PRIVACY POLICY

Black Sachbak is a thrash metal band from Israel. This policy covers this website (www.blacksachbak.com), our online merch shop, and the official Black Sachbak Facebook page and Instagram account (@blacksachbak). The band is the controller of the personal data described here.

We only collect what you give us, or what the site needs to work:

• Account details — username, email, a securely hashed password (never stored in plain text), and if you use Google sign-in, your Google name, email and profile picture.
• Order details — name, email, phone, shipping address, the items you bought and payment status. Payments are handled entirely by PayPal; we never receive your card number.
• Messages — what you send through the contact form (name, email, message).
• Social interactions — comments and direct messages you send to our Facebook page or Instagram account (see below).
• Booking contacts — for venues, promoters and agencies we work with, business contact details (name, organisation, work email/phone, public social profiles).
• Usage data — anonymous, aggregated page-view statistics. No cookies are used for this and you are not tracked across sites.

• To create and manage your account and let you sign in.
• To process, ship and support your orders, and send order emails.
• To reply to your messages, comments and booking enquiries.
• To keep the site secure and working, and to understand which pages are popular.
• To meet legal obligations such as tax and accounting records.

We do notsell, rent or trade your personal data, and we don't use it for third-party advertising. We only send you marketing email if you ask for it.

We use a Meta app to manage our own Facebook page and Instagram business account — publishing posts and stories, reading insights about our own content, and replying to comments and direct messages.

• When you comment on or message our page/account, we receive the content, your public name/username and profile picture, and the time it was sent — only so we can read and reply.
• We don't access your friends list, your private profile, or any account other than our own.
• Data received from Meta is used only to run our own page and account, is never sold, and is not used to build profiles of you.
• Meta's own handling of your data is governed by Meta's Privacy Policy.

We use trusted providers to run the site. They process data only on our behalf and only for the purposes listed:

Some of these providers are located outside Israel (mainly in the US and EU). Where data is transferred abroad, it is protected by the provider's contractual and security safeguards.

• Essential cookies keep you signed in and remember your cart. The site can't work without them.
• Our analytics (Vercel) is cookieless.
• Embedded players from YouTube, Spotify and Bandcamp, and Google Maps, may set their own cookies when you play or interact with them. Those are governed by each provider's policy.

• Account data — until you delete your account.
• Order records — as long as required by tax and accounting law (in Israel, generally 7 years).
• Contact messages and social conversations — as long as needed to handle them, and no longer than 2 years after the last reply.

Under the Israeli Privacy Protection Law, and where applicable the EU GDPR, you can ask us to:

• see the personal data we hold about you;
• correct data that is wrong or out of date;
• delete your data (see below);
• receive a copy of your data, or object to how we use it.

To make a request, use the contact form. We'll respond within 30 days. You can also complain to the Israeli Privacy Protection Authority or your local data protection authority.

You can ask us to delete all personal data we hold about you — including anything received through Facebook or Instagram — at any time:

1. Send a request through the contact form with the subject “Data deletion request”.
2. Include the email address of your account or order, and/or your Facebook or Instagram name, so we can find your data.
3. We'll delete it within 30 days and confirm by email. Order records we're legally required to keep are retained only for that purpose and deleted when the period ends.

You can also remove our app's access at any time from your Facebook settings under Settings & privacy → Settings → Apps and websites.

Data is sent over HTTPS, passwords are hashed, and social media access tokens are encrypted at rest. Access to stored data is limited to band members who need it. No system is perfectly secure, but we take reasonable steps to protect your data.

We may update this policy as the site changes. The “last updated” date at the top shows the latest version. This site is not directed at children under 13.

Questions about privacy? use the contact form.