Privacy Policy

1. Information we collect

• Account details: name, email address, business name and password. Passwords are stored only as a one-way hash; we cannot read them.
• Sign-in with Google or Apple: name, email address, profile picture (Google) and the account identifier at that provider. We never receive your Google or Apple password.
• Information a business enters: events, customers and contacts, quotes, income, expenses and the documents attached to them, tasks, suppliers, equipment inventory, music plans and songs.
• Information a business's customers fill in through links the business sends them, such as a couple's questionnaire or song requests.
• Support requests: what you write to us in a ticket, screenshots you attach, and which business you were working in at the time - so we can help.
• Technical information: IP address and browser or device type when you sign in (to secure the account), and a device identifier for push notifications if you allow them.

We do not use analytics, advertising or tracking tools, and we do not sell information.

2. How we use information

• To provide the Service and run your account and team.
• To send service messages: verification codes, password resets, invitations to join a business, reminders, and questionnaires or messages a business asked us to send to its customers.
• To send push notifications about events and updates, if you allow them.
• To secure the Service, prevent abuse and provide support.

3. Information from your Google account

When you sign in with Google we request only the basic openid, email and profile scopes, and use them only to identify you, create your account and show your name and picture in the app. We do not access any other Google service in your account.

Event Master's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is not shared with third parties, not used for advertising and not used to train AI models.

Google Calendar sync (optional): if you choose to connect your Google Calendar, we ask Google for the calendar.app.created scope (create and manage calendars the app makes itself) and the account's email address. With it the app creates one calendar in your account, named "Event Master · <business name>", and writes into it the events you see in the Service (name, kind, time, place, the names of the people celebrating and the DJ; no amounts). We have no access to the other calendars and events in the account and read nothing from them.

The access tokens Google issues are stored encrypted and used only to keep that calendar up to date. You can disconnect at any time in the Service's settings (the calendar we made is then removed from your account and the tokens are deleted on our side), or from your Google account's security settings.

4. Service providers that process information for us

• Neon - database and sign-in (servers in Frankfurt, European Union).
• Vercel - website and server hosting, and screenshots attached to support tickets (Frankfurt).
• Resend - email delivery.
• Google Firebase Cloud Messaging - push notifications.
• Google and Apple - sign-in, if you choose it; Google Calendar - syncing events to your calendar, if you connect it.
• Google reCAPTCHA - protecting sign-in and registration from automated abuse. Google receives technical information about your device and browser and your interaction with the page.
• Anthropic - transliterating names from Hebrew to English in the Switcher tool, only when it is used (only the text to transliterate is sent).

We rely on the following providers; each receives only what its role requires:

5. Transfers outside Israel

Information is stored on servers in the European Union, whose level of data protection is recognised by Israel. Some providers may also process information in the United States, subject to their data protection commitments.

6. Cookies and on-device storage

We use only the cookies needed to run the Service: keeping you signed in, the active business, your language and a temporary sign-in flow. On the sign-in, registration and password-reset pages Google reCAPTCHA also sets its own cookies, used only to tell people from automated programs. Preferences such as display settings are kept on your device. There are no advertising or tracking cookies.

On the public site we count anonymously how many times a page was seen and a button was pressed, by the source in the link that brought you (for example the name of the group it was posted in). Only a number is kept: no cookie, no IP address and nothing that identifies you. The source itself is kept on your device for up to 30 days, and if you ask to join or open a business it is recorded next to the request or the business.

If you leave a request to join, we keep your name, e-mail, phone and what you marked on the form, in order to get back to you with an invitation. Tips and updates by e-mail are sent only to people who said they want them, and each such e-mail has a link to stop them.

If you turn on Face ID sign-in in the app, your password is stored only in your device's Keychain, protected by Face ID, and is never sent to us.

7. Businesses using the Service

For information a business enters about its customers, the business is responsible for that information and we process it on its behalf. A business's customer who wants to access, correct or delete their information should first contact that business.

8. How long we keep information

Information is kept while the account is active. An account deleted in the Service ("My profile" -> "Delete account") is deleted at once; a deletion request by e-mail is handled within 30 days. Information the law requires us to keep (such as invoices) is kept only as long as required. Backup copies are deleted in their normal cycle.

9. Your rights

Under the Israeli Protection of Privacy Law, 5741-1981 (and the GDPR where it applies), you may ask to access, correct or delete your information or account. Send a request to support@event-master.co.il and we will handle it within 30 days.

You can also delete the account yourself, in the Service: "My profile" -> "Delete account". What is deleted and what stays is explained at https://www.event-master.co.il/en/delete-account.

10. Security

All communication is encrypted (HTTPS), passwords are stored as one-way hashes, and access is limited by permissions within each business. No system is completely immune; if a security incident affects you, we will notify you as required by law.

11. Children

The Service is intended for businesses and is not intended for anyone under 18.

12. Changes to this policy

We will update this policy from time to time, along with the date at the top of the page. We will announce material changes by email or in the app.

13. Contact

For any privacy question or request: support@event-master.co.il