Privacy Policy – 2TK / To The Key

Last updated: 25.09.2026

This Privacy Policy explains how To The Key, which operates the 2TK / To The Key service ("2TK", "we", "the service"), collects, uses, retains, processes, and shares personal information through the website, the application, and related services.

Our registered address: Hadera, Israel. Privacy inquiries: tothekey26@gmail.com. Service inquiries: tothekey26@gmail.com.

Use of the service is subject to this policy and to the 2TK Terms of Use.

1. Purpose of the service

2TK is a technology platform that connects users looking for a property to rent ("renters" or "seekers") with property owners, landlords, management companies, or other authorized parties who publish properties ("publishers").

The platform enables, among other things, creating a profile, publishing and viewing properties, setting preferences, expressing interest, creating mutual matches, in-app communication, scheduling a meeting or property viewing, identity verification, notifications, and support and security services.

2. What information we collect

Depending on how you use the service, we may collect the following types of information:

• Account and identification details, such as name, email address, phone number, user identifier, account status, and verification details.
• Profile details, such as profile photo, age or date of birth, occupation, personal description, household composition, housing preferences, and other relevant preferences the user chooses to provide.
• Publisher and property details, including the publisher type, property address, area, price, size, number of rooms, property features, move-in date, description, photos, property status, and information required to manage the listing.
• Information relating to matches and activity in the service, such as Interests/Likes, Matches, saves, meeting statuses, blocks, reports, and events required to operate the service.
• Communication content sent through the service, including chat messages and technical information related to their sending, receipt, reading, and abuse prevention.
• Identity verification information. When a KYC or identity verification process is enabled, we may request an identity document, a photo or selfie, verification details, and the status of the verification process. Such information is processed only for the purposes of verification, fraud prevention, safety, and compliance with the requirements of the service or the law. Where an external verification provider is used, the relevant information may be transferred to it in order to perform the verification, subject to the applicable agreement and legal provisions.
• Technical and security information, such as IP address, device and operating system type, application version, installation identifiers, push token, sign-in events, operational logs, error diagnostics, risk and security signals, and information required to prevent unauthorized use.
• Location information. We may process general location or location data related to a property. A property's exact address or precise coordinates are not intended to be exposed to a user who is not authorized to receive them before the authorization stage defined in the service.

3. Information we receive from Google or other sign-in providers

When a user chooses to sign in using Google, we may receive from Google basic information needed for identification and sign-in, in accordance with the permissions the user approved, such as a unique Google identifier, email address, name, and profile picture.

Our use of Google information is limited to authenticating the user, securely creating or linking a 2TK account, displaying basic profile details, securing the account, and providing the requested service.

We do not use information received from Google to sell personal information, and we do not use it to create targeted advertising unrelated to the service. We do not transfer Google information to third parties except where required to operate the service, to secure it, a service provider acting on our behalf, a legal obligation, or the user's request.

Where another sign-in provider is used, such as Apple, similar principles apply in accordance with the information and permissions provided by that provider.

4. Purposes of using the information

We use the information for the following purposes:

• Establishing and managing the account
• Identity verification and account security
• Operating search, matching, and Match mechanisms
• Displaying information appropriate to the user according to their role and permissions
• Managing property listings
• Operating chat and communication between users after a Match
• Coordinating viewings and meetings
• Sending service messages, Push notifications, and operational updates
• Preventing fraud, impersonation, spam, abuse, and security incidents
• Handling blocks, reports, and complaints
• Providing support
• Analyzing malfunctions and improving service performance
• Complying with legal, regulatory, and security requirements

5. Provision of information – mandatory or optional

As a rule, providing information to 2TK is at the user's choice. However, certain details are required in order to open an account or use certain actions in the service.

Failure to provide information designated as mandatory may prevent opening an account, publishing a property, creating an Interest or Match, using a particular feature, identity verification, or another action that requires that information.

Where certain information is required by law, we will indicate this to the extent required.

6. Sharing information with other users

We display to other users only information required for the operation of the service and in accordance with role, match status, and permissions.

A publisher may see relevant profile information of a seeker who has expressed interest in their property, but is not meant to receive information about the seeker's private browsing or about other properties they have viewed.

Personal contact details and precise location details are not intended to be exposed before the relevant authorization stage defined in the service.

7. Service providers and third parties

We may use providers of infrastructure and storage, security, notification delivery, email services, identity verification, OAuth/social login, error monitoring, maps, or other technical services.

These providers receive access only to the information required to provide the service for us, in accordance with the agreements, confidentiality obligations, and information-security duties applicable as relevant.

We may disclose information where we are required to do so by law, a judicial order, or an authorized demand of an authority, or where reasonably required to protect rights, safety, fraud prevention, or the security of users and the service.

8. Data retention

We retain personal information only for as long as required for the purposes for which it was collected, to operate the service, secure it, manage disputes, enforce terms, and comply with the requirements of the law.

Retention periods may vary according to the type of information, account status, legal obligations, and security needs. Certain information may be retained for a limited period in backups or security records even after account deletion, where there is an operational or legal justification for it.

The foregoing does not constitute a commitment to a uniform retention period for all types of information.

9. Information security

We employ technological and organizational measures intended to reduce the risks of unauthorized access, loss, alteration, or disclosure of information.

Among other things, we use, as needed, authorization controls, encryption, session management, authentication, security-event logging, access restriction, separation of permissions, and mechanisms to protect sensitive information.

No security system provides absolute protection, and therefore we cannot guarantee absolute immunity from any security incident.

10. Transfer of information outside Israel

Some service providers may process or store information outside Israel. In such a case, we will act in accordance with the applicable law and take appropriate measures to protect the information.

11. Marketing messages and service messages

We may send operational messages required for the service, such as security notices, Match, chat messages, account status, or a change to an action performed.

Promotional or marketing messages will be sent subject to the consent required by law, and it will be possible to withdraw consent in accordance with the mechanism presented in the message or in the settings.

12. User rights

In accordance with applicable law, a user may request to review personal information held about them, and may request to correct or delete information that is incorrect, incomplete, unclear, or not up to date, all subject to the terms, exceptions, and provisions of the law.

A request may be submitted via tothekey26@gmail.com or through the existing account mechanisms in the application.

Deleting an account does not require the immediate deletion of information that there is a legal, security, or other legitimate obligation to retain.

13. Account deletion

A user may request account deletion via the application or the support channels.

Upon completion of the process, we will cease the active use of the account and delete or deactivate information in accordance with the retention policy, legal obligations, and security and fraud-prevention needs.

14. Minors

The service is intended for users aged 18 and over. Do not use the service if you are not legally competent to enter into agreements relating to its use.

15. Cookies and similar technologies on the website

The website may use Cookies or similar technologies for purposes of operation, security, remembering preferences, measurement, and error diagnostics. To the extent that Analytics, advertising, or tracking services requiring consent are activated, they will be activated in accordance with the consent mechanism required by applicable law.

16. Changes to this policy

We may update this policy from time to time. In the event of a material change, we will publish an appropriate notice in the service or take additional notification measures as relevant.

The date of the last update will be shown at the top of the document.

17. Contact

For questions, requests, or complaints regarding privacy:

To The Key, Hadera, Israel, tothekey26@gmail.com.

If the organization has appointed a data protection officer as required by law, their contact details will be published or provided in accordance with the requirements of the law.

This is a translation of the Hebrew-language original. In case of any discrepancy or conflict of interpretation, the Hebrew version prevails to the extent permitted by applicable law.