Pody Privacy Policy

Privacy Policy, Cookies & Accessibility Statement

This document governs how MindSeller LTD (מיינד סלר בע״מ, Registration No. 515284891) (hereinafter: "the Company", "Pody") collects, uses, stores, transfers and protects personal information through the website, app, dashboard, services, WebApp, PWA, landing pages, and all other Pody digital platforms (hereinafter: "the Platform").

Last updated: 08.08.2026

Use of the Platform constitutes full agreement to this policy, the Terms of Use, and the Notice & Takedown procedure.

Privacy Policy · Cookies · Accessibility Statement

1. General

1.1 This Privacy Policy applies to all Platform users, including clients, editors, studio managers, client managers, and occasional visitors. The policy describes the types of information collected, purposes of processing, how information is used and shared, user rights, and the security measures we employ.

1.2 The Company may update this policy from time to time. Material changes will be published on the Platform and/or sent as a personal notification. Continued use of the Platform after an update is published constitutes consent to the changes.

1.3 This policy is subject to the Israeli Privacy Protection Law (1981), the Privacy Protection Regulations (Information Security) (2017), the Communications Law (Telecommunications and Broadcasts) (1982) (hereinafter: "the Spam Law"), and other applicable regulatory provisions.

2. Types of Information Collected

2.1 Information you provide

• Full name, email address, phone number
• Company / podcast / brand name
• Profile photo, logo or avatar
• Payment and billing details (processed by approved payment providers — Pody does not store credit card details)
• Any additional information you voluntarily provide in forms, support chat, customer service inquiries, or while using the Platform

2.2 Information about your activity on the Platform

• Editing orders, order status, transaction and payment history
• Content uploads (audio, video, images)
• Interactions with editors, client managers, and studio managers
• Ratings, reviews and feedback
• Account settings, language preferences and theme (dark/light mode)

2.3 Information collected automatically

• IP address, browser type, operating system, screen resolution
• Pages viewed, dwell times, navigation paths
• Device identifiers, cookies and session IDs
• Traffic source (referrer), marketing campaign (UTM parameters)
• Technical performance data (errors, load times)

2.4 Information from third parties

• Information from social login providers (Google) — name, email, profile photo
• Information from payment providers regarding transaction status
• Information from third-party analytics tools

2.5 Information about third parties provided by you

• If you upload content that includes information about other people (e.g. podcast guests), it is your responsibility to ensure you have their consent to share that information with the Platform.

3. Purposes of Information Use

• Service delivery: Account management, order processing, matching editors to clients, processing payments and tracking order status.
• Service improvement: Usage analysis, issue identification, development of new features, and improvement of user experience.
• Communication: Sending order updates, system notifications, security alerts, and marketing materials (subject to consent).
• Security and fraud prevention: Identifying and preventing misuse, fraud, unauthorized access, and violations of the Terms of Use.
• Legal compliance: Fulfilling legal, regulatory and judicial obligations.
• Personalization: Displaying content, recommendations and offers tailored to the user's profile and preferences.
• Research and development: Trend analysis, market research and new product development, including using artificial intelligence tools (see Section 9).

4. Information About Minors

4.1 The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from minors under the age of 18.

4.2 If we discover that information about a minor has been collected without parental or guardian consent, we will delete that information as soon as possible.

4.3 A parent or guardian who believes their child has provided personal information to the Platform is welcome to contact us at: support@pody.io

5. Legal Bases for Processing

We process personal information on one or more of the following legal bases:

• Consent: Your explicit consent, for example when registering for the Platform or consenting to receive marketing communications.
• Contract performance: Processing required to deliver the services you ordered, including account management and payment.
• Legitimate interest: Service improvement, platform security, fraud prevention and usage analysis — where our interest does not override your rights.
• Legal obligation: Compliance with legal, regulatory or court-ordered requirements.

6. Sharing Information with Third Parties

We do not sell personal information. We may share information with the following parties:

• Service providers: Supabase (storage and authentication), Vimeo (video hosting), payment providers, email service providers, PostHog (analytics and session recording, EU servers). All are bound by data processing agreements.
• Editors and studio managers: Information required to fulfil an order (name, content details, editing instructions) is shared with the assigned editor and the relevant studio manager.
• Authorities: Sharing with law enforcement, regulators or courts pursuant to a court order or legal requirement.
• Business transfers: In the event of a merger, acquisition or sale of assets, personal information may be transferred to the acquiring party, subject to advance notice to users.
• Aggregate data: We may share aggregated, anonymised statistical data that does not personally identify individuals for research, marketing and reporting purposes.

