🔒 Privacy Policy

1. Introduction

Welcome to the Timing Privacy Policy. We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, store, and protect your information when you use our booking platform. By using Timing, you agree to the practices described in this policy. If you do not agree with this policy, please do not use our services.

2. Information We Collect

We collect various types of information to provide and improve our services: • Personal Information: Full name, email address, phone number, profile photo, date of birth, and gender. • Business Information: For service providers - business name, address, operating hours, services offered, and pricing. • Appointment Details: Appointment dates and times, selected services, preferred service provider, and appointment history. • Payment Information: Transaction details, payment history, and transaction identifiers (we do not store full credit card numbers). • Technical Information: Device type, operating system, app version, IP address, and unique device identifier. • Usage Data: In-app interactions, features used, screens viewed, and usage frequency. • Approximate Location: In the Timing web app, when you start creating a business, your country is looked up from your IP address. Unless the business address or the phone country you pick already decides it, that country becomes the business's country: its holiday calendar, currency and phone prefix, and the country rules we apply to it, such as tax and messaging rules. In the Timing app, when you tap 'Use my current location' (business address), 'Start from my current location' (Plan my day) or 'Near me' (Businesses tab), your device's location is read once, at reduced accuracy, and never in the background: for the address it is sent through our servers to Google to suggest nearby addresses and is not stored; in Plan my day it goes into the Google Maps link that opens; 'Near me' sorts businesses on your device. This website picks Hebrew or English from your browser's time zone and language, inside your browser, with no lookup. • Precise Location: only when you tap 'Attach my exact location' while booking a visit at your address. Your device's location is read once and saved with that booking so the service provider can navigate to you; when the business plans its schedule or its day by travel time, the point is sent to Google's routing service to estimate travel times. The business directory's 'Near me' sorts businesses by distance inside your browser and does not send your location to Timing; the directory's map loads the map tiles for the area shown from OpenStreetMap.

3. How We Use Your Information

We use your information for the following purposes: • Providing appointment booking services and processing reservations. • Creating and managing your user account. • Sending appointment confirmations, reminders, and notifications. • Processing payments and issuing receipts. • Improving our services, user experience, and functionality. • Providing customer support and responding to your inquiries. • Sending updates, promotions, and marketing messages (only with your explicit prior consent, as required under anti-spam law including Israeli Amendment No. 40 to the Communications Law for commercial SMS; you can opt out at any time). Messages from Timing to business owners are covered by Section 8c. • Analyzing usage patterns to improve the platform. • Preventing fraud, abuse, and ensuring platform security. • Complying with legal and regulatory requirements.

4. Information Sharing

We may share your information in the following circumstances: • With Service Providers: To enable appointment booking and service delivery. When you book an appointment, your contact details and appointment details are shared with the service provider. • With Third-Party Service Providers: We work with cloud services, payment processors, analytics, and messaging systems to operate the platform, and with advertising measurement services (only with your advertising consent). • For Legal Requirements: When required by law, in response to legal proceedings, or to protect our rights. We disclose only what the law requires, and we notify the business owner that their information or their customers' information was demanded, unless we are prohibited from notifying them. • With Your Consent: In any other case where we obtain your explicit consent. • In the Public Business Directory: business owners may choose (explicit opt-in, revocable at any time from the app) to display their business details: name, category, city and address, photos, description, service names, and rating, in a public business directory on our website. • With Search Engines: Each business's public booking page (app.timingapps.com/lp/...) is included by default in our sitemap for search engines, separately from and independently of the business directory. The owner can turn this off at any time using the "Show in search engines" switch in the app, after which we remove the page from our sitemap and ask search engines not to list it; the link itself keeps working. We have no control over third-party caches. When your details are shared with a business/service provider to fulfill a booking, that business acts as an independent controller of the information and processes it under its own privacy policy and practices; Timing is not responsible for how the business uses the information once shared. Platform administrator access: for support, fault diagnosis and running the service, a platform administrator can access information stored with us. That access is limited to what is needed, and every viewing of a business's customer records is written to an audit log recording who accessed it, which business, and when. We do not sell your personal information to third parties.

5. Data Security

We implement industry-standard technical and organizational measures to protect your information: • Encryption of data in transit (TLS) and at rest. • Authentication managed by Firebase Authentication. • Role-based access controls and server-side database rules so businesses and staff can only reach data they are authorized to see. • Hosting on Google Cloud Platform / Firebase, which maintains its own recognized security certifications. While we strive to protect your information, no method of electronic transmission or storage is 100% secure and we cannot guarantee absolute security. We will notify you and, where required, the competent authority of a breach affecting your personal information as described in the Data Breach section.

