Privacy Policy

Effective October 7, 2026

7IT Solutions ("we", "us") is operated by Lior Aharonov and is based in Israel. This policy explains what information we collect on 7it.co.il, how we use it, and the choices you have. The short version: we collect what we need to answer you and improve the site, we do not sell personal information, and you can ask us to delete your data at any time by emailing lior@7it.co.il.

The AI chat

This site includes a chat with Lior's AI twin. Please know how it works before you use it:

• Your messages are processed by an AI service. Chat messages are sent to Anthropic's Claude API to generate replies, subject to Anthropic's own privacy practices.
• Chat conversations are sent to us automatically. If you share your email address in the chat, and also when a conversation goes idle or you leave the page, the chat transcript together with an AI generated summary is emailed to us so Lior can review it and follow up. This happens automatically; you do not need to submit anything for the conversation to reach us.
• Your conversation is also saved in your browser (local storage) so it survives a page refresh. You can remove it by clearing your browser data for this site.
• Please do not share sensitive information in the chat such as passwords, financial account details, or health information. Share only what you would put in a normal business email.

Contact form and leads

When you submit the contact form, or leave your email in the chat, we receive the details you provide (such as name, email, service interest, budget range, and your message, plus the chat transcript where applicable). If you arrive at the form from one of our tools, the form is filled in with that tool's result, which you can edit before sending. These details are delivered to us by email through Resend, our email delivery provider, and as a notification to Lior on Telegram, and we use them to respond to you and follow up about your project.

The tools on this site

• Store Speed Grader. The store addresses you enter are sent to Google PageSpeed Insights, which loads those public pages and measures them. We may keep the result for up to 24 hours so a report link can open it again. Each test sends us a notification with the store address, its score, the platform and apps detected, and the country the request came from. If you ask for a speed badge, we run the test again and keep a small certificate (the store address, its score, time to main content, its rank in our study and the date) at an unguessable address that is not listed or indexed, for as long as the badge is in use; email us to have it deleted.
• Automation calculator. Your figures are calculated in your browser. When you reach a result, a summary without personal details (the kinds of work chosen, the hours, the yearly cost and the hourly rate) is sent to us. A revenue figure you type into our tools is never sent.
• Field Kits and plans. When you leave your email to open a Field Kit, a build plan or a full list of fixes, we receive your email, what you opened and the page you were on. What you check off in a kit stays in your browser.

Our tools inside AI assistants

You can use our tools from AI assistants such as ChatGPT or Claude through our MCP server at 7it.co.il/mcp. When you do, the assistant sends us only what the tool needs: for example a store address, the figures for a calculation, or a search term. We use it to produce the result, may keep the result for up to 24 hours so its report link works, and record which assistant made the request. If you or your assistant ask 7IT a question through the ask_7it tool, that question is sent to Lior so he can answer it personally. When an assistant uses one of the other tools, Lior receives a short notice of which tool was used and the web address or search words it was given, so he can see how the tools are used. No name, email or conversation is included. We do not receive your conversation with the assistant, and we do not record your IP address with these requests beyond the standard logs our host keeps. The assistant itself handles your conversation under its own privacy policy.

The 7IT Guard plugin for Claude Code (formerly named Ship Check; 7it.co.il/tools/guard) runs its checks on your own computer: the requests go from your computer to the app you name and to public DNS. It never sends a request to the app's database and never reads data inside it. Nothing about the app or the results is sent to us. Only when the app itself publishes an MCP server does the plugin contact us, to download one public list from 7Maps (7it.co.il/7maps/known/ followed by two characters): the request carries those two characters of a one-way code and never the app's or the server's address, and the plugin compares the list on your computer to say whether that server is on the 7Maps map; we count these downloads without any address. Its "Full report" link carries the results after the "#" in the address, which browsers do not send to servers; the report page draws them in your browser, and our analytics records that page's address without that part. If you set a 7IT key, the plugin sends us that key, the short names of the findings (for example "csp_missing") and the names of the platforms it detected (for example "vercel"), once, when you ask for the fix playbook; we check the key with Lemon Squeezy, count its uses, and keep the usage record described below, never the app's address or the report. Clients that cannot run the plugin may use the hosted version at 7it.co.il/mcp?set=guard, which is covered by the paragraph above (it receives the address of the app). The deeper checks run only on an app that carries our verification token, and report file paths and the kinds of keys found in the code the app sends to every visitor, never file contents or key values; for the app's database they give the owner steps to follow in their own account.

