Privacy Policy

1. Who we are

QME operates a platform for booking appointments and managing businesses, on qme-tor.com and in the app. Database controller: QME. Privacy inquiries: privacy@qme-tor.com.

For customer, business owner, staff and partner program accounts, QME is the controller of the information. The information a business keeps about its customers (customer card, notes, forms, appointment and payment history) belongs to the business. The business is its controller, and QME is a "holder" that processes it on the business's behalf and according to its instructions. You can send requests about such information directly to the business. Requests that reach us will be forwarded to it.

2. What information we collect

You are not legally required to give us any information; doing so is up to you. Without the details marked as required, we cannot provide the service: book an appointment, verify your identity, or send confirmations and reminders.

2.1 Customers

• Required: name and phone number, for SMS code verification, booking, and sending confirmations and reminders.
• Optional: email address, day and month of birth (no year), and photos attached to an appointment.
• Your appointments, cancellations, waitlist entries, session packs and payments to businesses.

2.2 Business owners and staff

• Required: name, phone, and business details (name, address, opening hours, services and prices).
• Optional: email, photos, description, social media links, and details of staff members that were entered.
• Subscription and invoice details.

2.3 Partner program members

• Required: name and mobile number, for SMS code verification and identification, and the personal link code.
• Optional: email, for updates about sign-ups and commissions.
• Required to receive payment: a business registration certificate or certificate of incorporation, and the business type, to verify that a commission can be paid and for our accounting records. For a sole trader, the business number is the ID number.
• Link data: the number of visits, sign-ups, payments and commissions. A visit is counted by a random identifier, with no details about the visitor.

2.4 Sensitive information in forms

A business may ask you to fill in a form before your appointment, such as a health declaration. Such a form may include information of special sensitivity, such as medical information. It is submitted only after your explicit consent in the form itself, stored encrypted, and accessible only to the business that requested it.

2.5 Payments

Card details are entered directly on the payment processor's page and never pass through us. We keep only the last four digits and the expiry date, so you can recognize the card.

2.6 Technical information

• IP address, browser or device type, and access times, to secure your account and handle errors.
• A notification identifier (push token) with the device maker and model, so notifications reach the right device.

2.7 Device permissions

Permissions are used only for actions you start. You can revoke any of them in your device settings, and the service will keep working.

• Contacts: to import customers. Only the contacts you select are sent to us, and only their name, phone and email.
• Photos: to upload a logo, gallery, products and stories. Only the files you choose are sent.
• Calendar: to show your events next to your appointments and to save appointments to your calendar. Calendar data stays on the device.
• Notifications: for reminders and updates.

2.8 What we do not collect

• We do not collect your device location.
• We do not use third-party advertising, tracking or analytics tools.
• We do not sell information or pass it to data brokers.

3. How we use information

• Providing the service: booking and managing appointments, reminders, waitlists, session packs and payments.
• Verifying identity, securing accounts and preventing abuse.
• Support, troubleshooting and improving the service.
• Running the partner program: attributing a business that signed up to the partner who referred it, and calculating and paying the commission.
• Meeting legal obligations, such as keeping accounting records.
• Marketing messages from businesses you booked with, as described in section 4.

4. Marketing messages and direct mail

A business you booked with may send you advertising messages in the app (their title will include "Advertisement"), birthday greetings and invitations to come back. You can stop each type separately, for each business, in your profile in the app under "My businesses". This is your right under section 17F of the Protection of Privacy Law. Reminders and confirmations for appointments you booked are not marketing, and they keep arriving.

Business owners: QME may send you advertising messages about its services in the app (their title will include "Advertisement"). You can stop them at any time in the business notification settings. Service messages about your account, subscription and the system are not marketing, and they keep arriving.

5. Who receives information

• The business you booked with: your name, phone, appointment details and the answers to forms you filled in for it.
• A partner program member, when a business signs up through their link: the business name and whether it is on a trial, until the first payment and for up to 90 days from sign-up. After that the partner sees numbers only. No other information about the business, its owner or its customers is shared with them.
• Authorities, when the law requires it or under a court order.
• Service providers that operate the system for us, only to the extent their role requires:

• Hetzner — Application servers
• Supabase — Service database
• Vercel — Website hosting
• Cloudflare — Traffic routing to our servers, and encrypted storage of backups and of partners' business certificates
• Cloudinary — Image and file storage
• Google Firebase and Apple — Push notification delivery
• Meta (WhatsApp) and 019 — Delivery of verification codes and messages
• Google (Gmail) — Email delivery
• Pusher — Real-time updates of the business calendar
• Sentry — App error monitoring
• CardCom — Processing customer payments to businesses
• Invoice4U — Subscription payment processing and issuing invoices and receipts
• Google Places — Business address autocomplete during sign-up

Some providers store information outside Israel, in the European Union and the United States. Transfers are made under the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001, to providers that have committed to protect the information and not use it for any other purpose.

6. Data security

• Communication is encrypted (TLS).
• Phone numbers, emails, customer notes and form answers are stored encrypted in the database.
• Partners' business certificates are stored encrypted, and only QME can view them. Every view is logged.
• Each business's information is isolated from other businesses, and access within a business is limited by staff permissions.
• Access to customer information is logged, and backups are encrypted.

If a serious security incident occurs, we will report it to the Privacy Protection Authority and to the business owners whose information was affected, as required by law. Where needed, we will also inform you.

7. Cookies and browser storage

The website uses only QME's own cookies and local storage: a sign-in cookie, and saving your choices (theme, accessibility settings and dismissing the install prompt). The website has no third-party advertising, tracking or analytics cookies.

Arriving through a partner's or a business's link stores a cookie with the referral code only, for 60 days, so the sign-up is attributed to whoever referred it. A partner link also stores a random identifier for 24 hours, so the same visit is not counted twice.

8. Retention and deletion

• Information is kept as long as the account is active.
• Deleting a customer account (in your profile in the app or on the website) immediately deletes your personal information at all businesses, cancels future appointments, and deletes forms and photos. Appointments and payments that businesses need for their records remain without identifying details.
• A customer who is not linked to any business and has been inactive for 24 months is anonymized automatically.
• Deleting a business account deletes all information of the business and of its customers at that business.
• Deleting a partner account (in the partner portal) immediately deletes the name, phone, email and business certificate and disables the link. Commission data is kept without identifying details. A certificate replaced by a new one is deleted.
• Accounting documents are kept for 7 years, as the law requires.
• Encrypted backups are deleted on a rolling basis.

9. Your rights

• To review the information held about you (section 13 of the Law).
• To ask to correct or delete information that is wrong, incomplete or out of date (section 14).
• To ask to be removed from marketing mail (section 17F). You can also do this yourself in the app.
• To delete your account yourself, from your profile. Partners: in the partner portal, under "Profile".

You can send requests to privacy@qme-tor.com. We will respond within 30 days. If you did not receive a proper response, you can contact the Privacy Protection Authority.

10. Minors

The service is not intended for children. A minor under 18 may use the service only with the consent of a parent or guardian.

11. Changes to this policy

The version number and update date appear at the top of the page. We will announce any material change on the website and in the app and ask for your consent again.