Privacy statement

Last updated: 2026-10-26

This statement explains which personal information the service collects, why, how it is protected, and what rights you have. It is written according to the Israeli Privacy Protection Law, 1981, including Amendment 13, and the Privacy Protection (Data Security) Regulations, 2017.

Who is responsible for the data

• Business owners' accounts (login and business details): the service operator is responsible.
• Clients' data that a business enters (its clients and appointments): the business is the owner of that database. The service operator holds and processes it only on the business's behalf, to provide the service, and does not use it for any other purpose.

Information we store on our servers

• Business account: business name and type, contact person, phone, email, address, calendar settings.
• Owner login: email, name, an encrypted (hashed) password — we never store the password itself — preferred language, time of last login.
• Security records: email and IP address of failed login attempts, kept for up to 24 hours to block password guessing; technical error logs.
• Clients' data entered by the business: first and last name, ID or passport number, phone numbers, email addresses, home address, notes, and appointment history (dates, services, status, price, notes). Treatment notes may include sensitive information, such as health information. Businesses should enter only what they need.

Providing the information is not required by law. Without the login details and the business details the service cannot work. Clients' details are entered by the business, which decides what to collect and must inform its clients.

Purpose of use

The information is used only to provide the service: logging in, managing clients and appointments, and keeping the service secure. We do not sell information, do not use it for advertising, and do not send marketing messages.

Cookies and browser storage

• crm_sid — session cookie, strictly necessary for login and protection against forged requests. Deleted when you close the browser or log out.
• crm_lang — remembers the language you chose. Kept for one year.
• crm.a11y (browser local storage, not a cookie) — your accessibility display settings. Stays in your browser and is not sent to us.

We do not use analytics, tracking or advertising cookies of our own.

Data sent to third parties

We do not send personal information to third parties, except the hosting provider that runs our servers under a data-processing agreement, and when the law requires it. All page scripts and styles are served from our own servers.

Third-party advertising

The service may show ads served by a third-party provider. We have no control over those parts of the page, over the content of the ads, or over cookies or data that the ad provider may collect. Their use is governed by the provider's own privacy policy. If ads are added, you will be asked for consent before any non-essential cookies are set.

How we protect the information

• Encrypted connection (HTTPS) on all pages in production.
• Passwords stored only as a one-way hash; limits on failed login attempts.
• Each business can access only its own data. No public registration — accounts are opened only by the service manager.
• Access to servers and backups is limited to authorized staff.

Retention

Data is kept while the business account is active. When an account is closed, its data is deleted within 90 days, unless the law requires us to keep it longer. A business can ask for an export of its data before closing.

Your rights

You may ask to see the information about you, and to correct or delete it (sections 13 and 14 of the Privacy Protection Law). If you are a client of a business that uses this service, please contact that business first — it decides about its clients' data. We will help the business answer your request.

Security incidents

If a security incident affects personal information, we will inform the affected businesses and the Privacy Protection Authority as the law requires.

Contact

For any privacy question or request, contact the service manager who opened your account.

We may update this statement. The date at the top shows the latest version.