6. Data Retention

We retain your personal information as long as your account is active or as needed to provide you with services. After account deletion, we retain certain information for the following periods: • Transaction records: 7 years (as required by tax laws). • Aggregated analytics data (anonymous): Indefinitely. • Database backups: a daily backup kept for up to 7 days, and a weekly backup kept for up to 14 weeks. • Deleted files (images, documents): Recoverable for up to 30 days. Forms filled in by customers (including signatures and attached files) are kept until something deletes them. The business owner who collected them can switch on automatic deletion of older submissions from the app, and it is on by default for new accounts; the retention window follows the business's subscription plan. Until it is switched on, submissions are kept indefinitely. You may request deletion of your personal information at any time, subject to legal requirements for data retention.

7. Your Rights

You have the following rights regarding your personal information: • Right of Access: Request a copy of your personal information. • Right to Rectification: Correct inaccurate or incomplete information. • Right to Erasure: Request deletion of your personal information. • Right to Restriction: Restrict the processing of your information. • Right to Portability: Receive your information in a structured, common format. • Right to Object: Object to the processing of your information for certain purposes. • Right to Withdraw Consent: Withdraw previously given consent at any time. To exercise these rights, please contact us through the contact details below. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience. Consent is asked for each purpose separately, not as a single bundle: • Essential Cookies: Required for basic platform functionality and to carry out something you asked for (such as making a booking). Always on and not subject to consent. • Analytics & session replay: Google Analytics and Microsoft Clarity, used to find faults and improve usability. Requires its own consent. • Advertising & remarketing: Meta Pixel and server-side conversion measurement, both sent to Meta; in the web app this includes hashed identifiers (email, phone, name). Also, Google Ads conversion measurement: if you arrived from a Google ad, the ad click identifier and the event (signup or payment; for a payment, also the amount paid and its currency) are sent to Google Ads, without your name, email or phone. Requires its own consent; allowing analytics is not consent to advertising. On the marketing site, in the web app (app.timingapps.com), and on the booking pages (/lp), third-party tools: Meta Pixel and Microsoft Clarity session replay, are not loaded at all and make no request whatsoever to the third party until you actively accept the relevant purpose. Each surface offers only the purposes actually used there: the booking pages run measurement alone, so consent given there covers measurement only and is never recorded as consent to advertising; this site and the web app ask about measurement and advertising separately. Google Analytics loads for all visitors but in Consent Mode, all cookie storage and all advertising signals are disabled until you accept, so no Analytics cookie is written to your device beforehand. Refusing is available as easily as accepting, on the same screen and in the same number of taps. We retain a record of your choice: the purposes accepted, the consent version, and the time it was given. You can change or withdraw consent at any time: on the marketing site via 'Cookie settings' in the footer, on the booking page via 'Cookie settings' at the bottom of the page, and in the app via Profile → Privacy & Cookie Settings. You can also manage cookies through your browser settings. The choice cookie: we keep your choice in one small first-party cookie named 'timing_consent' on the timingapps.com domain, so that it applies on both timingapps.com and app.timingapps.com (the web app and the booking pages) and you are not asked the same question twice. A choice made on a booking page covers measurement only, so the other sites still ask you separately about advertising. The cookie holds only the choice itself: the purposes you accepted, whether you were asked about advertising, the consent version and the time it was given. It contains no name, email, phone number or identifier, and it is kept for up to 6 months, after which you are asked again. Withdrawing consent on one of the sites withdraws it on both. Cookie-free audience measurement: we additionally count page views on our website using a first-party, cookie-free counter that stores nothing on your device and creates no profile. For each visit we derive a short-lived daily code from your IP address and browser type; it cannot be linked across days, the underlying data (IP and browser identity) is never stored, and the code is deleted within 72 hours. Only aggregate statistics are retained: pages, referral sources, country (which our hosting provider derives from the IP address), device type, browser family, browser language, and campaign tags (utm_source/medium/campaign). Legal basis: our legitimate interest in measuring our own website. This data never leaves our systems and is never combined with account data. First-party marketing measurement: we store a random visitor identifier of our own on your device (the 'tv_id' cookie, lasting up to two years) together with the campaign details you arrived through, utm_source/medium/campaign and advertising click identifiers (Meta's fbclid, Google Ads' gclid/gbraid/wbraid). It serves one purpose: knowing which campaigns bring businesses that actually sign up. The identifier is random, contains no name, email or phone number, and is never sold. If, and only if, you granted advertising consent, then when you sign up or pay we send Google Ads the Google click identifier (gclid, gbraid or wbraid) together with that event and the time it happened (for a payment, also the amount paid and its currency), so we can measure which ads bring businesses. No name, email or phone number is sent to Google for this. If you withdraw your advertising consent, we stop sending once the withdrawal reaches your account, which happens the next time you open the web app. If you open an account, the identifier and campaign are saved on your business profile so the signup can be traced to its source. Legal basis: our legitimate interest in measuring our own marketing, and for the Google Ads send, your advertising consent. You can delete this at any time by clearing your browser cookies, or by contacting support@timingapps.com.