7. Marketing Communications, Advertising & Alerts

7.1 When registering for the Platform you may choose whether to receive marketing messages by email, SMS, WhatsApp or push notifications. This consent can be withdrawn at any time.

7.2 Operational messages (order updates, security alerts, policy changes) will be sent regardless of marketing communication consent, as they are required for the service to function.

7.3 Withdrawing consent to marketing communications is possible by: clicking the "unsubscribe" link at the bottom of any message, changing preferences in the account settings, or contacting us directly by email.

7.4 Marketing communications are conducted in accordance with the Communications Law (Telecommunications and Broadcasts) (1982) (the Spam Law).

8. Cookies, Pixels & Tracking Technologies

8.1 Types of cookies and technologies

• Essential cookies: Required for basic functionality — authentication, session retention, security. Cannot be disabled.
• Functional cookies: Store user preferences such as language, dark/light mode, text size.
• Analytical cookies: Help us understand how users navigate the Platform. We use PostHog (hosted on EU servers), which records a portion of sessions so we can see where users get stuck. In those recordings every input field is masked, and video players, audio players and payment screens are blocked entirely. PostHog and its recordings run only if you accepted analytical cookies, and stop immediately if you withdraw that consent. Separately, and regardless of that choice, Pody keeps its own first-party fault measurement: a random device identifier stored on your device, the page route with personal identifiers removed, and how long actions took. This measurement stays with us, is not shared with any third party, and is used only to detect faults and improve the service.
• Marketing cookies: Used to track campaign performance and display targeted advertising (Meta Pixel, Google Ads, etc.).
• Pixels and beacons: Invisible tracking tags on Platform pages and email messages for performance measurement.

8.2 Consent management

On first visit to the Platform, a cookies banner is displayed allowing you to accept or reject non-essential cookie categories. Preferences can be updated at any time through the account privacy settings. Blocking certain cookies may affect the user experience.

8.3 Third parties

Some cookies are embedded by third-party services (Google, Meta, Vimeo, PostHog, etc.). Those providers' privacy policies apply to their cookies. We recommend reviewing each provider's privacy policy.

9. AI & Use of Information for Development and Improvement

9.1 Pody uses artificial intelligence tools from external providers — primarily Anthropic Claude (Sonnet/Haiku), OpenAI Whisper, and Groq Whisper — for service improvement: automatic transcription, content analysis, automatic reel generation from episodes, editing recommendations, headline and description generation, clip identification, and an AI chat assistant. Calls are made via a secure API (Supabase Edge Functions) — not directly from the browser.

9.2 Your content (video/audio files, text, metadata) is not used to train models by any of the providers. There is functional use of AI APIs to process content on your behalf (transcription, reel generation, etc.). Information passed to AI APIs is anonymised and/or pseudonymised where possible (e.g. removing personal names from prompts).

9.3 External AI providers (Anthropic, OpenAI, Groq, Google) are bound by Data Processing Agreements (DPAs) that include: (a) prohibition on retaining customer content beyond the specific call; (b) prohibition on using content for model training; (c) automatic deletion of logs after 30 days at most. For any questions please contact support@pody.io.

9.4 Clarification on Section 3 (Research & Development): where it states that AI is used for "new product development", this means using AI APIs for internal processing (analytics, aggregated content insights) — not training external models on customer content. Section 9 prevails in any case of doubt.

10. Data Retention

We retain personal information for as long as it is required for the following purposes:

• Active account: While the account is active, information is retained to provide the service.
• Legal obligations: Financial information is retained for 7 years in accordance with Israeli tax law; records of consents are retained for the limitation period.
• Account deletion: Following a deletion request, personal information will be deleted or anonymised within 30 business days, except for information required to be retained by law.
• Backups: Information in encrypted backups will be deleted within the regular backup cycle (up to 90 days).
• Technical logs: Server and security logs are retained for up to 12 months and then automatically deleted.

11. Information Security

11.1 We implement administrative, technical and physical security measures to protect personal information, in accordance with the Privacy Protection Regulations (Information Security) (2017).

