Home›Privacy Policy
Privacy Policy

Privacy Policy
of Dinamic5

We take your privacy seriously. This document details how we collect, use and protect your personal information.

Last updated: October 2026

1. General — Controller Identity

Dinamic5 (hereinafter: "the Company", "we") operates, under the Dinamic5 brand:

  • the website www.dinamic5.com and the Dinamic5 cloud CRM system (hereinafter: "the Service");
  • the website nadlan.dinamic5.com of Tivuchi by Dinamic5 (תיווכי מבית Dinamic5), a system for real-estate brokerage offices built on Dinamic5 CRM;
  • the Dinamic5 mobile apps.

This one privacy policy applies to all of them and to all of their users.

How to read this policy: the policy applies to both websites and to the Service unless it says otherwise. Sections marked "both websites" apply to both websites. Where something applies to one website only, it says so (for example in section 8).

By using the Service, you consent to this privacy policy. If you do not agree, please refrain from using the Service.

Privacy contact: privacy@dinamic5.com

Privacy contact for the Tivuchi website: nadlan.privacy@dinamic5.com (both addresses reach us)

2. Information We Collect

We collect the following types of information:

2.1 Registration Data

  • First name, last name
  • Email address (used for login)
  • Phone number
  • Company name (optional)
  • Country (used for language, timezone, currency, and phone prefix settings)

2.2 CRM Content

  • Leads, contacts, accounts, deals
  • Quotes, invoices, sales orders, purchase orders
  • Projects, tasks, tickets
  • Documents and file attachments
  • Automation and workflow configurations

2.3 Communication Data

  • WhatsApp messages: full message content, phone numbers, timestamps, media files
  • Call recordings: phone numbers, call duration, timestamps and the recording. The recording is kept by the telephony provider; when your plan keeps recordings longer than the provider does, we keep a copy in your business's system
  • Email: if the mail scanner feature is configured by the user

2.4 Login & Security Data

  • Login history (IP address and timestamp)
  • Audit trail (record change history)

2.5 Automatically Collected Data (Website)

  • IP address, browser type, operating system (server logs only)
  • Access timestamp

2.6 Billing Data

  • Card details are entered directly with the payment processor — we do NOT receive or store the full card number or the CVV
  • The card is kept by the payment processor, and we charge it through the processor for renewals, added users and phone numbers (recurring billing) until you cancel. The system shows only the card’s last 4 digits and expiry date
  • Invoice details (name, ID or company number, invoice email) are kept by us and sent to the payment processor to issue the invoice
  • Billing cycle, plan, payment and invoice history

2.7 Inquiries through the contact form on www.dinamic5.com

  • Name, email, phone, preferred call-back time and the message
  • The message reaches our email inbox, and a copy is kept on our server and deleted after 12 months
  • We use these details only to get back to you

2.8 Affiliate (Partner) Program

  • Partners: partners who join the program, on www.dinamic5.com or on the Tivuchi website, give us their name, email, phone number and a password (stored only as a one-way hash) or a Google sign-in. They may also give a business or ID number (optional). To pay commissions we also store the bank details they enter (account holder, bank, branch and account number or IBAN), and we store them encrypted, as well as the receipts or invoices they send us for each withdrawal. We also keep the version of the partner agreement they accepted, their commissions and their payouts. We use this information to run the partner account, calculate and pay commissions, email account updates and meet tax and accounting duties. This information is kept while the partner account is active. After the account is closed we keep the accepted agreement, the commission and payment records and the receipts or invoices for seven years, as tax law requires. The other details, such as the phone number and bank details, we delete on request to privacy@dinamic5.com.
  • Clients who signed up through a partner: if you signed up through a partner's link or code, we store that partner's code with your account.

3. Purposes of Use and Legal Basis

We process personal data based on the following legal grounds:

  • Contract performance: operating the Service, account management, technical support, payment processing
  • Legitimate interest: service improvement, security, fraud prevention
  • Legal obligation: compliance with applicable laws, tax reporting
  • Consent: marketing communications (you may withdraw consent at any time)

We do NOT sell personal data.

4. Data Controller and Data Processor

Dinamic5 acts in a dual capacity depending on the type of data:

  • Data Controller for: account registration data, billing information, platform usage data
  • Data Processor for: CRM content entered by tenants — including contacts, leads, deals, messages, documents, and call recordings. Each tenant (organization) is the Data Controller for the CRM content they enter into the system.

