Skip to content
Log inStart free
Legal

Privacy Policy

Effective Date: November 3, 2026

The Cesura Technologies Ltd. (“we”, “us”, “our”) respects your privacy. This Privacy Policy (“Policy”) describes how we collect, use, and share personal information related to you (“Personal Information”) when you use our website (“Website”), platform (“Platform”), or other services (collectively, our “Services”).

Table of Contents

Personal Information Collection Categories and Classifications

We collect these types of Personal Information:

  • Contact information such as your name, contact details, and email addresses, that you provide when you fill out our contact forms or when you subscribe to our newsletter.
  • When you join a waiting list on our Website, we collect your work email address and the page you joined from, so we can tell you when your access is ready.
  • When you book a session with us through our Website, Google Calendar collects your name, email address, and the details you enter, such as your institution and role, so we can hold the meeting. Google processes this information on our behalf.
  • Account and profile information that you provide when registering for our Services, including professional credentials, educational background, and areas of specialization relevant to your training needs.
  • When you contact us, we will use any Personal Information that you share with us.
  • We collect interaction data, responses to practice questions, session duration, progress tracking information, and performance analytics generated when you use our training simulations and educational tools on our Platform. This includes data from our professional licensing examination simulator used solely for training and skill assessment purposes. For users who access simulations anonymously (without registration), we assign a pseudonymous device identifier stored in a persistent cookie on your device. This identifier allows you to return to your simulation results across visits but does not contain your name, email, or other contact information. Each workspace maintains a separate, independently derived identifier, so your anonymous activity in one workspace cannot be linked to your activity in another workspace by us or any third party
  • We also automatically collect data when you use our Website or Platform, such as IP addresses, browser information, how long you visit, location information, and which pages you visit.
  • Our Website includes plugins from third-party social media platforms and professional networks such as LinkedIn® and other business networking platforms. You can identify these plugins by their branding and interface elements. These plugins will not collect or handle Personal Information about you unless you specifically interact with or enable these external platform features. When you interact with them, these plugins activate and automatically send information to the third-party service provider.
  • When you subscribe to our paid Services, we collect payment transaction information including your name, billing address, and payment confirmation details from our third-party payment processors. We do not directly collect, store, or process your credit card numbers, banking information, or other sensitive payment credentials, which are handled securely by our certified payment service providers in accordance with industry standards.

How We Use Your Personal Information

We use Personal Information for these reasons:

  • to provide our Services;
  • to communicate with you, including marketing when you are our client or contact us through our Website, or subscribe to our newsletter;
  • to improve your experience with our Services;
  • to send you updates and notices;
  • to enforce our Terms of Use, and to protect rights of other users;
  • to handle legal issues and comply with legal requirements;
  • to prevent fraud and protect our systems; and
  • to comply with law enforcement requests.

User-Generated Content and Uploaded Materials

You maintain complete control over any content, media, or materials that you upload, submit, or transmit to our Services.

Please refer to our Terms of Use for guidelines regarding acceptable use of our Services and protocols concerning user-generated content submission. Such content may contain Personal Information.

Important Notice: Content uploaded to our Services may be accessible to other authorized users within your organization, depending on your organization’s sharing settings and permissions, or to the simulation creator/administrator, as necessary for the collaborative learning experience.

Our Platform is designed for professional training purposes, and we recommend using it accordingly. Please exercise caution when uploading content and avoid inadvertent disclosure of Personal Information, revelation of sensitive Personal Information, or sharing Personal Information belonging to third parties without their express consent. If you are part of an organization using our Services, please be aware that your organization’s administrators may have access to content you upload and share.

Third-Party Personal Information Sharing and Disclosure Protocols

We do not sell Personal Information. We share this information with service providers and business partners who help us run our Services. These companies provide data analysis, marketing, cloud hosting, security, and technical support. The current list of our subprocessors is published in our Trust Center at: https://trust.cesura.ai/?tab=subprocessors.

We use PostHog, hosted in the European Union, for product analytics. PostHog runs without cookies or other storage on your device. It records page views and interface interactions with on-screen text masked, and receives an internal user identifier rather than your name or email address. PostHog receives your IP address with each event, through our proxy, but does not derive your location from it. We do not use Google Analytics. You can read the PostHog Privacy Policy at: https://posthog.com/privacy.