11.2 Security measures include, among others: SSL/TLS encryption on all communications, Row Level Security (RLS) at the database level, two-factor authentication (2FA) for administrative users, anomaly monitoring and activity logging, encrypted backups, role-based access control (RBAC), and periodic security reviews.

11.3 Despite our efforts, no system is completely immune. In the event of a security incident that could affect your privacy, we will notify affected users and relevant authorities in accordance with legal requirements.

12. Your Rights

In accordance with the Privacy Protection Law, you have the following rights:

• Right of access: To review the personal information held about you.
• Right of correction: To request correction of inaccurate or outdated information.
• Right of erasure: To request deletion of personal information (subject to legal retention obligations).
• Right to object: To object to processing of information for direct marketing purposes.
• Right to portability: To receive a copy of your information in a structured format.
• Right to withdraw consent: To withdraw previously given consent at any time.

To exercise your rights, please contact us at: support@pody.io. We will respond to your request within 30 days.

You also have the right to file a complaint with the Privacy Protection Authority: www.gov.il — Privacy Protection Authority

13. Links & Third-Party Services

The Platform may include links to third-party websites and services. We are not responsible for the content, privacy policies or security practices of those websites and services. We recommend reviewing the privacy policy of each third-party service you use. Accessing external links is at your own risk.

13.1 Google API Services (including YouTube Data API & YouTube Analytics API)

Pody integrates with Google API Services to allow users to manage their own YouTube channel directly from the Pody dashboard. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data we access from Google: When you connect your YouTube account to Pody, we access (1) your YouTube channel ID, channel name, custom URL, channel avatar, subscriber count and video count for display in your Pody dashboard; (2) OAuth access and refresh tokens, which we encrypt and store on our servers in order to publish content on your behalf; (3) YouTube Analytics data (views, watch-time, traffic sources, demographics) when you enable analytics on a podcast — used only to populate your in-Pody dashboard. We never access content from YouTube channels you do not own.

How we use Google data: We use Google data solely to (a) display your YouTube channel info in the Pody dashboard so you can identify which channel a post will publish to; (b) upload videos you explicitly choose to publish, with the title, description, tags, thumbnail, privacy setting, and scheduling time that you specify in the Pody publishing wizard; (c) display analytics for your own videos inside Pody. We do not use Google data for advertising, do not transfer it to other parties except as needed for Pody's service to operate (e.g. to the publishing engine), do not allow humans to read it except for security/abuse/compliance investigations or with your explicit consent.

Sharing & retention: We do not sell or share Google user data with third parties. OAuth tokens are stored encrypted in our database (Supabase, EU region) and are auto-refreshed before expiry. Tokens are deleted when you disconnect the YouTube account from /integrations in Pody or when you revoke access via your Google Account.

Revoke access: You can revoke Pody's access to your Google account at any time by visiting https://myaccount.google.com/permissions and removing Pody from the list of connected apps. You can also disconnect from inside Pody at /integrations. Once revoked, Pody will no longer be able to upload videos or read analytics on your behalf. myaccount.google.com/permissions

Google's privacy policy: Your use of Google APIs is also governed by Google's Privacy Policy at https://policies.google.com/privacy and the YouTube Terms of Service at https://www.youtube.com/t/terms.

Limited Use compliance: Pody's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data to serve ads, do not transfer it to third parties except as necessary to provide Pody, and do not use it for any purpose other than the user-visible features described in this policy. Google API Services User Data Policy

13.2 Meta Platform Services (Facebook & Instagram)

Pody integrates with Facebook and Instagram to let you publish content, view analytics, and manage comments and messages on your own accounts — directly from the Pody dashboard. Our use of information received from Meta is subject to the Meta Platform Terms and Meta's Developer Policies.

Information we receive from Meta: When you connect your own Facebook Page or Instagram Business account to Pody, we receive: (1) the account/Page id, name, profile picture and follower count — for display in your dashboard; (2) Page access and OAuth tokens, stored encrypted, to publish on your behalf; (3) comments, mentions, story replies and messages received on your own content — for display in Pody's Comments Inbox and to run the automation rules you configure; (4) insights (reach, engagement, demographics) — for display in your analytics dashboard. We never access content from accounts that are not yours.