Tenants are responsible for having a lawful basis for the personal data they enter into the CRM system.

For details on data processing obligations, see our Data Processing Agreement (DPA).

5. Information Sharing with Third Parties

We may share information with third parties only in the following cases:

  • Meta Platforms, Inc. ("Meta") — when you connect Meta-owned products to your CRM via OAuth, the following data flows apply, in each case subject to the Meta Business Tools Terms:
    • WhatsApp Business Cloud API: Meta acts as a data processor on your behalf to transmit and deliver messages you send via your WhatsApp Business Account (WABA). Outbound: message content, message templates, media, and recipient identifiers are sent to Meta for delivery to WhatsApp recipients. Inbound: incoming WhatsApp messages addressed to your business number, delivery statuses, conversation metadata, and template approval results are received from Meta. WhatsApp LLC operates the WhatsApp delivery infrastructure as an independent data controller, governed by the WhatsApp Business Policy and WhatsApp Business Data Processing Terms.
    • Facebook Lead Ads: when a prospect submits one of your Facebook lead forms, Meta transmits the submission data (name, phone, email, and any custom fields configured in your form) to Dinamic5 via Meta's webhooks and Graph API. Data submitted through your Lead Ads is governed by this privacy policy from the moment it reaches Dinamic5's systems.
    Communication content transmitted via WhatsApp Business Cloud API remains end-to-end encrypted in transit.
  • Google LLC: when you connect a Google account via OAuth (Gmail and/or Google Calendar), the relevant data — email messages, threads, labels, calendar events, attendees — is exchanged between Dinamic5 and Google APIs solely to provide the synchronization features you enabled. Use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use Requirements. Subject to Google's Privacy Policy.
  • Transactional email provider: for account activation and password reset emails, and to forward contact-form inquiries to our inbox
  • Cloud telephony providers: for call routing, recording, and virtual numbers — Israeli and international providers
  • Payment processor: payments, recurring billing and invoices, as described in section 2.6
  • Infrastructure provider: hosting services in the European Union
  • PostHog: processes data on our behalf to measure use of the Tivuchi website (nadlan.dinamic5.com) only, according to your choice in the cookie banner, as described in section 8.3. The data is stored on PostHog servers in the EU (Frankfurt, Germany).
  • Cloudflare: the security check (Turnstile) on the sign-up, login and password-reset pages of both websites, as described in section 8.1.
  • Google Fonts: loading fonts on some pages of www.dinamic5.com, as described in section 8.2.
  • DNS and email delivery provider
  • User-configured integrations: services you have connected to the system (Google, Facebook, WhatsApp, etc.) — according to your settings only
  • The partner who referred you: if you signed up through a partner's link or code, that partner sees in the partner portal and by email your system name (the address chosen at sign-up, or your business name if we linked your account to the partner manually), your sign-up date, your account status (in trial, paying or ended), your first payment date, and for each of your payments the amount the commission is based on and the commission itself. The partner does not see your CRM content, contact details or invoices.
  • Legal requirement: when required by law, court order, or legal process

A complete sub-processor list is available on request at privacy@dinamic5.com.

6. Data Security

We employ advanced security measures to protect your information:

  • 256-bit SSL/TLS encryption for all communications
  • Separate, isolated database for each customer
  • Automatic daily encrypted backups
  • Secure servers with 24/7 monitoring
  • Role-based access control (RBAC)
  • Complete audit log

While we make every effort to protect your information, no security system can guarantee 100% protection. We commit to notifying you without delay in the event of a security incident that may affect your privacy.

7. Data Retention and Deletion

  • CRM data: deleted within 30 days of account closure. Backups purged within 90 days.
  • Account registration data: retained up to 12 months after account closure for legal and audit purposes
  • Payment data: retained as required by law (up to 7 years)
  • Call recordings: kept for the recording retention period of your plan, then deleted; also deleted with the account
  • WhatsApp data: retained while the account is active; deleted with account closure
  • Contact-form inquiries: the copy kept on our server is deleted after 12 months

Sign-in with Google or Facebook

If you choose “Continue with Google” or “Continue with Facebook”, we receive from that provider only your name, your email address and your account ID with that provider. We do not receive your posts, friends, contacts or any other data, and we never post on your behalf. We use this information only to create your Dinamic5 account and to sign you in to it.