On our marketing website, cesura.ai, we use the LinkedIn Insight Tag to measure our LinkedIn advertising, only if you accept marketing cookies in the website’s cookie preferences, or, if you visit from the United States, unless you opt out (see Notice to United States Residents). It tells LinkedIn that you visited our website and when you click a button to book a session, so LinkedIn can report how many people its ads brought to us. LinkedIn shows us only totals, not who you are. The Insight Tag does not run on the Platform. You can withdraw this consent at any time through the Cookie preferences link at the bottom of every page of our website. You can read the LinkedIn Privacy Policy at: https://www.linkedin.com/legal/privacy-policy.

We will reveal Personal Information with or without prior notification to individuals (a) when required by court subpoena or other judicial process or regulatory directive; (b) when required by applicable law or legal obligation; or (c) at our reasonable discretion, when disclosure is necessary to protect the safety of any individual, the general public welfare, or to prevent violations of our rights or the rights of third parties.

If we experience corporate restructuring, merger, acquisition, or similar business transactions, Personal Information may be transferred to acquiring organizations or successor entities, provided that such receiving party agrees to maintain data protection practices materially equivalent to this Policy or implements comparable privacy protections.

Artificial Intelligence Technology

Our platform uses artificial intelligence to provide simulation services. We process your inputs and interaction data through AI systems to generate conversational responses and create summary reports for your training sessions.

The AI processing includes:

  • Your inputs during simulation sessions
  • Interaction patterns and response data
  • Session analytics for generating summary reports

AI conversations, voice, and image generation run on Google Cloud Vertex AI in the European Union and Israel, unless your organization connects its own AI provider account, in which case its requests run on that account. Google Cloud Model Armor screens this content for safety. When a simulation searches documents uploaded to it, the document text and the search queries are converted to search vectors by MongoDB’s embedding service (Voyage AI), which may process them outside the European Union and Israel; the resulting vectors are stored in Israel. Workflow automation can be configured to use Anthropic’s API. If you use the microphone button to dictate into a text chat, your browser’s built-in speech recognition transcribes the audio, and your browser’s provider (for example Google in Chrome, Apple in Safari, or Microsoft in Edge) processes it under its own privacy policy. We do not use your personal information or session content to train our AI models, and under Google Cloud’s terms Google does not use it to train its models either. For important disclaimers about AI-generated content and usage limitations, please refer to our Terms of Use. While we strive to ensure accurate AI processing of your data, AI systems may occasionally produce unexpected results or errors in data analysis. We cannot guarantee the accuracy or completeness of AI-generated analytics or reports based on your Personal Information.

De-identified Information and Statistical Analytics

We may use and examine de-identified, anonymized, and aggregated information sets created from Personal Information, to generate insights, statistical evaluations, trends and forecasting models and analytics for our internal business objectives, including improving our Services and understanding usage patterns.

With your explicit consent, we may share such compiled de-identified information with academic research partners, educational institutions, and research organizations for studies related to training effectiveness, learning outcomes, and educational research purposes. We will maintain and use de-identified information in de-identified form and will not attempt to re-identify the information.

We do not sell Personal Information. Any sharing of de-identified data is conducted solely for legitimate research and educational purposes under appropriate data sharing agreements that ensure continued protection of privacy.

Individual Rights and Personal Information Control

We will provide you with significant control and extensive choices concerning the ways we use and share Personal Information, and will honor and implement the choices you make.

At any time, you may revoke authorization for our marketing communications, promotional activities, and subscription services, or request deletion of your Personal Information, by providing written notice through our established communication channels. Implementation of such requests may take up to thirty (30) business days for full processing and system modifications. You should understand that certain deletion requests may require account suspension, if retention of specific Personal Information is essential for service operation and provision.

To exercise your rights and choices, please contact us at: [email protected]

We will collect Personal Information that is essential and appropriate for the purposes specified in this Policy. At any time, you can stop using our Services. After that, we will stop collecting Personal Information. However, we may retain and process certain Personal Information as permitted by applicable law and regulatory requirements.

Certain web browsers offer a “Do Not Track” (“DNT”) feature. A DNT signal represents HTTP header field indicating individual preference regarding the monitoring of individual activities on our Services or through cross-site user tracking. Our Services currently do not respond to DNT signals or comparable privacy indicators.

