Legal Document — Effective June 2026

Privacy Policy

Last updated: June 2026 | JerusalaTech™ — operated by GrahamBerry Holdings Group — Los Angeles, CA

JerusalaTech is built on truth. That principle applies here without exception. This policy discloses exactly what personal information we collect, how we use it, who we share it with, and what rights you have under California law and applicable federal law. We do not lie, pad, or obfuscate. Everything in this document reflects what the site actually does — nothing more, nothing less.

1. Who This Policy Covers

This policy applies to all visitors, subscribers, and customers of jerusalatech.com and any associated subdomains or pages operated by GrahamBerry Holdings Group (“JerusalaTech,” “we,” “us,” “our”). By visiting or using this site, you acknowledge this policy.

2. Personal Information We Collect — Exact Categories

The following is an exhaustive list of every category of personal information collected through this site. No hidden collection occurs.

Category (CCPA)	Specific Data	How Collected	Required?
Identifiers	Email address	Contact/inquiry form; Stripe checkout at purchase	Required for service delivery
Identifiers	First and last name	Contact/inquiry form (optional field)	Optional — not required
Commercial Information	Product purchased, amount paid, transaction date, Stripe session ID	Stripe webhook after confirmed payment	Required for order fulfillment
Internet Activity	IP address, browser type, operating system, referring URL, pages requested, timestamp	Vercel hosting infrastructure — standard server access logs	Infrastructure — not controllable by visitor
Internet Activity	IP address, browser type	Google Fonts CDN (fonts.googleapis.com, fonts.gstatic.com) — loaded on every page	Infrastructure — third-party resource
Message Content	Inquiry type, free-text message	Contact/inquiry form (optional fields)	Optional — not required
Token / Access Data	Email address, subscription tier, subscription start timestamp — encoded in a signed access token (HMAC-SHA256)	Generated upon purchase; stored in your browser’s `localStorage` as `jt_catalog_token`; also delivered in URL parameters via email	Required for catalog access verification

What we do NOT collect: Social Security numbers, government-issued ID numbers, financial account numbers or payment card numbers (Stripe handles these — we never see them), precise real-time geolocation, biometric data, health or medical information, racial or ethnic origin, sexual orientation, religious or philosophical beliefs, or union membership.

3. How We Use Your Information

Order fulfillment: Delivering purchased products (catalog access tokens, download links, onboarding emails).
Subscription management: Sending renewal confirmations and updated access tokens on each billing cycle.
Inquiry response: Forwarding contact form submissions to the business owner to respond to your specific inquiry.
Internal notifications: Notifying the owner of new orders and inquiries (your email and purchase details are included in these notifications).
Catalog authentication: Verifying your subscription tier and calculating tool unlock progress via your access token.

We do not use your information for advertising, behavioral profiling, retargeting, list-building for marketing, or any purpose beyond the above.

4. How Your Information Is Stored

JerusalaTech operates as a serverless static website. We do not operate a proprietary database. Your information lives in the following places:

Owner’s email inbox: Contact form submissions and order notifications are delivered via Resend to the owner’s private email address. No separate database stores them.
Stripe’s systems: Purchase records, your email address, and subscription status are stored by Stripe under their data retention policies.
Your own browser: Your catalog access token is stored in localStorage under the key jt_catalog_token on your device. This persists until you clear your browser storage. It is never sent to a JerusalaTech server except when you load the catalog page, at which point it is validated server-side.
Vercel access logs: Standard HTTP access logs retained by Vercel (IP, user-agent, URL, status, timestamp).

5. Catalog Access Tokens — Full Disclosure

Upon purchase of a catalog subscription, we generate a signed access token. You must understand exactly what this token is and how it operates:

The token contains your email address, your subscription tier (entry/starter/pro/complete), and your subscription start timestamp.
It is signed with an HMAC-SHA256 key so it cannot be forged or altered.
The token is delivered in your purchase confirmation email as a URL parameter (e.g., catalog.html?token=...). This means your email address is encoded in URLs that may appear in email clients, browser history, and server access logs.
The token is stored in your browser’s localStorage under jt_catalog_token after first use. It persists in your browser until you clear localStorage. It is not a cookie and is not sent automatically on every request.
Token expiry: 1 year from issue, automatically refreshed on each monthly renewal.
To remove the token from your device: clear your browser’s localStorage for jerusalatech.com, or use your browser’s developer tools.

