Privacy Policy

Last updated: 12 October 2026

This Privacy Policy explains how MLAIA Data Science Ltd. (Hebrew: המלאיה מדעני נתונים בע״מ; company registration / ח.פ. 516808078) ("MLAIA", "we", "us", or "our") handles personal data in connection with the NextDemand marketing website at nextdemand.ai (the "Site"). It covers this marketing Site and the free /try diagnostic. The NextDemand product application, used by our customers under a separate agreement, is not covered by this policy.

Who we are

The Site is operated by MLAIA Data Science Ltd., a company incorporated in Israel (company registration / ח.פ. 516808078), registered at Shenef 4, Yavne, Israel 8151139. MLAIA Data Science Ltd. is the data controller for the personal data described in this policy, including /try. Our privacy contact is Yochai Edlitz. All privacy inquiries and data-subject requests are handled by email at yochai@nextdemand.ai (we do not publish a phone line for privacy matters).

What data we collect

Apart from the free /try diagnostic, which has its own section below, the Site is a static, informational page. We set no cookies and run no analytics unless you opt in by clicking "Accept" on the cookie banner (see section 3 below). We use no tracking pixels, advertising networks or social-media trackers, and the Site submits no form data to any server. On /try, when you start a try, Google reCAPTCHA, which protects it from abuse, sets one cookie and your browser stores your sign-in session locally; /try also stores your language setting and, if you ask for a sign-in link, your work email address in your browser (see below). We collect personal data in only the three ways described below, plus the free /try diagnostic, which has its own section.

The Site's accessibility toolbar saves the display preferences you choose (such as larger text or high contrast) in your own browser's local storage — this is first-party data that stays on your device, is not a cookie, is never sent to us or anyone else, and is not used for tracking; you can remove it at any time with the toolbar's "Reset all" button or by clearing your browser's site data.

The free calculators under /tools (for example, the demand-pattern classifier, where you can paste demand histories) run entirely in your browser: anything you type or paste into them is processed on your device only — it is never transmitted to us, stored by us, or shared with anyone, and it disappears when you leave the page.

1. Information you volunteer by email

Apart from /try, the only way the Site sends us information is the "Book a demo" link that opens your own email application (a mailto: link). If you choose to email us, we receive the information you send — typically your email address and the content of your message (which may include your name, company, and any details you decide to share). We do not require you to provide any particular information.

2. Technical data processed by our infrastructure providers

Like any website, the Site cannot be delivered to your browser without your device's technical data passing through our hosting and content-delivery infrastructure. This happens automatically and is inherent to how the web works. The providers involved are:

• Firebase Hosting (Google LLC / Google Ireland Ltd.), which serves the Site from servers located primarily in the United States and automatically records standard server-log data — your IP address, request metadata, and a timestamp;
• Cloudflare, Inc., which provides DNS and content-delivery / redirect services across its global network and processes connection metadata (including IP address) to route and secure requests;
• Google Fonts (Google LLC), from which the Site loads the Archivo typeface; Google receives your IP address when your browser requests the font files.

We do not use this technical data to build profiles of visitors, and we do not combine it with other data to identify you.

3. Usage analytics — only with your consent

When you first visit, the Site asks whether you agree to analytics cookies. Until you click "Accept", no analytics script is loaded and no analytics cookie is set. If you accept, the Site loads Google Analytics 4 (Google LLC / Google Ireland Ltd.), which sets first-party cookies (named _ga and _ga_*) and records how the Site is used: pages viewed, approximate location derived from your IP address (IP addresses are not stored by Google Analytics 4), device and browser type, the page that referred you, and clicks on key links such as "Try it yourself" or "Book a demo". Advertising features, Google signals and ad personalisation are switched off. We use these statistics only to understand which content is useful and to improve the Site, and we keep them no longer than 14 months.

Your choice is remembered in your browser's local storage. You can change it at any time with the "Cookie settings" link at the bottom of every page; withdrawing consent stops analytics from that point on. You can also delete the cookies through your browser settings.

The free /try diagnostic

The free /try diagnostic lets you upload a sales file (and, optionally, an inventory file) without creating an account and see a preview of a report built from it. To unlock the full report, you give a work email address. Unlike the marketing Site, /try sends data to our cloud infrastructure. This section describes what it handles. The rest of this policy also applies to /try unless this section says otherwise.