Personal Information Access and Portability Rights

If you determine that Personal Information is inaccurate, incomplete, or out-of-date, please provide the necessary documentation and information to correct and update such data.

At any time, you can contact us at: [email protected] to request access to Personal Information that we process and retain. We will require certain authentication documents and identity verification to confirm that you are the authorized individual and in accordance with applicable law, will make good-faith efforts to locate and provide access to Personal Information.

When individuals have legally established access rights, you can obtain confirmation about whether we handle Personal Information, and receive a copy of such Personal Information, allowing you to:

  • verify its accuracy and the lawfulness of the processing;
  • request correction, amendment or deletion of Personal Information if it is inaccurate or if you believe that the processing is in violation of applicable law.

International Data Transfers and Adequacy Determinations

We host the Platform and store Personal Information on Google Cloud and MongoDB Atlas in Israel, with a disaster-recovery copy in the European Union. Operational logs are kept in Google Cloud Logging at Google’s global location. Israel is recognized by the European Commission as providing an adequate level of data protection. Some of our service providers, such as those supporting customer support, payments, and optional platform features, process Personal Information in other countries, including the United States. For residents of jurisdictions requiring explicit consent for international transfers of Personal Information to foreign countries, you expressly provide the necessary consent for such cross-border data transfers. We will take all steps necessary and implement reasonable measures to ensure that your Personal Information is handled securely and in accordance with this Policy and no international transfer of Personal Information will be conducted with an organization or country unless adequate safeguards exist to ensure data security, privacy protection, and compliance with applicable data protection laws and standards.

Retention Policies and Erasure Procedures

We may retain Personal Information for reasonable periods as required to provide our Services, fulfill business purposes, meet legal and regulatory obligations, resolve disputes, enforce our agreements, and protect our legitimate business interests. Retention periods may vary depending on the type of Personal Information, the context in which it was collected, our business needs, and applicable legal requirements.

We may maintain aggregated, de-identified, and anonymized information that cannot reasonably identify individuals for extended periods as permitted by law for business analytics, research, and statistical purposes. We will delete or anonymize Personal Information when it is no longer needed for the purposes described above, subject to applicable legal retention requirements and our business needs.

Waiting lists: We keep your waiting-list sign-up, meaning your work email address and the page you joined from, for twelve (12) months after you join, and then delete it. We delete it sooner if you ask us to. If you become a customer, your information is kept as described for accounts.

Content and Account Termination: When you delete your account, your Personal Information and the content you uploaded are deleted within thirty (30) days. When an organization’s agreement with us ends, its Personal Information and content are deleted within thirty (30) days of the organization’s deletion request. Both exclude: system logs and metadata required for technical operations, which may be retained for up to four hundred (400) days; security audit records, billing records, and records of the emails we sent you, which we retain for as long as our information security, accounting, and legal obligations require; and information we are required to retain under applicable legal or regulatory obligations.

Backup copies of deleted information may persist in our encrypted backup systems for up to twelve (12) months following deletion, after which they expire and are permanently removed. Backups are used only to restore the Services after a failure.

Cookies and Digital Tracking Technologies

Online cookies represent small data files that servers and platforms send to a user’s devices and web browsers, during online navigation and website engagement.

Your device and browser automatically delete session cookies when ending browsing sessions. Persistent cookies remain active for longer periods. You can review the expiry dates and settings of each cookie through browser preferences and control interfaces.

We use both types of cookies and similar tracking technologies. We use persistent cookies to save and retrieve your login information and enable easier access during subsequent visits to our Services. We also use persistent and session-based cookies to enable platform features, such as protecting your session against cross-site request forgery, admitting you through an invitation link, and launching simulations from your learning management system. All the cookies we set on the Platform are strictly necessary to provide the Services. We do not use cookies on the Platform for analytics, advertising, or profiling. On our marketing website, analytics cookies (PostHog) and marketing cookies (the LinkedIn Insight Tag) are set only if you accept them in the website’s cookie preferences. If you visit from the United States, they are on unless you opt out, as described in Notice to United States Residents. Our network provider, Cloudflare, sets security cookies that protect the Services against automated attacks. On the sign-in page, Google’s sign-in service sets a g_state cookie that stores the state of its one-tap sign-in prompt, such as whether you signed out, so the prompt does not sign you straight back in. We store your interface preferences, such as language and display settings, in your browser’s local storage. If you open our support chat, our support provider, Help Scout, stores its own session data in your browser to run the conversation.

