Privacy Policy

Sherman Art Works, Handmade Glass Judaica from Israel ("we", "us", "our") is a family-run handmade glass and Judaica studio based in Israel. This policy explains what information we collect when you visit shermanartworks.com, how we use it, and your rights.

Sherman Art Works is operated by Ernest Sherman, 3 HaAmal Street, Karnei Shomron 4485500, Israel. You can reach us at shermanartworks@gmail.com or on WhatsApp at +972 52 348 2278. We are the data controller for personal data processed through this website.

We collect minimal data. Specifically:

• Analytics data - page views, session duration, country, device type, and on-site events (product views, items added to the cart, checkout steps and WhatsApp clicks). Collected anonymously via Google Analytics 4, which also tells Google Ads when a visit that started from one of our ads ends in a purchase.
• Order and inquiry messages - when you contact us via WhatsApp or email, you share your name, phone number (WhatsApp), and the content of your message. We use this solely to respond to your inquiry and fulfill your order.
• Delivery details - if you choose to enter them at checkout, your name, email address, phone number, and shipping address. These are held in your own browser and reach us only when you place an order.
• No account registration - this site does not require or offer user accounts. We do not store passwords or payment card numbers.

Providing this information is voluntary and is not a legal obligation. However, if you do not provide your name, phone number, or message details, we will not be able to respond to your inquiry or fulfill your order.

Some of the personal data described above is processed and stored outside of Israel. Specifically: order and inquiry messages sent via WhatsApp are processed on servers operated by Meta Platforms, Inc. (United States); emails are stored by Google LLC (Gmail) on servers located in the United States and/or the European Union; and anonymized analytics data is processed by Google Analytics and, for visits that come from our ads, Google Ads (both Google LLC, United States).

When you pay by card, the details of your order (the items, your delivery address, and your contact details) are held briefly by Cloudflare, Inc. (United States), which runs the service that prepares your payment and records your order, and are sent to you and to us by Resend (United States), which delivers our order emails. Card details are not part of this and are handled only by HYP Pay, as described under Payment Processing.

Where personal data is transferred abroad, we rely on the receiving providers' own data-protection safeguards, in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001.

We use Google Analytics 4 (GA4) to understand how visitors use our site. GA4 sets first-party cookies on your browser to distinguish sessions and track anonymized behavior. No personally identifiable information is sent to Google.

We also advertise on Google, and our Google Analytics account is linked to our Google Ads account so we can tell whether an ad led to a purchase. If you arrive through one of our Google ads and accept analytics cookies, the Google tag keeps the ad-click identifier in a first-party cookie for up to 90 days and reports a purchase, with its value, to Google Ads. No name, email address, phone number or delivery address is sent. Google signals and ad personalization are turned off for this data, so it is not used to show you ads or to build advertising audiences. If you decline cookies, none of this happens.

You can opt out of GA4 tracking by installing the Google Analytics Opt-out Browser Add-on, or by using a browser with tracking protection enabled.

This site uses the following cookies:

• _ga, _ga_* (Google Analytics) - anonymous analytics, expire after 2 years / 24 hours respectively.
• _gcl_aw, _gcl_au (Google Ads) - may be set when you accept analytics cookies and arrive through one of our Google ads, so a purchase can be counted. Expire after 90 days.
• sa_lang, sa_cur, sa_cur_lang (Sherman Art Works) - remember your language and currency preference. Session-scoped, stored in localStorage, never sent to any server.
• sa_cart (Sherman Art Works) - remembers items you have added to your cart. Stored in localStorage. Never sent to any server.
• sa_ship, sa_ship_addr (Sherman Art Works) - remember your chosen shipping destination and any delivery details you typed at checkout, so you are not asked for them twice. Stored in localStorage, and sent onward only when you place an order.

We do not use retargeting or ad-personalization cookies, or any other third-party tracking cookies.