6. Third Parties Who Receive Your Information

We share your personal information only with the following third parties, only as necessary to operate the service:

Third Party	What They Receive	Why	Their Privacy Policy
Stripe	Email address, payment card data, purchase details	Payment processing and subscription management	stripe.com/privacy
Resend	Email address, name (if provided), inquiry content, product details	Transactional email delivery (order confirmations, inquiry forwarding)	resend.com/legal/privacy-policy
Vercel	IP address, browser type, URL, timestamp — via server access logs	Web hosting infrastructure	vercel.com/legal/privacy-policy
Google (Fonts CDN)	IP address, browser type — sent when your browser loads fonts from fonts.googleapis.com and fonts.gstatic.com	Typography rendering. Google’s servers are contacted on every page load to deliver font files.	policies.google.com/privacy

We do not sell, rent, lease, or trade your personal information to any third party. Ever. Under any circumstances.

We do not share your data with data brokers, advertisers, or any party beyond those listed above.

7. Do Not Sell or Share My Personal Information

JerusalaTech does not sell your personal information. JerusalaTech does not share your personal information for cross-context behavioral advertising. This statement is made pursuant to California Civil Code § 1798.120 (CCPA/CPRA). Because we do not sell or share personal information for advertising purposes, there is no opt-out mechanism required. If this practice ever changes, this policy will be updated before that change takes effect.

8. Cookies, Tracking, and Do Not Track

Cookies: JerusalaTech does not set any cookies on your device. No cookie consent banner is required because we set none.

localStorage: The catalog access token is stored in browser localStorage (not a cookie). See Section 5 for full disclosure.

Analytics and Tracking Scripts: This site uses no Google Analytics, no Meta (Facebook) Pixel, no TikTok Pixel, no Hotjar, no Mixpanel, no Plausible, no Heap, no Segment, and no other analytics or behavioral tracking scripts of any kind.

Do Not Track (“DNT”): California law (Bus. & Prof. Code § 22575(b)(5)) requires that we disclose how we respond to browser Do Not Track signals. We do not track visitors across third-party websites and therefore do not alter our behavior based on DNT signals. The only data collection that occurs on this site is described in this policy. No behavioral tracking exists to enable or disable.

Third-party collection: Google Fonts (fonts.googleapis.com) receives your IP address and browser information when loading font files. JerusalaTech does not control and cannot disable this collection. If you wish to prevent Google Fonts requests, you may use a browser extension that blocks external font loading.

9. Data Retention

Contact form inquiries: Retained in the owner’s email inbox until manually deleted. No automatic deletion schedule. If you want your inquiry deleted, submit a request per Section 11.
Purchase records (Stripe): Retained by Stripe for the duration required by their policies and applicable financial regulations. JerusalaTech retains purchase notification emails in the owner’s inbox for accounting and tax compliance, up to 7 years as required by IRS and California Revenue & Taxation Code obligations.
Delivery emails (Resend): Retained by Resend per their data retention policies. JerusalaTech receives delivery receipts; the content of delivery emails is not separately stored on our systems.
Catalog access tokens: Active for 1 year from issue or until subscription is cancelled. Token stored in your browser localStorage until you clear it.
Vercel server logs: Retained by Vercel per their infrastructure policies (typically 30–90 days for raw logs). JerusalaTech does not access or store these logs.

10. Security

All data in transit is encrypted via TLS/HTTPS. HTTP connections are automatically redirected to HTTPS.
Strict security headers are enforced on every response: HSTS (max-age 31,536,000 seconds, includeSubDomains), Content-Security-Policy, X-Content-Type-Options, Referrer-Policy.
Catalog access tokens are cryptographically signed with HMAC-SHA256. They cannot be forged or modified without the signing secret.
Payment card data never passes through JerusalaTech servers. It is submitted directly to Stripe’s PCI-DSS Level 1 certified infrastructure.
Stripe webhook events are verified using Stripe’s signature verification before any action is taken.