For anonymous simulation participants, we set a persistent device identity cookie that expires after 30 days and is refreshed on each visit. This cookie contains a cryptographically signed identifier used solely to associate you with your simulation results within a specific workspace. The identifier stored in our database is unique per workspace and cannot be used to correlate your activity across different workspaces.

Every browser gives you tools to manage and control your cookies preferences. You can turn off, block, or remove certain or all cookies through browser preferences and privacy settings. Please be aware that turning off or removing cookies may negatively impact your user experience with our Services. For example, turning off or blocking our cookies may require re-entering your login details, or may prevent access to certain features.

Our Services may also integrate with social media platforms and third-party services that use their own tracking technologies. These integrations are governed by the respective privacy policies of those third-party services.

Personal Information Security and Incident Response

We maintain the confidentiality of Personal Information and employ reasonable technical, administrative, physical, and procedural protections to ensure that such Personal Information is accurate, complete, current, and reliable for its intended operational uses. We implement technical, administrative, and physical security measures and safeguards to protect Personal Information from loss, misuse and unauthorized access, disclosure, alteration, and improper destruction or alteration. Personal Information is encrypted in transit and at rest.

We have implemented and maintain appropriate physical, technical and organizational procedures and controls to protect and secure Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction and to ensure business continuity and disaster recovery capabilities.

These security measures follow industry standard security practices. However, while we make efforts to protect information privacy and security, we cannot guarantee that our Services will be fully protected against cyber-attacks, malicious activities, system malfunctions, human error and other security breaches or operational failures.

Our Services may contain links to third-party websites, applications, or services that are not owned or controlled by us. We are not responsible for the privacy practices or content of these third-party services. We encourage you to read the privacy policies and terms of service of any third-party services before providing them with your Personal Information.

When you access third-party services through our Services, you acknowledge and agree that your interactions with such third parties are governed by their respective privacy policies and terms of service, not this Policy.

Children’s Privacy Protection

Our Services are not intended for children, and we do not knowingly collect Personal Information from children. If we become aware that we have inadvertently collected Personal Information from a child, we will take steps to delete such information as soon as reasonably possible. If you believe that a child has provided us with Personal Information, please contact us immediately at [email protected] so that we can take appropriate action.

Policy Amendment and Revision Protocols

From time to time, we may update and modify this Policy. When changes are minor or administrative in nature, they will take effect seven (7) days after we publish notification on our Services or after notice is sent through email or other electronic communication. Significant changes will take effect thirty (30) days after we first publish the change notice or as otherwise required by applicable law and regulatory requirements.

Until the modified Policy takes effect, you can choose to reject the changes and terminate your use of our Services. Continuing use of our Services after the modified Policy takes effect means you agree to the updated Policy. Please note that if we need to change this Policy to meet legal or regulatory requirements, the updated Policy will be effective immediately or as required by applicable law.

GDPR Compliance Framework

The following provisions apply when GDPR and related European data protection regulations govern our processing of Personal Information:

If you act as a data controller, then for content uploaded to our Services, we function as a data processor, and our Data Processing Agreement governs such processing activities.

Where we process Personal Information as a data controller, processing is based on these lawful grounds:

  • We process account and payment information to fulfill our contractual obligations with you.
  • We process Personal Information to comply with legal obligations and protect vital interests.
  • We rely on legitimate interests (which we believe do not override your fundamental rights)
  • Business communications, including direct marketing to clients and website visitors; Cybersecurity and fraud prevention
  • Customer support and service operations
  • Platform improvements and user experience enhancement
  • Fraud detection and platform misuse prevention
  • All other Personal Information processing not covered above is based on your consent.

Data Processing Agreements

For enterprise and business customers who use our Services under separate commercial agreements, the processing of Personal Information uploaded to our Services is governed by our Data Processing Agreement (DPA), where we act as a data processor on behalf of such customers who function as data controllers.