When you click "Order on WhatsApp", you are redirected to WhatsApp with a pre-filled message containing your selected items. Your WhatsApp number and message are processed by WhatsApp (Meta Platforms, Inc.) under their own privacy policy. We receive and read your message to process your order, and we retain our WhatsApp conversation history in line with normal business records.

Card payments are processed by HYP Pay (Hyp Payment Solutions, Israel). When you choose to pay by card you are taken to a payment page hosted by HYP Pay, and your card number, expiry date, and security code are entered there and handled solely by HYP Pay under their own privacy policy. Those details are never transmitted to, seen by, or stored by Sherman Art Works.

So that you are not asked for the same information twice, the delivery details you enter at checkout (name, email, phone, street, and city) are passed to HYP Pay to prefill its payment page. HYP Pay returns to us a transaction reference, the amount, and whether the payment was approved. We retain those as part of our ordinary business and accounting records.

HYP Pay operates in Israel, so paying by card does not involve a transfer of your data outside the country.

Emails sent to shermanartworks@gmail.com are stored in Gmail (Google LLC) and retained for as long as necessary to handle your inquiry. We will never share your email address with third parties.

We do not use your order or inquiry details to send you marketing. Your name, email address and phone number are used to handle the order or question you contacted us about, and for nothing else. We do not sell, rent or share our customer list with anyone.

If we ever start sending occasional news about new pieces, it will only go to people who have asked for it. Every message will say who it is from and carry a one-click way to stop, and simply asking us to take you off that list is enough - we will do it and confirm.

Product and studio photographs are served via Cloudinary (Cloudinary Ltd, Israel/US). Images are cached on Cloudinary's global CDN. Cloudinary may log request metadata (IP address, timestamp) in line with their own privacy policy. No personal data you provide to us is shared with Cloudinary.

We take reasonable steps to protect the personal data we handle. All traffic to and from this website is encrypted in transit using HTTPS/TLS. This website does not collect or store payment card numbers or CVV codes; card payments are handled entirely on our payment provider's own hosted page, as described in the Payment Processing section. Order and inquiry data received via WhatsApp or email is accessible only to the Sherman family members who operate this business, and is not stored on any servers we manage ourselves - it resides with Meta Platforms and Google LLC respectively, both of which maintain their own security programs. These measures are intended to comply with the Protection of Privacy Regulations (Data Security), 5777-2017, as applicable to a database of this size and sensitivity.

If we hold personal data about you then, whoever you are and wherever you live, the Protection of Privacy Law 5741-1981 gives you two rights that we honor for every customer:

• The right to inspect your data (section 13) - you may ask to see the personal data we hold about you. We will respond within 30 days.
• The right to have it corrected (section 14) - you may ask us to correct, complete, clarify or delete data that is inaccurate, incomplete, unclear or out of date. If we decide not to, we will tell you so and explain why, and you may ask a court to order the correction.

If you are located in the European Economic Area or another jurisdiction with data-protection law, you additionally have the right to:

• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing
• Receive your data in a portable format
• Lodge a complaint with your local data-protection authority

To exercise any of these rights, email us at shermanartworks@gmail.com. We will respond within 30 days. Residents of Israel may also complain to the Israeli Privacy Protection Authority at the Ministry of Justice.

Analytics data is retained in Google Analytics for 14 months (our configured retention window). WhatsApp and email correspondence is retained for as long as necessary to fulfill orders and handle after-sale queries, typically up to 3 years.

For card orders, the working copy of your order held by the service that prepares your payment is deleted automatically after 30 days. The order confirmation emails, and the record of the transaction held by our payment provider, are kept longer, as we are required to retain records of sales for accounting and tax purposes.

You may request earlier deletion at any time, subject to those record-keeping obligations.

This site is not directed at children under 16. We do not knowingly collect personal data from children.

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the site after an update constitutes acceptance of the revised policy.

Questions about this policy? Email us at shermanartworks@gmail.com or send a WhatsApp message to +972 52 348 2278.