Privacy Policy

LahavSec is an offensive security practice operated by Yaniv Avisror in Israel. This page explains what this website collects, what it does not, and how to reach us about any of it. It covers this website only. Information handled inside a signed penetration testing engagement is governed by that engagement's agreement and its confidentiality terms, not by this page.

The short version

• This website has no contact form, no login, no account area, and no database.
• We do not ask you for personal information anywhere on this site.
• The only optional tracking is Google advertising measurement, and it is off until you accept it.
• The chat assistant on this site runs entirely in your browser. Nothing you type is sent anywhere or stored.

What we collect

When you email us

If you write to us, we receive your email address, your name if you give it, and whatever you choose to put in the message. We use it to answer you and to scope work if that is what you are asking about. We keep business correspondence for as long as it is commercially or legally relevant, and no longer. Our email is hosted with Proton Mail.

Technical logs

This site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes connection data such as IP address, user agent, requested URL and timestamp, in order to serve the page and to protect the site against abuse. We do not use those logs to build a profile of you.

Advertising measurement, only if you accept

We run advertising campaigns, and we would like to know which ones bring people here. For that we use Google Ads conversion measurement, which sets cookies in your browser. It is set to denied by default. Nothing is set until you press Accept on the cookie notice, and you can change your mind at any time through the Cookie settings link in the footer.

The chat assistant

The assistant on this site is not a chatbot in the usual sense. It has no model behind it and no server. It matches what you type against a fixed list of topics held in the page itself, and every reply it can give is written in advance. What you type is never transmitted, never stored, and disappears when you close the tab.

Cookies and local storage

Two of the three items below are stored on your device only and are never transmitted to us or to anyone else. They exist so the site remembers how you set it up.

What	Why	Consent needed
Accessibility preferences	Remembers text size, contrast, readable font and similar settings you chose in the accessibility menu.	No. Strictly functional, stored locally, never sent.
Intro animation flag	Remembers that you already saw the opening animation, so it does not replay in the same session.	No. Strictly functional, cleared when you close the browser.
Google Ads measurement cookies	Tells us which advertising campaign a visit came from.	Yes. Denied by default, set only after you accept.

Declining does not delete cookies that were already set in your browser during an earlier visit. It stops new ones from being set. Your browser settings can clear existing ones.

Third parties

These are the only external services involved in serving this site:

• Cloudflare, hosting, content delivery and abuse protection.
• Google, advertising measurement, only after you accept.
• Google Fonts, typefaces used across the site.
• Proton Mail, our email, used only if you write to us.

We do not sell personal information, and we do not share it with anyone for their own marketing purposes.

Your rights

Under Israel's Protection of Privacy Law, 5741-1981, you may ask what information we hold about you, ask us to correct it, and ask us to delete it. If you are in the European Union or the United Kingdom, the GDPR gives you equivalent rights, including access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority. Write to us and we will answer. Where consent is the basis for processing, as with the advertising cookies, you can withdraw it at any time and that does not affect anything done before you withdrew it.

Security

This site is static. It has no server-side code, no database and no user accounts, which removes most of the ways a website leaks personal information. It is served over HTTPS only, with a strict content security policy and a set of hardening headers.

Children

This site is aimed at organisations and the people who run their security. It is not directed at children, and we do not knowingly collect information about them.

Changes

If this policy changes, the revised version appears here with a new date at the bottom of the page. Material changes to how we handle advertising consent will reset the cookie notice, so you will be asked again.

Contact

For privacy questions, requests about your information, or accessibility issues, write to contact@lahavsec.com. The responsible person is Yaniv Avisror, founder of LahavSec.

Last updated: 22 September 2026.