Your Rights Under EU Data Protection Laws

In addition to rights described elsewhere in this Policy, you have these rights:

  • Consent withdrawal - Contact us at [email protected] to withdraw consent for Personal Information processing. This will not affect the lawfulness of processing before withdrawal.
  • Deletion and restriction - Request deletion or restriction of Personal Information access. We will review requests and respond according to applicable law.
  • Third-party notification - When you exercise the above rights, you may request that we inform third parties holding your Personal Information to act accordingly.
  • Data portability - Request transfer of Personal Information in accordance with your portability rights.
  • Direct marketing objection - Object to Personal Information processing for direct marketing purposes. Additional information is in the Individual Rights section.
  • Automated decision-making - You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
  • Supervisory authority complaints - You have the right to lodge complaints with data protection supervisory authorities in your country of residence, workplace, or where an alleged GDPR infringement occurred.

Additional information about your rights under EU data protection laws is available on the European Commission website at: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens_en.

Exercising Your Rights

When submitting requests to exercise your rights, we will need to verify your identity and location. We will request credentials to confirm your identity and ask questions to understand your request’s nature and scope.

If we must delete Personal Information following your request, complete removal of residual copies from active servers and backup systems will take time.

For concerns about our Personal Information processing, contact us at [email protected] We will investigate inquiries and respond promptly in good faith.

Sensitive Personal Information Categories and Restrictions

Our Services are designed for training and educational simulations. While users may discuss various scenarios including business and personal situations as part of the training experience, we recommend exercising appropriate caution when inputting highly sensitive personal information.

We strongly advise against uploading, transmitting, or storing any of the following sensitive information categories through our Services: financial account credentials, payment card information with security codes; government identification numbers, social security numbers, passport details; health information, medical records, genetic data; biometric identifiers intended for unique identification; and information concerning minors under applicable age thresholds.

For training scenarios that may involve business discussions, personal experiences, or other content containing personal information, please ensure you have appropriate permissions and consider using anonymized or hypothetical examples where possible.

If sensitive information is inadvertently uploaded or transmitted through our Services, contact us immediately at [email protected] to arrange for appropriate handling and removal.

We reserve the right to remove, restrict access to, or delete any information that violates applicable laws or our terms of service and may suspend or terminate accounts that repeatedly violate these restrictions.

Notice to United States Residents

This section applies to you if you live in a US state with a consumer privacy law, such as California, and adds to the rest of this Policy.

What we collect and why. The categories of Personal Information we collect, where they come from, and why we use them are described in Personal Information Collection Categories and Classifications and How We Use Your Personal Information. We keep them as described in Retention Policies and Erasure Procedures.

Selling and sharing. We do not sell Personal Information for money. On our marketing website, the LinkedIn Insight Tag tells LinkedIn that you visited and whether you clicked to book a session, so we can measure our LinkedIn advertising. Under some state laws, such as California’s, this may count as “sharing” Personal Information for cross-context behavioral advertising, or as a “sale”. If you visit cesura.ai from the United States, analytics and the LinkedIn Insight Tag are on unless you opt out. You can opt out at any time through the Do Not Sell or Share My Personal Information link or the Cookie preferences link at the bottom of every page of our website. If your browser sends a Global Privacy Control signal, we treat it as your request to opt out of sale and sharing, and the LinkedIn Insight Tag does not run. We do not knowingly sell or share the Personal Information of anyone under 16.

Your rights. Depending on the state you live in, you may have the right to know what Personal Information we hold about you and to receive a copy of it, to correct it, to delete it, and to opt out of its sale or sharing and of its use for targeted advertising. We do not use sensitive Personal Information to infer characteristics about you, and we do not use Personal Information for profiling that has legal or similarly significant effects. We will not treat you differently for using any of these rights.

How to make a request. Email [email protected]. We will verify your identity before we act on a request to know, correct, or delete, and we answer within forty-five (45) days. You may use an authorized agent; we may ask the agent for your signed permission and ask you to confirm your identity with us. If we decline your request, you can appeal by replying to our answer, and we will respond to the appeal within the time your state’s law requires.

Students. When we process student information on behalf of an educational institution, we do so as its service provider, under its instructions. Requests about that information should go to the institution, and we will help it respond.

Contact Information

For questions, issues, complaints, or official requests about this Policy or our data processing practices, please contact us at:

Email: [email protected]

Address: Dvora 13, Hod Hasharon