Binding document

Data Collection Policy — binding internal document

Three hard rules bind every developer, agent and crawler run:

1. No raw contact data at rest. A publicly-listed phone becomes an HMAC and the plaintext is discarded before the record is written; emails, exact addresses and GPS are never stored. Enforced by schema — there is no column to write them to.
2. No outbound message to a harvested record, ever. Israel's spam law carries ILS 1,000 per message without proof of damage and criminal fines to ILS 202,000. Enforced in the notification service, which refuses any identity lacking a consent record.
3. We never sell data and never export contact details — to anyone, including partners. There is no such endpoint in the codebase.

Permitted sources are government open data, certifiers' public registries, growers' organizations, business directories (facts only, never their copy), business websites, public tender supplier lists and OpenStreetMap. Prohibited: anything behind a login or paywall, purchased or leaked datasets, personal social profiles, closed groups, and any circumvention of robots.txt.

Records publish as unclaimed and non-indexable until two independent sources corroborate them. Every harvested profile shows its sources, a claim button and a one-click removal that needs no account and is honoured within 48 hours, permanently, with a tombstone preventing re-collection.

Under Amendment 13, our position is that we are a business directory, not a data broker. That position rests entirely on the three rules above. If any one of them is broken in implementation, the defence fails. They are fixed in this binding document and enforced by gate tests; they may not be changed without an explicit, recorded Company decision. Our protection here is the architecture itself — enforced in code — not any external signature.