Privacy Policy

Last updated: 24 May 2026

This Privacy Policy explains how Dorak ("Dorak", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use the Dorak appointment-booking platform — including our mobile applications, our web dashboard, and our website at dorak-appointments.com (together, the "Services").

Dorak is operated by Deyaa Hojerat, a sole proprietor (Osek) registered in Israel ("the Operator"). The Operator is the data controller responsible for your personal information under the Israeli Privacy Protection Law, 5741‑1981 (including its amendments) and, where applicable, the EU General Data Protection Regulation (GDPR).

Please read this Policy together with our Terms of Service. By creating an account or using the Services, you acknowledge that you have read and understood this Policy.

1. Who this Policy applies to

The Services are used by two kinds of people:

  • Customers — individuals who discover businesses, book appointments, and manage their bookings.
  • Business users — store owners, managers, and staff who use Dorak to manage their business, services, schedules, and customers.

This Policy applies to both, with differences noted where relevant.

2. Information we collect

2.1 Information you provide to us

  • Account details: your full name, email address, phone number, gender, and password (passwords are handled and stored by Google Firebase Authentication, not by us in plain text).
  • Profile information: profile photo, and, for business users, your business name, business address, industry, working hours, services, team members, and business photos/logo.
  • Booking information: the appointments you create, including the business, service, staff member, date and time, and any notes you add.
  • Content you submit: reviews and ratings you leave for businesses, and feedback or ratings you give about the app itself.
  • Communications: messages you send to our support address.

2.2 Information we collect automatically

  • Usage and analytics data: how you interact with the Services — screens viewed, features used, session activity, and events such as starting a guest session or completing a booking. We collect this to understand how the Services are used and to improve and enhance the platform and your experience (see Section 3).
  • Device information: device model, operating system and version, app version, language/locale, a device identifier (Android id / iOS identifierForVendor), and network/connectivity status.
  • Approximate and precise location: with your permission, your device's GPS location and a reverse‑geocoded address, used to show you nearby businesses and improve search results. You can disable location access at any time in your device settings.
  • Push notification token: a Firebase Cloud Messaging (FCM) token that lets us deliver push notifications to your device.
  • Diagnostic data: crash reports, error logs, and performance metrics (app start time, screen load times, network timings) used to keep the Services stable and fast.

2.3 Information from third parties

  • Sign‑in providers: if you sign in with Google or Apple, we receive your name, email address, and (where available) profile photo from that provider, in accordance with their respective privacy policies and the permissions you grant.

We do not collect special categories of data (such as health, religion, or biometric identifiers). Biometric authentication (fingerprint/face), if you enable it, is performed entirely on your device by your operating system — Dorak never receives or stores your biometric data.

3. How we use your information

We use your information to:

  1. Provide the Services — create and manage your account, authenticate you, show businesses and availability, create and manage bookings, deliver notifications, and process reviews.
  2. Analyze usage and improve and enhance the platform and your experience — we analyze how people use Dorak (in aggregate and at the event level) to understand what works, fix problems, prioritize new features, personalize relevant content, and continuously enhance the quality, performance, and usability of the Services.
  3. Communicate with you — send booking confirmations, reminders, service updates, and, where you have opted in, re‑engagement reminders. You can opt out of non‑essential messages at any time.
  4. Keep the Services safe — detect, prevent, and address fraud, abuse, security incidents, and technical problems.
  5. Comply with the law — meet our legal and regulatory obligations and enforce our Terms of Service.

4. Legal bases for processing

Where the GDPR applies, we rely on the following legal bases:

  • Performance of a contract — to provide the Services you request (e.g. creating bookings, managing your account).
  • Consent — for location access, push notifications, optional re‑engagement reminders, and certain analytics; you may withdraw consent at any time.
  • Legitimate interests — to analyze usage, secure the Services, and improve and enhance the platform, balanced against your rights and freedoms.
  • Legal obligation — where processing is required to comply with applicable law.

Under the Israeli Privacy Protection Law, you provide your information voluntarily; without certain information we may be unable to provide the Services.

5. How we share your information

We do not sell your personal information. We share it only as described below:

  • Between customers and businesses: when you book an appointment, the relevant business receives the information necessary to fulfil it (e.g. your name, phone number, selected service, time, and notes). When you leave a review, your name and review become visible to that business and, where reviews are public, to other users.
  • Service providers (processors) who help us operate the Services, including:
    • Google Firebase (Authentication, Cloud Messaging, Analytics, Crashlytics, Performance Monitoring) — authentication, push delivery, analytics, and diagnostics.
    • Apple — Sign in with Apple and push notification delivery (APNs).
    • Amazon Web Services (AWS) — cloud hosting and storage (primary region: Israel, il‑central‑1).
    • Cloudflare — content delivery, DNS, and security.
    • MongoDB Atlas — database hosting for certain platform data.
  • Legal and safety: where required by law, legal process, or to protect the rights, property, or safety of Dorak, our users, or the public.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Our processors act on our instructions and are bound to protect your information.

6. International data transfers

The Operator is based in Israel and primarily stores data in AWS's Israel region. Some processors (such as Google Firebase, Apple, and MongoDB Atlas) may process data outside Israel, including in the European Union and the United States. Where data leaves the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision (Israel benefits from an EU adequacy decision).

7. Data retention

We keep your personal information for as long as your account is active and as needed to provide the Services. After you delete your account, we delete or anonymize your personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Aggregated or anonymized analytics data that can no longer identify you may be retained indefinitely.

8. Your rights

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you;
  • Correct inaccurate or incomplete information;
  • Delete your information ("right to be forgotten");
  • Object to or restrict certain processing;
  • Withdraw consent at any time (e.g. disable location or notifications);
  • Data portability — receive your data in a structured, commonly used format;
  • Lodge a complaint with a supervisory authority (in Israel, the Privacy Protection Authority).

To exercise any of these rights, contact us at support@dorak-appointments.com. We will respond within the timeframes required by applicable law.

9. Security

We use technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS), secure credential storage on your device (OS keychain/keystore), authentication tokens managed by Firebase, and access controls on our backend systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data stored on your device

The app stores some information locally on your device to function properly, including your language preference, last searched location, saved location names, notification opt‑in preference, and authentication tokens (in secure, OS‑protected storage). This information is removed from secure storage when you sign out.

11. Children's privacy

The Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12. Third‑party services and links

The Services rely on third parties (such as Google and Apple) and may link to external sites or services we do not control. Their handling of your information is governed by their own privacy policies. We encourage you to review them.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Services. Your continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.

14. Contact us

If you have questions, requests, or concerns about this Policy or your personal information, contact us at:

Email: support@dorak-appointments.com Operator: Deyaa Hojerat, sole proprietor (Osek), Israel

This Privacy Policy is provided in English, Hebrew, and Arabic. In the event of any conflict or inconsistency between versions, the English version prevails.