8b. Advertising Messages and Opt-Out

Advertising SMS is sent only to recipients who gave prior, explicit, recorded consent, as required by section 30A of the Communications Law (the Israeli "Anti-Spam Law", Amendment 40). An absent flag is not consent: a customer who never opted in is excluded from the send. Every advertising message carries the word "פרסומת" at its start, the sending business's name and a way to contact it, and a direct removal link. Following that link opens a page where a phone number can be entered and permanently removed from that business's mailing list. The removal is recorded and honoured even if the customer record is later recreated (for example by a file import). Operational messages about an appointment you made: confirmation, reminder, change, or cancellation: are not advertising, do not require marketing consent, and continue after a removal. To stop those, contact the business or us. A business owner using the platform to message its own clients is the advertiser for the purposes of the law and is responsible for holding the consent; Timing provides the technical controls: consent-based filtering, the mandatory message markings, and the removal link.

8c. Messages from Timing to Business Owners

Business owners who use Timing receive messages from us by WhatsApp, SMS, email and in-app notification. They are of two kinds: • Service messages about your account and business: for example finishing your booking page setup, alerts about appointments and payments, and changes to the service. • Marketing messages about Timing itself: for example new features, joining the business directory, and subscription offers. By using Timing as a business owner you agree to receive these messages. Every marketing message starts with the word "פרסומת" (advertisement), is sent in Timing's name, and includes an immediate, free way to opt out. You can stop at any time: with the opt-out button in the message, by replying "הסר" (stop) to the WhatsApp message, or with the "WhatsApp updates from Timing" switch in the app's notification settings. The opt-out is recorded and honoured for all later sends, and you can switch updates back on from the same switch. Opting out does not stop messages the account needs to operate, such as security, billing and appointment messages. These messages go to business owners themselves only, never to a business's customers.

9. Third-Party Services

We use the following third-party services: • Google Firebase: For authentication, database, storage, and analytics. • Google Cloud Platform: For data storage and processing. • Grow (grow.business / Meshulam): For processing web subscription purchases, and - when the business owner enables it - for processing client payments for appointments through the business's own Grow account. Funds settle directly to the business's account; Timing does not hold funds and does not access card or bank details. • Apple App Store and Google Play Billing: For in-app purchases on iOS and Android. • Bit: For processing appointment payments (when enabled). • WhatsApp Business API (Meta): For sending appointment confirmations and reminders to phone numbers you or your customers provide, only where messaging is enabled and consented. • Email Services: For sending notifications and reminders. • Google Analytics: For usage analysis and service improvement. • Google Ads: advertising conversion measurement (the ad click identifier and the signup or payment event; for a payment, also its amount and currency), only with your advertising consent. • Firebase Crashlytics: For crash reporting on iOS and Android apps. • Shorebird: delivers updates to the iOS and Android apps without a store download. The app sends Shorebird its version and update number, the operating system, the processor type and a random install identifier that is not linked to your account and resets when you uninstall the app. Like any server, Shorebird sees the connection's IP address. No location, advertising identifier or account details are sent. • Sentry: For error monitoring and human-readable stack traces from the web app. Your Firebase User ID is attached to error events to aid diagnosis. • Microsoft Clarity: For anonymous session replays and UI heatmaps on the website and web app, to identify usability issues. • IP Geolocation (Cloudflare, ipapi.co): in the Timing web app, when you start creating a business, to detect your country from your IP address (see Approximate Location above). Cloudflare is asked first, and ipapi.co only if that fails. • Google Maps Platform (Places, Routes): address search and suggestions, nearby addresses for a location you chose to share, and travel times between appointments for businesses that plan by travel time. The requests go from our servers, so Google receives the search text or the coordinates, not your account details. • Nager.Date (date.nager.at): public holiday dates for businesses whose holiday calendar is a country other than Israel. The app or our servers fetch them, so Nager.Date sees the requesting IP address. • OpenStreetMap: map tiles for the business directory's map on this website and for the map in the Timing app's Businesses tab. Your browser or the app loads the tiles for the area shown, so OpenStreetMap sees your IP address and that area. Each third-party service has its own privacy policy, and we recommend reviewing them. We only select providers that meet strict security and privacy standards.

