Privacy Policy

Last updated: October 19, 2026

תקציר בעברית נמצא בסוף העמוד.

1. Who we are

BulBazman (“we”, “us”) is a business operated by a sole proprietor in Israel. We develop and operate mobile apps for service businesses: each business receives its own app, under its own name and design (a “Business App”), in which the business's clients book appointments and the business manages its calendar, clients, team and payments.

Contact: bulbazman.team@gmail.com

2. Roles

Each business that uses a Business App decides which personal information about its clients it keeps and why. For that information the business is responsible towards its clients, and we process it on the business's behalf to provide the service. For information about the business's own staff accounts and about the Google Calendar integration described below, we process it to provide and secure the service.

3. Information processed in Business Apps

• Clients: name, phone number, appointments (date, time, treatment, provider, status), notes and treatment records entered by the business, and booking terms the client approved.
• Staff: name, username, role, working hours, and the services they provide.
• Business records: receipts and other accounting documents the business issues, and payment records.
• Technical data: sign-in identifiers, and a push-notification token if notifications are allowed.

We use this information only to operate the Business App for the business and its clients: booking, reminders and notifications, calendar and team management, and the business's records. We do not sell personal information and do not use it for advertising.

4. Google Calendar integration

Service providers (the business's staff) may choose to connect their own Google Account to a Business App. This is optional and is started only by the provider, from the app's settings. We request these permissions:

What we write: for each of the provider's appointments, one event in their primary calendar with the treatment, the client's name and phone number, the appointment notes, and the time. We update the event when the appointment changes and remove it when the appointment is cancelled. Each such event carries a private marker so we can recognise it.

What we read: events in the provider's primary calendar for roughly the next twelve months. From each event we use only its start and end time, whether it is marked “busy” or “free”, whether the provider declined it, and our own marker. We do not store the titles, descriptions, locations or attendees of the provider's own events.

What we store: the connected Google Account's email address; the access and refresh tokens Google issues for the connection; which Google event belongs to which appointment; and the busy time ranges (start and end only), which are replaced every few minutes. Tokens are kept only on our server, are not readable by any app user, and are used only to perform the synchronisation described here.

How it is used: busy times hide those time slots from online booking in that business's app, so clients can't book over them. Nothing else is done with Google user data.

Disconnecting and deletion: the provider can turn either part off, or disconnect, at any time in the app's settings. Disconnecting deletes the stored tokens, the stored busy times and the event links, removes the upcoming appointment events we added, and revokes our access with Google. Access can also be revoked at any time from the Google Account's security settings (myaccount.google.com/permissions).

5. Service providers and where data is kept

We use these providers to run the service, each only for its part: Supabase (database, authentication and server functions; data is stored in the European Union, in Frankfurt, Germany), Expo (delivery of push notifications), Google (the Calendar integration, at the provider's request), and Apple and Google app stores (app distribution). We do not share personal information with others except where required by law.

6. Retention

Information is kept while the business uses its Business App. Accounting documents are kept for the period required by Israeli tax law and cannot be changed after they are issued. A business may ask us to delete its data when it stops using the service, subject to those legal requirements. Google Calendar data is deleted as described in section 4.

7. Security

Data is transferred over encrypted connections. Access is limited by role: for example, a provider sees only their own clients' appointments, and an independent provider's financial records are visible only to them. Server credentials are kept out of the apps.

8. Your rights

Clients may ask the business they booked with, or us, to see, correct or delete information about them, subject to legal record-keeping requirements. Write to bulbazman.team@gmail.com.

9. Children

Business Apps are intended for adults. Bookings for minors are made by a parent or guardian.

10. Changes

We will update this page when our practices change, and change the “Last updated” date above.