Privacy Policy
This policy explains what BookliBookings ("Bookli", "we") collects about you, why, who sees it and what you can do about it. It applies to bookli-bookings.com and to the messages we send on behalf of businesses. We process personal data in accordance with the Israeli Protection of Privacy Law, 5741-1981, and, where it applies to visitors from the European Economic Area or the United Kingdom, the GDPR and UK GDPR.
1. Who is responsible
BookliBookings, Jerusalem, Israel, is the controller of the data described here. Contact: [email protected].
For the customer data a business keeps in its dashboard (its client list, its appointments), the business is the controller and Bookli processes that data on its behalf.
2. What we collect
| Data | When |
|---|---|
| Account details: name, email address, phone number, password (stored only as a hash). | When you register, or sign in with Google (we then receive your name, email and Google account id). |
| Booking details: business, service, staff member, date, time, price, whether it was paid, cancellations. | When you book, or when a business records an appointment for you. |
| Business details: business name, category, address and map location, phone, opening hours, staff names and photos, services and prices, photos, posts, business registration number, Instagram and Facebook links. | When a business owner sets up and edits their page. |
| Reviews you publish, with your name. | When you leave a review. |
| Messages: the content and delivery status of confirmations, codes and reminders we send by email, SMS or WhatsApp; messages you send to the support WhatsApp. | When a message is sent or received. |
| Technical data: IP address, browser and device type, pages requested, timestamps, the result of Cloudflare's bot check, and a security log of sign-ins and important account actions. | Automatically, on every request. |
| Payment records: plan, amount, date, payment reference from PayPal or the transfer app. | When a business pays for a plan. We never receive card numbers. |
3. Why we use it
- To create and manage appointments and to send confirmations, verification codes and reminders (performance of the service you asked for).
- To show a business page and the directory to visitors (the business's choice to publish).
- To let a business contact its own clients about appointments, within the limits of our Terms.
- To keep the platform secure: login protection, bot checks, rate limits, audit log, fraud prevention (our legitimate interest and legal duties).
- To moderate content and handle reports (legitimate interest and legal duties).
- To bill business plans and keep accounting records (contract and legal duties).
- To answer support requests.
We do not use your data for advertising, we do not build advertising profiles and we do not sell personal data.
4. Who sees it
- The business you book with sees your name, phone, email, your appointment history with them and your reviews. It does not see your bookings with other businesses.
- Visitors see what a business publishes on its page, and the name and text of published reviews.
- Service providers that process data for us under contract: Hetzner (hosting, Germany), Cloudflare (network, DNS and bot protection), Google (optional sign-in; email delivery through Gmail), Meta (WhatsApp Business messages), SMS carriers, PayPal (payments), and open map and address services used only for the address you type when setting up a business page.
- Authorities when the law requires it, or to protect the rights and safety of users.
Some providers are outside Israel and the EEA. Where required we rely on their standard contractual clauses and equivalent safeguards.
5. How long we keep it
- Account data: while the account exists, then deleted within 30 days of a deletion request.
- Appointment and payment records: up to 7 years where accounting or tax law requires it, otherwise deleted with the account.
- Security and audit logs: 12 months.
- Web server access logs: 90 days.
- Content removed for breaking our rules: kept as evidence for up to 12 months.
- Backups: daily, overwritten within 30 days.
6. Cookies and local storage
We use browser local storage to keep you signed in, remember your language and your light or dark preference. Cloudflare may set a security cookie to tell real visitors from bots. We do not use advertising or analytics cookies. Pages that embed Instagram posts load them from Instagram, which may set its own cookies; that only happens on business pages that chose to show Instagram content.
7. Your rights
You can ask us to show you the data we hold about you, correct it, delete it, restrict or object to certain processing, or give it to you in a portable format. You can delete your own account from your account settings. Businesses can edit or delete their page and photos from the dashboard. You can stop reminders by asking the business or by contacting us. If you think we mishandle your data you may complain to the Israeli Privacy Protection Authority or, in the EEA or UK, to your local data protection authority.
Requests: [email protected]. We answer within 30 days.
8. Children
Customer accounts require a minimum age of 16 and business accounts 18. If you believe a child has given us personal data, contact us and we will delete it. Businesses must not publish photos of minors without a parent's or guardian's consent.
9. Security
Passwords are hashed, traffic is encrypted, sign-ins are rate-limited and locked after repeated failures, server access is key-based and logged, and the database is backed up daily. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authority as the law requires.
10. Changes
We may update this policy. Material changes are announced by email or a notice in the dashboard at least 14 days before they apply.
11. Contact
BookliBookings, Jerusalem, Israel. [email protected], or WhatsApp support from the home page.