What /try collects

• The files you upload. Before uploading, your browser keeps only the columns the diagnostic uses (such as date, SKU, quantity sold, stock on hand, unit cost and price, and lead time) and drops the rest. Your file's name is not kept. We also record which of your column names matched which of those columns.
• The currency and business type you choose, used to show amounts in your report and to word it.
• An anonymous sign-in. /try signs you in anonymously (Firebase Authentication), with no name, email address or password. The random identifier this creates links you to your upload and your report.
• A keyed hash of your IP address. To enforce a daily limit on tries, we combine your IP address with the date and a secret key and keep only the resulting keyed hash (pseudonymised data), for up to three days. We do not keep your IP address in our own records; our hosting providers receive it in order to deliver /try.
• Your report: figures and per-product rows computed from your files.
• Your work email, if you unlock the full report. After the preview, you can unlock the full report by giving a work email address. We check the address before sending anything: addresses at disposable-email domains and at domains with no mail server are refused, and free email addresses (such as Gmail or Outlook) are accepted and marked as free email. We then email a sign-in link to that address. Opening it, from any browser, signs you in with that address and unlocks your report.
• Limits on full reports. One full report per email address every 30 days, three per company domain each month (free email addresses do not count towards a domain), and a daily limit overall. For these limits we keep a one-way hash of your email address, not the address itself, and, for company addresses, the domain name for that month. These limit records are deleted automatically: the email hash after 30 days, the domain record in the following month.
• A sales lead, only if you agree. When you unlock the full report, you can tick a box to let us contact you about NextDemand. Only if you do, we create a lead record: your work email address, its domain, whether it is a free email address, the business type and currency you chose, the money figures your preview showed, the number of items, the time, a reference to your try, whether the daily limit stopped your unlock, and when you agreed and which opt-in wording you saw. If you agreed and the daily limit stops your unlock, we still keep the lead.
• Usage counts, such as "upload completed" or "report ready", with a timestamp. They contain no sign-in identifier, IP address or file content.

/try does not ask for your name or for any contact details other than the work email address you give to unlock the full report. Please upload business data only (sales and stock figures by product), not personal data about individuals.

Cookies and browser storage

/try sets no cookies of its own. When you start a try (by choosing a file or running it), Google reCAPTCHA, which protects /try from automated abuse, sets one cookie (_GRECAPTCHA, on google.com), and /try keeps your sign-in session (anonymous at first and, after you unlock, signed in with your work email), the technical tokens used for sign-in and abuse protection, and the Firebase software's heartbeat record in your browser's storage. /try also stores your language setting there and, when you run a try, a random code and your report's identifier, kept for that browser tab only, so that it can pick up the same try and show your report if the page reloads. When you ask for a sign-in link, /try keeps the work email address you entered and your report's identifier in your browser's storage, so that opening the link in the same browser completes your sign-in. They are removed once opening the link in that browser signs you in; otherwise they stay until you ask for another link or clear your browser's site data. During the unlock, /try also keeps your email address and the unlock's progress, and during and after it your report's identifier, for that browser tab only.

Why we use it

We use your files, currency and business type only to compute and show your report. We use the anonymous sign-in so that only you can open your report in /try, and the sign-in and the IP hash to limit abuse (one active try per sign-in and a daily limit per address). If you unlock the full report, we use your work email address to send you the sign-in link and an email when your full report is ready, to apply the limits on full reports, and, if you agreed, as a sales lead, to follow up with you about NextDemand. Replies to these emails reach us at yochai@nextdemand.ai. We use the usage counts to see, in aggregate, how /try is used and where it fails. We do not use any of this for advertising or profiling.

For visitors in the European Economic Area and the United Kingdom, our legal bases under the GDPR are: providing the service you ask for (Article 6(1)(b)) for your files, your currency and business-type choices, your report and the anonymous sign-in; and our legitimate interests (Article 6(1)(f)) in preventing abuse, keeping /try working and recoverable, and understanding how it is used, for the IP hash, the reCAPTCHA check, error reports, backups and usage counts. You may object at any time to processing based on legitimate interests (see "Your rights" below). If you unlock the full report, we use your work email address to provide the service you ask for (Article 6(1)(b)): the sign-in link, the unlock and the email telling you your report is ready; and our legitimate interest in preventing abuse (Article 6(1)(f)) for the limits on full reports. We keep a lead record and contact you about NextDemand only with your consent (Article 6(1)(a)). You can withdraw it at any time, and ask us to delete your lead, by emailing yochai@nextdemand.ai.

You are not required by law or by contract to use /try or to give us any of this data; without your files we cannot produce a report. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

No AI

Your files are not sent to any AI service. Your report is computed by our own code.

Who can see it

Only you can open your report in /try: in the browser you used or, after you unlock it, by signing in with the link sent to your work email. Authorised MLAIA staff can access your upload and report when needed for support or to keep the service running. We do not share your files or your report with anyone else, apart from the service providers named below, which process them on our behalf.

How long we keep it

If you do not unlock the full report, everything is deleted after 7 days; if you unlock it, everything is deleted 30 days after the unlock (occasionally a few days later, if processing is still finishing): your files, your report, the related records, your anonymous sign-in (unless you have since used it to sign up for a NextDemand account) and the email sign-in created when you unlocked (unless it belongs to a NextDemand customer account). If you agreed to be contacted, your lead record is kept separately for 12 months for sales follow-up, then deleted automatically; we delete it sooner if you ask (email yochai@nextdemand.ai). Deleted try-it data, including deleted leads, may remain in encrypted backups for up to 98 more days, used only for disaster recovery, then permanently erased. The IP hash is removed within three days. The usage counts described above are kept for as long as we need them to understand how /try is used and where it fails.