Sign-in with Apple

If you sign in with Apple (iPhone app), we receive from Apple an account ID and an email address (possibly an Apple relay address), used only to sign you in. We keep the Apple account ID linked to your Dinamic5 account email. We don’t keep the relay address or your name, and we keep no Apple tokens. To delete this link, email privacy@dinamic5.com and we delete it; a password reset also removes it. You can also stop it yourself on iPhone: Settings > [your name] > Sign-In & Security > Sign in with Apple > Dinamic5 > Stop Using. There is no Apple sign-in on our websites, and on Android you sign in with Google only.

Deleting Your Google or Facebook Sign-in Data

To delete the data we received from Google or Facebook, email us at privacy@dinamic5.com from the email address of your account (or tell us that address) and ask us to remove your Google or Facebook sign-in. We then delete the stored link (provider, provider account ID and email). On request, we also delete your account, as described in section 7 above. You can also remove Dinamic5’s access at any time in your Google Account or Facebook settings.

Mobile App

The Dinamic5 CRM app for Android and iPhone shows and saves the same CRM data of your business, with the same permissions, and sends it over an encrypted connection to your business’s server only. Your sign-in is kept in the device’s secure storage. There is no sign-up in the app: accounts are opened on our website. You can also sign in with Google, and on iPhone with Apple; from Apple we receive an ID and an email address (or an Apple relay address), used only to sign you in.

Location

If your business uses the time clock, the app asks for the device’s precise location (GPS) only at the moment you punch in, start or end a break, or punch out, and only while the app is open. The location is saved with that punch in your business’s system and is visible to your business’s managers. We do not collect location in the background, do not sell it, do not use it for advertising and do not share it with any third party. You can refuse or withdraw the permission at any time in the device settings.

No Ads or Tracking in the App

The app shows no ads and contains no third-party analytics or tracking tools. Data collected in the app is deleted as described in section 7 above, or on request to privacy@dinamic5.com.

8. Cookies

This section lists the cookies and browser records each website keeps and the data collected on it: what applies to both websites (8.1), what applies only to www.dinamic5.com (8.2) and what applies only to nadlan.dinamic5.com (8.3).

8.1 Both websites: sign-up, login and the system

  • d5gw: when you sign up or log in, a strictly necessary cookie named d5gw is set. It secures sign-up and login (including protection against cross-site request forgery, CSRF) and keeps your sign-up and login steps during the visit. Sign-up and login cannot work without it, so it needs no consent. It is deleted when you close the browser.
  • PHPSESSID: a session cookie in the system, required for authentication and maintaining your login session
  • d5_funnel_sid: on the sign-up, login and password-reset pages, a random ID for the current visit only is kept in your browser (sessionStorage, named d5_funnel_sid). We record the steps you go through on these pages, your IP address and browser type, only to find and fix sign-up and login problems. This data is deleted after 30 days.
  • Security check (Cloudflare Turnstile): on the sign-up, login and password-reset pages, a Cloudflare check confirms that a person, not an automated program, is filling in the form. For this check Cloudflare receives your IP address and technical details about your browser and device, and uses them only for this check.
  • d5_ref: if you opened a link from a partner in our affiliate program, a cookie named d5_ref stores only that partner's code, for 90 days, across dinamic5.com sites. It is used only to credit your sign-up to the partner who referred you, and the code is filled in on the sign-up form automatically. No data about the click itself is stored. Visitors who did not open a partner link do not get it.
  • d5aff: a strictly necessary session cookie for logging in to the partner portal, on both websites. It is deleted when you close the browser.

8.2 www.dinamic5.com only

  • d5_cookie_notice_dismissed: when you close the cookie notice, a record named d5_cookie_notice_dismissed is kept in your browser (localStorage) so the notice is not shown again.
  • Fonts (Google Fonts): some pages of this website load fonts from Google's servers. To do so, your browser contacts Google and sends it your IP address and browser details. No cookies are stored.

On www.dinamic5.com we do NOT use tracking, analytics, or advertising cookies. No third-party scripts install cookies on this website or within the CRM system. One exception: the d5_ref cookie (section 8.1), which is set only if you opened a partner link and contains only the partner's code.

8.3 nadlan.dinamic5.com (Tivuchi by Dinamic5) only

The Tivuchi website uses no advertising or social-network cookies. Usage-measurement cookies are kept only if you accept them in the cookie banner.

