until the partner's last statement has been paid. The record that you signed up through a partner is kept as long as your account data is. When the account is deleted, the record is detached from you and only an anonymous count remains. Invitations that were never accepted and the daily link-click totals are kept until our yearly review, and then we delete what we no longer need.

Right of inspection (s.13): you can ask to see what we hold about you. Write to shahar@wider-group.com from the account's email address, or name it in the message. If we can't tell the request is really yours, we'll ask for one more identifying detail, so we don't hand your data to someone else.

Right of correction and deletion (s.14): if something we hold is wrong, incomplete or out of date, ask us to fix it. You can also ask us to delete it and close the account. If we refuse a correction, we'll put the reason in writing, and you can take the decision to court.

We answer an inspection request within 30 days of receiving it, and if we refuse, we tell you in writing, with the reason, within 21 days. We answer a correction or deletion request within 30 days of receiving it, and if we refuse, we explain why in writing. When we correct or delete something, we also tell everyone we gave that data to in the previous three years, as the law requires. In the portal, partners can see the last four digits of their tax and bank details, their documents, statements and signed agreement, and can re-enter their tax and bank details. For anything else, write to shahar@wider-group.com. Some records we may keep even after a deletion request, where another law says we must, for instance invoices, which tax law requires us to retain. When that happens we'll tell you exactly what stayed and why.

If we don't get back to you, or you think we've handled this badly, you can complain to the Privacy Protection Authority at the Ministry of Justice.

We use reasonable technical and organizational safeguards to protect your information. For example, our database rules mean you can only ever read your own profile and course access, never anyone else's.

All traffic to and from the site is encrypted over HTTPS, the login cookies are marked so browser scripts can't read them, and passwords are only ever stored hashed. Once a year we go through the list of who holds admin access and remove anyone who no longer needs it. The database is backed up daily.

Partners' ID numbers and bank details are encrypted, and we keep only the last digits in the clear. Staff see them masked. Viewing a full number is limited to the highest admin role and is logged, and so is every download of a partner document by staff. Partner documents sit in private storage and open only through temporary links. Each partner sees only their own records.

No system is guaranteed to be completely secure, and we won't pretend otherwise. But we take reasonable steps, and we keep them current.

As with our Terms of Service, opening an account requires being 18 or older, or having a parent or guardian's consent. Joining the partner program is open to people 18 or older only.

We may update this policy from time to time. The date at the top of the page always reflects the version currently in effect.

For a material change, such as a new purpose or a new provider receiving the data, we'll put a prominent notice on the site before it takes effect. We won't just quietly move the date.

Questions about this policy, or requests about your data, go to shahar@wider-group.com.

Shahar Wider, עוסק מורשה 200759850, trading as Wider Group, 2 Pa'amei Aviv Street, Herzliya, shahar@wider-group.com.

This policy is written primarily around Israeli privacy law. If you're visiting us from the EU or EEA, we know GDPR gives you additional rights, and we plan to add a dedicated section here as our business grows in that direction. For now, the contact above works for you too.

PostHog, our analytics provider, stores data in the United States. Our data processing agreement with PostHog incorporates the European Commission's Standard Contractual Clauses (Module 2, controller to processor), and those clauses are the safeguard for the transfer. We send data to PostHog only after you accept analytics cookies, and you can withdraw that consent at any time. The transfer carries a privacy risk, because US authorities may be able to access the data.