How we use Meta data: We use Meta data only to: (a) publish content you explicitly choose to publish; (b) display your comments, messages and analytics inside Pody; (c) execute the auto-reply / auto-DM rules you configure yourself — including drafting a reply with an AI model based on the instructions you provide. Every action is limited to your own account and is initiated by the visitor (a comment/message they sent). We do not use this data for advertising and do not allow humans to read it except for security/compliance investigations or with your explicit consent.

Sharing and storage: We do not sell or share Meta data with third parties, except sending a comment's text to Anthropic solely to draft an automatic reply. Tokens are stored encrypted (Supabase) and deleted when you disconnect the account from /integrations or revoke permission through Meta.

Revoking access: You can revoke Pody's access at any time via your Facebook and Instagram business/app settings, or by disconnecting the account from within Pody at /integrations. Once revoked, Pody can no longer publish, read comments, or send messages on your behalf.

13.3 TikTok Services

Pody integrates with TikTok to let you publish and schedule video content to your TikTok account directly from the Pody dashboard. Our use of information received from TikTok is subject to the TikTok Developer Terms of Service and TikTok’s developer guidelines.

Information we receive from TikTok: When you connect your TikTok account to Pody through TikTok Login Kit, we receive: (1) your user identifier (open_id), display name, username and avatar — used to show "connected as @account" in the dashboard and to route publishing to the correct account (scope: user.info.basic); (2) OAuth access and refresh tokens, stored encrypted on Pody servers so we can publish on your behalf; (3) the video file and metadata (title, description, privacy settings) that you explicitly choose to publish (scopes: video.upload, video.publish). We do not access content, videos or data from TikTok accounts that are not yours.

How we use TikTok data: We use TikTok data solely to: (a) display your TikTok account details in the Pody dashboard so you can see which account a post will go to; (b) upload and publish videos you explicitly select — with the title, description and privacy level you specify in the Pody publishing wizard — whether as a Direct Post or as a draft to your TikTok inbox (Upload). Every publish is explicitly initiated by you and scheduled at your choosing. We do not use TikTok data for paid advertising, we do not transfer it to third parties except as required to operate the service, and we do not allow humans to read it — except for security, abuse or compliance investigations, or with your explicit consent.

Sharing and retention: We do not sell or share TikTok data with third parties. OAuth tokens are stored encrypted in our database (Supabase) and refreshed automatically before expiry. Tokens are deleted when you disconnect the TikTok account from /integrations in Pody, or when you revoke authorization through your TikTok settings. Video content you publish is not retained by Pody beyond the time required to upload it to TikTok.

Revoking authorization: You can revoke Pody’s authorization for your TikTok account at any time through your TikTok settings (Settings → Security & permissions → Manage app permissions) or by disconnecting the account from Pody at /integrations. Once revoked, Pody can no longer publish on your behalf.

Compliance: Pody’s use of TikTok APIs is subject to the TikTok Developer Terms of Service and to TikTok’s privacy policy at tiktok.com/legal/privacy-policy

Connecting your podcast host (BYO-host)

If your podcast is hosted with an external provider (such as Podbean, Transistor, Captivate or Buzzsprout), you can connect that account to Pody so we can publish for you at the time you scheduled. You initiate the connection, and you can disconnect at any time.

What we store: An API key or access token for your account at the host, alongside the show identifier there and the connection status. These are your access credentials and we treat them as such.

How it is stored: The token is encrypted at rest with AES-256-GCM before it is written to the database, using a key that exists only in the server environment. Your browser never reads it, it never appears in logs, and it is never sent to anyone other than the host it belongs to.

What we use it for: Only to create an episode and upload a file at your host, at the time you scheduled. We do not delete episodes, unpublish, or edit an existing episode at the host — our code never calls those operations at all.

What is sent to the host: Your episode title, description, publication date and audio file. No data about other users is sent.

How to disconnect: On the show's "My host" page, using "Disconnect". On disconnect we delete the encrypted token and stop writing to the host. Episodes already published there stay there and are unaffected. You can also revoke the key from your account at the host.

How long: Until you disconnect. After that only a connection record without credentials is kept, for audit purposes.

The public podcast directory

Pody operates a public podcast directory so that shows can be discovered and compared. It includes shows that are not hosted with us and whose owners never signed up. The information is collected from the public RSS feed the show itself publishes, and from the public Podcast Index and iTunes Search interfaces.

Where it comes from: This information was not given to us by you; it was collected from a public source. An RSS feed is published, by its very nature, for distribution and discovery, and that is what the collection rests on.

