Tor gives each business its own booking page and a private diary and client list. Two different roles exist, and the responsibilities differ.

• The business is the controller of its clients' data. A business that uses Tor decides which details it asks its clients for and why. PROPEL handles that data as the business's processor (operator): only to run the service for that business and on its instructions.
• PROPEL is the controller of account data. For the business owners and staff who sign in to Tor, and for the technical data needed to run and protect the platform, PROPEL decides how the data is used.

If you booked an appointment with a business, that business is your first contact for questions about your details. PROPEL will help the business answer you.

Which fields exist depends on the business's settings. In general:

• Clients of a business: full name, phone number and, where the business asks for it, an email address; the bookings (service, date and time, status); notes the client writes while booking; notes the business keeps about the client or the booking; answers to the forms and declarations the business asks for (a business may choose to ask for health information, and such forms can carry a signature image); records of the messages sent about a booking and, for text messaging, the consent that was given.
• Business owners and staff: name, email address and sign-in details (the password is stored only as a hash by our authentication provider), the business's details and settings, and a log of actions taken in the admin area.
• Technical data: to limit abuse we keep a one-way hash of the visitor's IP address (the application does not store the raw address) together with a shortened browser identifier; the hosting network keeps ordinary request logs. Our own application logs do not contain names, email addresses or phone numbers.

We do not use advertising or analytics trackers, social media pixels or advertising networks, and we do not sell personal data.

• To let a client book, change or cancel an appointment, and to let the business run its diary.
• To send the messages that belong to a booking: confirmation, reminders, change and cancellation notices, a verification code when the business requires one, and invitations and password-reset mail for account holders.
• To keep the service secure and working: preventing abuse and spam, finding faults, and keeping an audit trail of administrative actions.
• To keep records the law requires, such as invoices, where the business uses the invoicing add-on.
• To sync bookings with the owner's own Google Calendar, only when the owner connects it (see the Google section below).

We do not use client data for our own marketing and we do not build profiles of clients.

PROPEL uses the following providers to run Tor. Each receives only what its task needs.

• Supabase: database, sign-in (authentication) and private file storage for form signatures. The database is hosted in the EU (Frankfurt, eu-central-1).
• Cloudflare: hosting and delivery of the application at the edge of its network, DNS, and a bot check (Turnstile) on booking steps where it is enabled.
• Resend: sending of transactional email (confirmations, reminders, verification codes, invitations).
• Google (Google Calendar API): only when a business owner connects their Google Calendar.
• Meta (WhatsApp Business) and invoicing providers: only for a business whose WhatsApp or invoicing add-on has been connected by the studio at the business's request. Without that, no data goes to them.

We do not share personal data with anyone else, except where a law or a binding order requires it.

This section applies only to a business owner who chooses to connect their Google Calendar to Tor in the settings screen. Without that step, Tor receives nothing from Google.

What the app accesses, and why:

• Calendar events that Tor creates for bookings (scope calendar.events). Tor creates, updates and removes one event per booking on the calendar the owner chose, so that the booking appears in the owner's own calendar and moves or disappears when the booking changes.
• Busy times from the calendar or calendars the owner ticked (scope calendar.events, optional read direction). Tor reads the start and end of events in the next 60 days so that a time already taken in the owner's calendar is not offered to clients. It does not request titles, descriptions, locations or attendees.
• A dedicated calendar (scope calendar.app.created). By default Tor creates a new calendar named after the business and writes the booking events there, so that the owner's other calendars stay untouched.
• The list of the owner's calendars (scope calendar.calendarlist.readonly). Tor shows the names of the owner's calendars so that the owner can choose where events go and which calendars count as busy. Tor does not request the owner's email address or profile and does not learn which Google account it is.

What Tor stores:

• The identifier of each event created for a booking, with the booking it belongs to.
• The identifier and name of the chosen calendar, and the identifiers of the calendars read for busy times.
• The busy intervals, as a start and an end only. Titles, descriptions, locations and attendees of the owner's events are never requested, so they never reach our servers. Overlapping intervals are merged.
• The refresh token Google issues, encrypted (AES-256-GCM) before it is written to the database, plus a short-lived access token kept encrypted in the same way. The encryption key is held outside the database.

The events Tor writes to the owner's calendar contain the booking's details: the service, the client's name, status, date and time, the client's phone number, and the notes entered for the booking. These are data the business already holds in Tor, sent to the business owner's own Google Calendar at the owner's request.