California Security Breach Notification: In the event of a security breach that results in unauthorized access to unencrypted personal information of California residents, JerusalaTech will provide notification as required under California Civil Code § 1798.82, in the most expedient time possible and no later than 45 days following discovery of the breach.

11. Your Rights Under California Law (CCPA / CPRA)

California residents have the following rights under the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100–1798.199) as amended by the California Privacy Rights Act (Proposition 24, effective January 1, 2023):

Right to Know (§ 1798.100)

You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.

Right to Delete (§ 1798.105)

You may request deletion of your personal information. We will comply subject to legal retention obligations (e.g., tax records for completed transactions).

Right to Correct (§ 1798.106)

You may request correction of inaccurate personal information we hold about you. Added by CPRA, effective January 1, 2023.

Right to Opt-Out of Sale / Sharing (§ 1798.120)

We do not sell or share personal information for behavioral advertising. No opt-out is necessary, but you have this right should our practices ever change.

Right to Limit Sensitive PI (§ 1798.121)

We do not collect sensitive personal information as defined by CPRA (no government IDs, financial accounts, precise geolocation, health data, biometrics, etc.). This right is not applicable.

Right to Non-Discrimination (§ 1798.125)

We will not deny you goods or services, charge different prices, or provide a lower quality of service because you exercised any privacy right under this policy.

How to Submit a Request: You may submit a verifiable consumer request by either of the following methods:

Email: orders@jerusalatech.com with subject line: CCPA Privacy Request
Contact Form: jerusalatech.com/#contact — select “Other” and specify your request type in the message

Response Timeline: We will respond to verifiable consumer requests within 45 calendar days of receipt, as required by California Civil Code § 1798.100(b). If we require additional time (up to 45 more days), we will notify you of the extension and the reason within the initial 45-day period.

Verification: To protect your privacy, we must verify your identity before fulfilling a request. For email-based requests, we will verify by sending a confirmation to the email address you provide. We cannot fulfill a request if we cannot verify your identity.

Authorized Agents: You may designate an authorized agent to submit requests on your behalf. We will require written authorization or a power of attorney and will verify directly with you before releasing any information.

12. Additional Rights (All Visitors)

Regardless of your state or country of residence, you may:

Request a copy of the personal information we hold about you.
Request deletion of your personal information (subject to legal retention requirements).
Opt out of any future non-transactional communications (we send none currently, but this right stands).

13. Children’s Privacy (COPPA)

JerusalaTech products are designed for professional developers, technologists, and businesses. We do not knowingly collect personal information from anyone under the age of 13. If we discover we have collected information from a minor under 13, we will delete it promptly. If you believe a minor has submitted information through this site, contact us at orders@jerusalatech.com immediately.

14. CalOPPA Compliance Statement

This privacy policy is posted in compliance with California Business & Professions Code §§ 22575–22579 (California Online Privacy Protection Act — CalOPPA).

Categories of personally identifiable information collected: See Section 2.
Categories of third parties with whom PII is shared: See Section 6.
Process to review and request changes: See Section 11.
Effective date of this policy: June 2026.
How we respond to Do Not Track signals: See Section 8.
Whether third parties collect PII through this site: Yes — Google Fonts. See Section 6.

15. Changes to This Policy

If we make material changes to this privacy policy, we will update the “Last updated” date at the top of this page. If changes are significant (e.g., we begin collecting new categories of data, or we begin sharing data with new third parties), we will notify active subscribers via email before those changes take effect. Continued use of the service after the effective date of an updated policy constitutes acceptance of the new terms.

16. Contact & Governing Law

This site is operated by GrahamBerry Holdings Group, based in Los Angeles, California. This policy is governed by the laws of the State of California without regard to conflict-of-law provisions.

Privacy questions, CCPA requests, and all legal correspondence:
Email: orders@jerusalatech.com — Subject: Privacy Request
Contact Form: jerusalatech.com/#contact