Lawful basis: Legitimate interest in operating a discovery directory, alongside the fact that the show owner chose to publish the information in a public feed. This is not your consent, which is precisely why we keep the scope narrow and honour removal unconditionally.

What we store: Show name, a shortened description, the creator name as it appears in the feed, language, categories and publishing cadence, plus a title, shortened description, date and duration for each episode. We do not store or serve audio files, and we do not copy the cover image — it is loaded from its original source.

The email address in the feed: It is never displayed, never exported, and we never send anything to it — no notice, no update, no marketing. Today we do not keep it at all. Ownership of a show is verified manually against the feed itself, at the request of whoever approaches us on their own initiative. Should we ever store a one-way hash of the address, it would be for ownership verification alone, and this page would be updated to say so.

Listener numbers: Some of the numbers we show are direct measurements and some are our estimates. An estimate always carries the ≈ sign and the word "estimate" in the body of the page, next to a note making clear it is an estimate and not a measurement. An estimate is an opinion, not a statement of fact, and a show owner who believes a number is wrong can contact us — it will be corrected or removed.

Your rights: A show owner may ask us to correct a detail, hide a figure, or remove the show from the directory entirely, unconditionally and without giving a reason. Removal deletes the show's details from the directory and also prevents it from being crawled again; for that prevention alone we retain the feed address, and nothing else. We carry it out within three business days. A directory removal request is not subject to the grounds and alternatives set out in our notice-and-removal procedure — it is honoured as made. Contact: privacy@pody.io.

Retention and refresh: Records are refreshed from the feed periodically. A show whose feed ceases to exist is kept for twelve months and then deleted; a show removed at its owner's request is deleted within three business days and is not crawled again.

14. Accessibility Statement

14.1 Accessibility Standards

Pody is committed to making the Platform accessible to people with disabilities in accordance with Israeli Standard SI 5568 and WCAG 2.1 guidelines at Level AA. We operate in accordance with the Equal Rights for Persons with Disabilities Law (1998) and relevant accessibility regulations.

14.2 Main Accessibility Adaptations

• Full keyboard navigation support
• Compatibility with screen readers (NVDA, VoiceOver, JAWS)
• Colour contrast meeting WCAG AA ratio (4.5:1 for text, 3:1 for graphical elements)
• Labelled ARIA regions (landmarks, roles, labels)
• Alternative text (alt text) for images and visual elements
• Ability to enlarge text to 200% without loss of content
• Full RTL (right-to-left) support for the Hebrew language
• Dark Mode to reduce visual strain
• Forms with accessible labels and error messages
• Animations respect the prefers-reduced-motion setting

14.3 Known Limitations

There may be components or pages not yet fully accessible. We continuously work to improve accessibility and prioritise fixes based on user reports. User-uploaded content (audio/video files) is not always within our control with regard to accessibility.

14.4 Accessibility Enquiries & Feedback

Encountered an accessibility issue? We would love to hear from you and address it promptly:

• Email: support@pody.io
• Phone: 055-704-1621
• Accessibility officer: MindSeller LTD

We commit to responding to accessibility enquiries within 14 business days.

15. Changes & Updates

The Company reserves the right to update this document from time to time. Material changes will be published via a Platform notification, a dedicated banner or by email. The date of the last update will appear at the top of the document. Continued use of the Platform after changes are published constitutes consent to the updated version.

16. Contact Us

For any question, request or enquiry regarding privacy, cookies or accessibility:

• Company: MindSeller LTD / מיינד סלר בע״מ, Registration No. 515284891
• Email: support@pody.io
• Phone: 055-704-1621

17. The AI assistant (Pody Concierge)

When you use the in-app support chat, information from your account — including subscription plan, balances (Podys, credits), recent order history, name and email address — is processed automatically by an AI model from Anthropic in order to give you personal, accurate answers.

Conversations are stored at Pody for service-quality purposes and may be reviewed by Pody staff only. The information is not sold and is not shared with third parties, beyond Anthropic, which operates the model under its commercial terms with Pody (available at anthropic.com/legal/commercial-terms). The information is not used to train models.

When a conversation is handed to a human representative, your phone number and the summary message are passed to Pody’s owner (Aviv Charuvi, +972-54-215-7889) over WhatsApp so we can get back to you quickly.

Questions about privacy?

Privacy, cookie or accessibility enquiries can be directed to us