10. Google User Data

Timing accesses Google user data only when you choose to use Google-powered features. For Google Sign-In, we receive and use your Google account identifier, email address, display name, profile photo, and authentication tokens through Firebase Authentication so we can create or sign you in to your Timing account, link staff/business access by email, prevent duplicate accounts, secure your session, and provide support. For Google Calendar, after your explicit authorization, we request calendar.readonly to list calendars you can select and calendar.events to create, update, delete, and read events needed for two-way appointment sync and optional import of external calendar events as availability blocks. Calendar data we may access includes calendar IDs/names, event IDs, titles, descriptions, locations, start/end times, time zone, busy/free status, all-day status, and app-specific private extended properties used to identify Timing-created events and business/staff scope. We use Google Calendar data only to provide calendar sync, restore sync state, show calendar choices, keep Timing appointments aligned with the selected Google calendar, and optionally import selected external calendar events as private availability blocks. Imported external events are stored in Timing/Firebase with the event ID, selected calendar ID, title, description/notes, start/end time, all-day status, busy/free blocking status, and sync metadata so your availability can be calculated and updated. Timing-created appointments may be written to your selected Google calendar with appointment title, description, location, start/end time, business/staff identifiers in private extended properties, and the Google event ID stored in Timing. We do not use Google Calendar data for advertising, sell it, or use it to train AI models. Google user data is stored in Firebase/Google Cloud and, for the selected calendar preference and short-lived web Calendar API access token, in secure local storage on your device/browser. The cached access token is used only to restore Calendar API access after a web page reload, expires after about 50 minutes, and is cleared when you disconnect or sign out. Google OAuth credentials are otherwise handled by Google Sign-In/Firebase SDKs. We do not share Google user data except with service providers that operate Timing infrastructure, with the business/staff/customer participants necessary to display or manage bookings, when required by law, or with your explicit consent. You can disconnect Google Calendar in the app, revoke access from your Google Account permissions page, sign out, or request account/data deletion by contacting support@timingapps.com. Timing's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11. Children's Privacy

A Timing account is not intended for anyone under 16, and we do not open accounts for children. Customers of the businesses using the platform can, however, be minors: a business may book an appointment for a minor and record their details, and a minor may fill in a form the business sent them. In those cases it is the business owner who collects the information, and it is their responsibility to obtain parental or guardian consent where the service and the processing require it. Timing does not verify age and cannot know whether the person filling in a form is a minor. If you become aware that a minor's information has been collected unlawfully, contact us or the business and we will act to delete it.

12. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by: • Posting the updated policy in the app. • Sending an email or in-app notification. • Updating the 'Last Updated' date at the top of the policy. Your continued use of Timing after such changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us:

📧 Email: support@timingapps.com

📍 Address: Timing, Tel Aviv, Israel

📞 Phone: +972-52-331-6433

🏢 Legal entity: Omer Rahmany

14. GDPR Compliance

Timing is committed to compliance with the European Union's General Data Protection Regulation (GDPR). As part of this commitment: • We process personal information only on a legal basis (consent, contract performance, legitimate interest, or legal obligation). • We implement the data minimization principle - collecting only information necessary for our purposes. • We ensure full transparency regarding information collection and use. • We enable you to exercise all your rights under GDPR. • In Israel we comply with the Privacy Protection Law, 1981, including Amendment No. 13 (in effect since August 2025). • Where a business uploads personal data about its own clients, that business is the controller and Timing acts as its processor under the Data Processing section of our Terms of Use. • For any privacy request, contact support@timingapps.com; EU/EEA/UK users may also lodge a complaint with their local supervisory authority.

15. Data Breach

In the event of a personal-data breach: • Where legally required, we will notify the competent supervisory authority without undue delay - and within 72 hours where GDPR applies, to the extent feasible. • We will notify affected users without undue delay where the breach is likely to affect their rights. • We will take immediate steps to minimize damage and prevent further breaches. • We will document the incident and conduct a thorough investigation. We maintain reasonable measures to detect, investigate, and respond to security incidents.

16. International Data Transfer

Your information may be transferred and processed in countries outside your country of residence, including countries that may not provide the same level of data protection. When we transfer information internationally, we ensure: • Our infrastructure providers (Google Cloud / Firebase) process data under data processing agreements that incorporate the European Commission's Standard Contractual Clauses (SCCs) for international transfers where applicable. • Implementation of appropriate technical and organizational safeguards. Your information is primarily stored on Google Cloud / Firebase servers, including in the EU and other regions.

17. Automated Decision-Making

Timing may use automated processing for: • Personalized recommendations for services and service providers. • Fraud detection and prevention. • Optimization of appointment times and schedules. We do not make automated decisions with legal or significant impact on you without human involvement. You have the right to request human intervention, express your point of view, and contest automated decisions.