  • Your choice (nadlan_consent): your cookie choice is kept in your browser (localStorage, named nadlan_consent) only after you make it, so we don’t ask again. You can change it at any time with the “הגדרות עוגיות” (cookie settings) button at the bottom of the page.
  • Usage measurement (PostHog): a tool that measures how the website is used. Until you choose in the banner it does not run, and nothing is stored in your browser. With either choice we collect the pages you open, the site you came from and campaign details from the address, clicks, loading speed, and device and browser type. What you type is never collected. If you reject, we count visits without cookies and without storing your IP address. If you accept, a cookie with a random ID is kept in your browser, an approximate location is derived from your IP address, and your browsing on the site (mouse movement, clicks and scrolling) is recorded with all page text masked. The data is stored on PostHog servers in the EU (Frankfurt, Germany). Usage-measurement data is kept for up to one year, and recordings for up to thirty days.
  • First visit (tivuchi-first-visit): if you accept cookies, your browser keeps (localStorage, named tivuchi-first-visit) the site you came from on your first visit, the first page you opened, campaign details from the address and the visit date, so they can be attached to a trial sign-up. The record is removed if you reject.
  • Accessibility settings (nadlan_a11y): if you change settings in the accessibility menu, they are kept only in your browser (localStorage, named nadlan_a11y) and are cleared with the menu’s “איפוס הגדרות” (reset settings) button.
  • Sign-up source: when you sign up for a trial, we save with the account the site you came from, the page you went to sign-up from and campaign details from the address, for example an advertising tracking code or a Google Ads click ID. If you accepted cookies, the first page you opened on the site and the date of your first visit are added. No IP address or browser data is saved here. This tells us which pages and ads bring sign-ups.
  • Server logs: as on any website: IP address, browser type, the page opened and the time. Used for security and deleted after fourteen days.
  • Inquiries: when you contact us through the form on the site, by phone, WhatsApp or email: name, phone, email, office name and the content of your inquiry. You are not required to give these details, but without them we cannot get back to you. Inquiries are kept in the Dinamic5 customer management system for as long as needed to stay in touch with you, and after that as the law requires. An inquiry sent through the form reaches our email inbox, and a copy is kept on our server and deleted after 12 months. A WhatsApp inquiry also passes through Meta’s WhatsApp service, under its terms and privacy policy.
  • Marketing messages: we will not send you marketing messages without your separate, explicit consent. Contacting us is not such consent. You can withdraw consent at any time by writing to nadlan.privacy@dinamic5.com or through the unsubscribe link in the message.

The Tivuchi website is intended for professionals, not for minors.

9. International Data Transfers

  • Servers: hosted in the European Union
  • European Union (Frankfurt, Germany): usage-measurement data of the Tivuchi website (nadlan.dinamic5.com) is stored there on PostHog servers
  • Israel: recognized by the European Commission as providing adequate data protection (Decision 2011/61/EU)
  • United States: some sub-processors (email delivery, telephony, DNS, the Cloudflare security check and Google Fonts) — transfers conducted under Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework

10. Your Rights

Under the Israeli Privacy Protection Law 5741-1981 and the GDPR (for EU/EEA residents), you have the following rights:

  • Right of access: view the personal information we hold about you
  • Right of rectification: correct inaccurate or incomplete information
  • Right of erasure: request deletion of your information (subject to legal requirements)
  • Right to restrict processing: limit how we use your data in certain circumstances
  • Right to object: object to processing based on legitimate interests
  • Right to data portability: receive a copy of your data in a structured format
  • Right to opt out: unsubscribe from marketing communications at any time
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise your rights, contact us at: privacy@dinamic5.com.

Right to complain:

  • Israeli users: Israeli Privacy Protection Authority (PPA) at www.gov.il
  • EU users: your local data protection supervisory authority

11. Automated Decision-Making

We do NOT perform automated decision-making or profiling that produces legal or similarly significant effects on individuals.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be published on the website and registered users will be notified. Continued use of the Service after a policy update constitutes consent to the changes.

13. Contact

For questions or requests regarding this privacy policy:

14. Governing Law and Jurisdiction

This privacy policy shall be governed by the laws of the State of Israel. The exclusive jurisdiction shall be the competent courts in the Tel Aviv district.

Questions About Your Privacy? Talk to Us

Our team is available to answer any question about privacy and data security.

Contact Us