Where it is stored and processed

/try runs on Google Cloud (Firebase). Your uploaded files are stored in the United States, your report and the related records in the European Union, and your files are processed in Israel to compute your report. The functions that handle sign-in and uploads run in the United States. Leads and the limit records are stored in the European Union. The emails /try sends you are sent through Amazon Web Services in the European Union (Stockholm, Sweden). See "International transfers" below.

Service providers for /try

• Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Cloud Run), for sign-in, storage and computing;
• Google reCAPTCHA Enterprise, which checks that requests come from a real browser, to block automated abuse; it sets one cookie, _GRECAPTCHA, on google.com;
• Sentry (Functional Software, Inc.), which receives technical error reports from the /try page; it is configured to exclude cookies, request headers and request bodies.
• Amazon Web Services (Amazon Simple Email Service), which sends the sign-in link and the email telling you your full report is ready to your work email address.

To ask about your /try data or exercise your rights (see "Your rights" below), email yochai@nextdemand.ai. If you did not unlock the full report, your try is anonymous, so we may need information that links it to you before we can act on your request, such as the date and time of your try and details of the files you uploaded.

Why we use it and our legal basis

We use the information you email us solely to read and respond to your enquiry and to conduct the resulting business correspondence. Technical / server-log data is processed only to deliver, secure, and maintain the Site. Analytics data (if you opted in) is used only to measure and improve the Site. We do not use any of it for automated decision-making or profiling.

For visitors in the European Economic Area and the United Kingdom, our legal bases under the General Data Protection Regulation (GDPR) are our legitimate interest in operating a secure website and responding to enquiries about our products, and your consent, given by voluntarily choosing to contact us or by accepting analytics cookies. You may withdraw consent or object at any time (see "Your rights" below).

AI use

Messages you email us are read and answered by a human. They are not automatically processed by AI, profiled, or used to train AI systems. Files you upload to /try are not sent to any AI service (see The free /try diagnostic).

Sharing and disclosure

We do not sell, rent, or trade your personal data, and we do not share it for third-party marketing. The only third parties that process data in connection with the Site are the infrastructure providers named above (hosting, CDN / DNS, and fonts) and, only if you accept analytics cookies, Google Analytics, acting on our behalf or as necessary to deliver the Site, plus the standard email-service providers that carry any message you send us, and, for /try, the service providers named in its section. We may also disclose information where required by law or to establish, exercise, or defend legal claims.

International transfers

MLAIA is based in Israel, which the European Commission recognises as providing an adequate level of data protection. Our hosting, CDN, font and (if you opt in) analytics providers (Google and Cloudflare) may process technical data on servers in the United States and other countries. Where such transfers involve personal data of EEA/UK individuals, they are covered by appropriate safeguards, which may include the EU Standard Contractual Clauses and certification under the EU-US Data Privacy Framework.

For /try, your uploaded files are stored in the United States, your report and the related records in the European Union, and your files are processed in Israel, which has an EU adequacy decision (see The free /try diagnostic). Google LLC, Sentry and Amazon Web Services, Inc. are certified under the EU-US Data Privacy Framework and its UK Extension; where the Framework does not apply, transfers are covered by the safeguards described above.

Security

The Site is served exclusively over HTTPS/TLS. Apart from /try, it is a static site with no database and no user accounts, which materially reduces its attack surface. Access to any correspondence you send us is limited to authorised MLAIA personnel on a need-to-know basis.

Retention

We keep the emails and correspondence you send us for up to three years from submission, or until the end of any resulting business relationship, whichever is appropriate, after which we delete or archive them in the ordinary course. Technical server-log data is retained by our infrastructure providers under their own standard retention periods. For /try, see "How long we keep it" in The free /try diagnostic.

Your rights

Subject to applicable law, you have the following rights over your personal data:

• Access — to obtain a copy of the data we hold about you;
• Correction — to have inaccurate or incomplete data corrected;
• Deletion — to have your data erased;
• Portability — to receive your data in a portable format;
• Withdraw consent — at any time, without affecting prior processing;
• Restriction — to limit how we process your data;
• Objection — to object to processing based on legitimate interest.

To exercise any of these rights, email yochai@nextdemand.ai. We will acknowledge your request within 5 business days and respond to verified requests within 30 days (extendable to 60 days for complex requests, in which case we will tell you). There is no charge unless a request is manifestly unfounded or excessive.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.

Israeli Privacy Protection Law

If you are in Israel, the Israeli Privacy Protection Law, 5741-1981 — including Amendment 13, effective August 2025 — applies. You have the right to review personal information we hold about you and to request that inaccurate, incomplete, or outdated information be corrected or deleted. You may also lodge a complaint with the Israeli Privacy Protection Authority (PPA / רשות הגנת הפרטיות). Please direct requests to yochai@nextdemand.ai.

Children

The Site is intended for business audiences and is not directed at children under 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be reflected on this page.

Contact

Questions about this policy or your personal data? Email yochai@nextdemand.ai, or write to MLAIA Data Science Ltd., Shenef 4, Yavne, Israel 8151139.

MLAIA Data Science Ltd. · Shenef 4, Yavne, Israel 8151139 · yochai@nextdemand.ai