How the data is used and shared:

• Data from Google is used only to provide the visible calendar sync feature to that same business owner, and for nothing else.
• It is not sold.
• It is not used for advertising, including personalised advertising.
• It is not transferred to anyone except as needed to provide the feature, to comply with the law, or as part of a merger or sale of the service, with notice to the owner.
• It is not used to develop, improve or train generalized artificial intelligence or machine learning models.
• No person reads it, except with the owner's explicit consent for a support request, or where required by law or to investigate abuse.

How to disconnect and delete:

• In Tor, open Settings, then Google Calendar, then Disconnect. This revokes the token at Google and deletes our copy of the token, the busy intervals and the links to events. If you choose it, Tor also removes the events it created. The dedicated calendar itself stays in your Google account; you can delete it in Google Calendar.
• Or revoke Tor's access directly in your Google account. Sync then stops, and the connection is shown as needing reconnection.
• If a business closes its account, its Google connection and the data above are deleted with it.

Manage third-party access in your Google account: https://myaccount.google.com/permissions

Tor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The policy: Google API Services User Data Policy

• Bookings and client details are kept while the business keeps its Tor account, so that it has its history. A business can anonymise a client on request: the name, phone number and email are removed from the client and from the bookings.
• Form answers and signatures are deleted automatically after the number of days the business set for its forms, when it set one. Answers to forms marked sensitive are encrypted by the application before they are stored.
• Invoices are kept for seven years, as tax rules require. Anonymising a client does not remove them; only the name as it appeared on the document, the number, the amounts and the date remain.
• Verification codes and abuse-prevention records are short-lived and are purged automatically.
• Google data is kept only while the connection exists and is deleted on disconnection, as described above.
• Closing an account: when a business leaves, its data is deleted, including files in storage, after the business has had the chance to export what it needs. Any backups held by our database provider expire on the provider's own schedule.

• Each business's data is separated from every other business's: the database enforces row-level security by business, and server code filters by business on every request.
• Traffic is encrypted with HTTPS.
• Credentials for connected services (such as the Google refresh token and the WhatsApp and invoicing credentials) are encrypted at rest and bound to the business they belong to; they are never shown in the interface or in logs.
• Answers to sensitive forms are encrypted by the application. Signature images are stored in a private location and opened only through short-lived links after a permission check.
• Passwords are handled by our authentication provider and stored only as hashes. Manage links sent to clients are signed and carry no password.
• Our logs do not contain names, email addresses or phone numbers.
• There is no advertising tracking on any Tor page.

No system is perfectly secure. If a breach affecting personal data occurs, we will notify the affected businesses and the authorities as the law requires.

Tor uses only what the service needs. There are no advertising or tracking cookies.

• Sign-in session cookies for business owners and staff, and a cookie that remembers which business is open.
• A language cookie and a short-lived cookie that records that an email address was verified during a booking.
• Small interface cookies in the admin area, such as one that remembers a closed notice.
• Local storage in your browser: the interface theme, saved views in the admin area, keyboard-shortcut and guided-tour settings, and, if you tick the box while booking, your name, phone and email so that the next booking is quicker. This stays in your browser and is not sent to us until you make a booking; delete it in your browser's site settings at any time.

You may ask to see the personal data held about you, to have it corrected or deleted, to receive a copy, and to object to its use, as applicable law allows (including the Israeli Protection of Privacy Law, 1981, and where relevant the GDPR).

• If you are a client of a business, ask the business. It can export a copy of your data and anonymise it from the client card. You can also write to us and we will pass the request to the business or carry it out for it.
• If you are a business owner or staff member, write to us for access, correction or deletion of your account data.
• For Google data, you can disconnect at any time (see the Google section).

Write to the address below or call. We answer within a reasonable time, and within 30 days at the latest.

• Name: PROPEL
• Email: propel.manage@gmail.com
• Phone: 0537154945

Tor is meant for businesses. It is not directed at children under 16 and we do not knowingly collect data from them for our own purposes. A business that serves minors decides what to collect and, where required, obtains a parent's or guardian's consent.

The database is in the EU. Some providers (for example Cloudflare, Resend and Google) operate globally, so data can be processed outside Israel and the EU. Where that happens we rely on the safeguards in those providers' data processing terms, such as standard contractual clauses.

We will update this page when the service changes in a way that matters here, and change the date at the top. For a material change we will also tell business owners by email or in the admin area.

• Name: PROPEL
• Email: propel.manage@gmail.com
• Phone: 0537154945