The 7IT Guard app and Guard Pro (7it.co.il/guard/app). We do not ask for your name, email address or password. You sign in by proving a website is yours (a line we give you, placed on the site) or with a 7IT license key. For each site we keep its address, the results of our outside checks (whether it answered, how fast, its certificate, its domain's expiry date, its security settings, what changed at each update, whether the database or hosting service it uses answered as paused, and, on a site whose ownership is proven, the kinds of exposed files or secret keys found, never their contents), and the alerts and summaries we sent. We never read the contents of your database. For each signed-in device we keep a random id, the device type, when it was last used and, if you turn them on, its push notification address, stored encrypted; to offer the no-cost plan once per device we keep a one-way code of the device. Your preferences (quiet hours, time zone, which alerts reach you) are kept with the account. We never keep your network address with any of this. Customer files are stored encrypted, under names that cannot be worked out from a site address.

Payments are handled by Lemon Squeezy as merchant of record: your name, email and card details go to Lemon Squeezy and do not reach us. From Lemon Squeezy we keep only a one-way code of your license key, order and customer number, the plan, the subscription status and its dates, and the amounts of your own payments to show them to you in the app.

To offer the 14 days of Guard Pro and the money-back guarantee only once per website and per customer, we keep a one-way, encrypted code of the website's domain, and of the customer number for refunds, with the date each was used, for 24 months. It does not contain the domain or the customer number itself and is not linked to a person.

Retention: while your account is in use we keep up to 90 days of check history (the app shows what your plan includes). When a plan or the 14 days of Guard Pro end, we keep your data for 90 days so it is all there if you come back; after that the no-cost plan keeps 7 days. An account that has not been used for 180 days, and whose devices have not accepted a notification in that time, is deleted, with a notice in the app 14 days before. A site registered for you by an AI assistant and never opened in the app is deleted after 30 days. The signed daily record of our checks (one-way codes of check results, which anyone can verify) is kept permanently and does not identify you. You can delete your account at any time in the app (Account, Delete my account): everything above is deleted at once, except the one-way codes described above and Lemon Squeezy's own records, which it keeps as merchant of record under its privacy policy.

Requests for personal guidance, a Launch Review or an urgent engineer (from 7it.co.il/plans/request or the 7IT Guard app): we keep your name, email address, site address and the words you wrote, encrypted, with the service you asked for and when, so Lior can reply by email. He gets each request in his own notification channel. Nothing is charged through the form. We do not keep your network address or browser details with a request, and a request is deleted 90 days after it is closed.

To run these tools reliably and keep them safe from misuse, we keep a short usage record for each request made to them, whether from an assistant or from the tools on this site: which tool or resource was used, which assistant software made the request, whether it worked and how long it took, the country our host derives from the network address, and for website tools only the site's host name (for example example.com). Your IP address is not stored in this record. Instead we keep a random-looking code computed from the network address and the assistant's software name, under a key we change every year, so we can count repeat use and spot abuse without knowing who you are. Links in tool results carry a short reference code so we can tell when a report was opened, and if you then contact us, that your message followed a report. These records are kept for 90 days.

For our monthly study State of AI-Built App Security, each run of the app security check, the Supabase check and the owner-verified deep scan also leaves an anonymous count: which standard protections the site sends, its hosting and builder where the page shows them, whether Supabase was found, and the kinds of exposed files or secret keys found (kinds only, and only for a site whose owner proved it is theirs). The count carries no address, project, key or file content; a one-way code that changes every month lets us count a site once a month. Only totals and percentages are published, and small groups are never shown.

7Maps

7Maps is our public map of MCP servers (7it.co.il/7maps). Its crawler, 7Maps-bot, reads only what MCP servers publish to any client (the handshake and the tool list) and never signs in or calls a tool. Around it:

• Agent reports (opt-in). An agent can report how a call to a server went (report_road, or last_trip on a paid call). A report has fixed fields only: the server, the tool name, worked or failed with a reason from a fixed list, milliseconds, whether the result matched the description, result size, amount charged, a surprise from a fixed list, and a tool-list fingerprint. No text in the agent's own words. The reporter is recorded as a code: for a paying customer a code derived from its wallet or license, otherwise a keyed code derived from the network address, never the IP address itself. Reports are part of the signed public history and are kept as written.
• Gateway sensors (opt-in). Operators who switch on our open-source sensor send, per call their gateway forwards: the server address or registry name, worked or failed with a reason from a fixed list, milliseconds, the tool name and the time, plus a random sensor id, the gateway kind and the sensor version. Arguments, results, prompts, user ids, keys and tokens are never sent, and a batch with any other field is refused. The sensor's IP address is not stored. Raw batches are deleted after about a month, once that day's totals exist; the daily totals per server are kept.
• Demand counts. When an agent asks 7Maps to find a tool or pick a server, we record the kind of request, a category, up to a few common keywords and which servers were shown and picked. No task text, agent identity, IP address or user agent. Raw records are deleted after about a month; only daily aggregates are kept, and owners see aggregates only.
• Server owners. When an owner verifies a server, we keep the date, how control was proven and the optional public note. An alert address (ntfy, Slack, Discord or a webhook) is stored encrypted, used only to send that server's down and up alerts, and never shown or returned. Lior receives a short notice of each verification with the host and the kind of alert, never the alert address. Submissions keep the server address and the details given in the form; opt-outs keep the host name.
• Counters. Page, badge and widget view counts keep no IP address, user agent or referrer. Short-lived rate counters (for submissions and ownership checks) use a one-way code derived from the network address, not the IP address itself, and are deleted within days.
• Calls to the 7Maps tools are covered by the usage record described above (kept 90 days). For 7Maps tools that record also keeps the public address of the MCP server the call was about, the tool it pointed to, and an estimate of the tokens the answer saved, so we can count which servers agents choose most.
• The 7Maps plugin (Claude Code, Cursor and Gemini CLI; 7it.co.il/7maps/plugin). It connects your agent to our 7Maps MCP server, so the requests your agent makes there are covered by the usage record below. At the start of a session (Claude Code and Gemini CLI) its hook downloads one public list, 7it.co.il/7maps/down.json, at most every 10 minutes, and compares it with the MCP servers configured on your computer as one-way codes on your computer: no server address, name or setting is sent to us. The download is counted without any address. Turn it off with the environment variable SEVENMAPS_HOOK=off. An optional personal key, if you set one, is sent with the plugin's requests as described under personal keys.
• Personal keys (optional). At 7it.co.il/7maps/me anyone can create a random key, without an account or an email address. We never store the key itself, only a one-way code of it, the date it was created and, if you switch on the badge, a separate public id. For each call made with the key we keep the tool, whether it worked, the number of servers it covered, an estimate of the tokens saved, failures avoided and the response time. Never the task, arguments, results, IP address or user agent. These per-call counts are folded into daily totals and deleted after about a month; the daily totals stay while the key exists. "Delete my data" on that page removes the key, its daily totals and the badge at once. Our internal business metrics keep only counts, such as how many keys were active in a month, with no link back to the deleted key.

Retention in detail, and what is part of the permanent signed history, is listed in the 7Maps methodology.

Paid tools and payments

When an AI agent pays for one of our paid tools per call (x402, USDC on the Base network), we keep the paying wallet address, the amount, the transaction id and which tool was used, so we can account for payments and serve the customer; a blockchain payment is public by its nature. Payments are verified and settled through an x402 facilitator (currently PayAI). Monthly plans are sold by Lemon Squeezy as merchant of record: card details go to Lemon Squeezy and never reach us. For 7IT Guard plans, what we keep from Lemon Squeezy is described under the 7IT Guard app above. For a site monitor we keep the site's host name, the weekly results and, if given, the webhook address. These records are kept while the plan or monitor is active and for up to seven years afterwards where tax and accounting rules require it.

Analytics

We use Google Analytics 4 to understand how the site is used: pages viewed, links clicked, downloads, and interactions with the AI chat (such as when a chat starts, not the content of your messages). Google Analytics uses cookies and collects device and usage information, including truncated IP addresses, under Google's privacy policy. You can limit this through your browser's cookie settings or Google's opt out tools.

Scheduling

Booking a call uses Calendly. Any details you enter while booking (name, email, meeting notes) are handled by Calendly under its own privacy policy and shared with us so we can hold the meeting.

Security and hosting

The site is hosted on Vercel, which keeps standard server logs (such as IP addresses and request times) for security and operations. The chat may use Cloudflare Turnstile to filter automated abuse; Turnstile evaluates browser signals under Cloudflare's privacy policy.

Service providers

We share data only with the providers needed to run the site: Google (analytics, and PageSpeed Insights for the Store Speed Grader), Anthropic (AI chat replies and summaries), Resend (email delivery), Telegram (notifications to Lior), Vercel (hosting and short-term storage of tool results), Calendly (scheduling), and Cloudflare (bot protection). Each processes data on our behalf for these purposes. Some providers process data in the United States or the European Union.

How we use your information

To reply to your inquiries, follow up on potential projects, run and improve the site, and keep it secure. We do not sell personal information, and we do not use your data for third party advertising.

Retention

Lead emails, notifications and chat transcripts are kept for as long as they are useful for following up on your inquiry, then deleted. Stored tool results expire after 24 hours, tool usage records after 90 days, except speed-badge certificates, which stay until you ask us to delete them. 7Maps: raw sensor batches, demand records and per-call counts of personal keys after about a month, view counts after 90 days, rate counters within days; the daily totals of a personal key until you delete it; agent reports, daily aggregates and the signed daily history are kept (see the 7Maps section). Analytics data is retained according to our Google Analytics settings.

Your choices

Email lior@7it.co.il to ask what we hold about you or to have it deleted, and we will handle it promptly. You can clear the chat conversation stored in your browser at any time through your browser settings, and control cookies the same way.

Children

This site is a business service and is not directed to children under 16. We do not knowingly collect their information.

Changes

If we change how the site handles data, we will update this page and its effective date.

Contact

7IT Solutions, Lior Aharonov. Email lior@7it.co.il. See also our Terms of Use.