Privacy policy

Last updated: 23/10/2026

The operator's details will be completed soon; the binding wording is the one published together with the full details

What personal data the Service collects, for what purpose, who receives it, where and for how long it is kept, how it is secured, and your rights under the Protection of Privacy Law, 5741-1981. The Hebrew version is the governing text.

Teaching is operated by (company details - to be published soon) (company number (company number - to be published soon), (address - to be published soon)), the "Company". The contact for privacy matters: (email address - to be published soon).

For the account details of the teacher and the Scheduler, the billing data, the support chat and the Portal data, the Company is the controller of the database as defined in the Protection of Privacy Law, 5741-1981 (the "Law"). For the data about students, parents and school teachers that a teacher or a school enters, the teacher or the school is the controller, and the Company is a holder that processes the data for them and on their instructions only.

You are under no legal duty to give us data; giving it depends on your wish and consent. Without an email address and a password (or sign-in with Google) an account cannot be opened, and without a payment means a paid plan cannot be used; searching for teachers in the Portal is possible without giving identifying details.

The data is used for the purposes set out in the section "Why we use the data", and is given only to those listed in the section "Holders and sub-processors". You have the right of access under section 13 of the Law and the right of correction and deletion under section 14 of the Law, as set out in the section "Your rights".

The data is collected according to your role in the Service:

  • Private teacher: email address, display name, language, password (stored hashed only), a Google identifier if you sign in with Google, rates and message templates, subscription and billing data (plan, status, statements, payment token, last four digits, card type and expiry), notification settings and the consent to marketing, and technical sign-in data (browser type, and a hashed device fingerprint identifying the sign-in).
  • Students and parents (entered by the teacher): the student's name, the parent's name, phone and email, class, a lesson price if set, the language of messages, the lessons, debts and payments. In the studio module also: bookings, make-up tokens, packages, payment declarations, and the name, time and network address of a signature on the teacher's terms (as evidence of consent). In the student area a hash of the personal link is kept, not the link itself.
  • A person asking to join through a teacher's join link: the student's name, the parent's name, phone, email, the subject and level wanted and convenient days.
  • School: the school's name, the timetable and classes, the details of the school teachers the Scheduler enters (name, email, phone, subjects, classes), the constraints they write in free text, absences, substitutions and substitution reports, and the log of messages sent to them.
  • Public profile (only if the teacher chose to appear in the Portal): headline, description, subjects, WhatsApp number, contact email, city and photo. The exact address is kept private; only a rounded point (to about 500 metres) is used in the search.
  • Portal visitors: the address typed into the search becomes a rounded point; the point, the subject, the number of results and a hash of the browser are kept. Revealing a teacher's detail is recorded with a hash of the network address and of the browser, not their raw values.
  • Reviews: a rating, a short text and the time of writing, linked to the student record that proves a lesson really took place. On the public page the review is shown with no name and no initials. The text of a review is sent for a relevance check to the artificial-intelligence provider (see "Holders and sub-processors").
  • Support chat: the messages you wrote in the conversation, as written, for the conversation with the assistant (in the copy shown to the owner, contact details found automatically are masked), and contact details the visitor asked to leave so we can get back to them. For a signed-in teacher a short context is also sent to the model (subscription status, number of active students, open debt and the current screen), without student names.
  • Technical and security data: the network address (IP) for rate limiting, abuse prevention and the sign-in log of the owner dashboard; system logs from which passwords, tokens, cookies and card data are removed; and an audit log of actions in the account.

The data is processed for the following purposes only:

  • operating the Service and providing the features you chose, including sending the messages the Service is meant to send (lesson reminders, debts, personal links, reports);
  • billing, collection and issuing accounting documents, and meeting the record-keeping duties the law imposes;
  • support and answering enquiries, including through the automated assistant;
  • securing the Service, preventing fraud and abuse, and rate limiting;
  • complying with legal obligations, including reporting to authorities where the law requires;
  • aggregate, anonymous statistics to improve the Service;
  • marketing mail, only if the Company starts to send it in future, and even then only to those who expressly consented (see "Marketing mail").
  • The Company does not sell personal data, does not pass it to third parties for their own purposes, and does not use data about students for advertising or profiling.

The Company uses the following providers, each for a defined purpose and under an agreement that binds it to secure the data and use it for that purpose only. No provider receives data beyond what its role requires:

  • Amazon Web Services, Tel Aviv region (il-central-1): hosting of the servers, the database, the backups and the sending of email.
  • iCount: payment processing, billing and issuing of accounting documents. Card details are given to it directly on its payment page and never pass through the Company's servers; its customer record is kept under the tax laws.
  • Google Gemini: the chat assistant and the reading of constraints a school writes in free text. In the chat, the messages written in the conversation are sent as written (see "What data we collect"); in reading constraints, the text written after phone numbers, email addresses and links are masked is sent, together with the names of the school's teachers, classes and subjects. The data may be processed by Google outside Israel. The text of a review is also sent to it, for a relevance check only.
  • Cloudflare Turnstile: a check that tells a person from software in the Portal search, the public chat and the join form. The provider receives the network address and browser data.
  • An address service (Google Geocoding or OpenStreetMap Nominatim, as configured): the address typed into the search or the profile is sent to it to turn it into a geographic point.
  • Google Fonts (the Heebo font) and OpenFreeMap (the map tiles): when a page loads the browser contacts them directly and your network address is exposed to them.
  • Google AdSense / Ad Manager: only if the owner enabled a rewarded advertisement in the Portal. The advertisement loads only after you chose to watch it, and Google may set cookies of its own.
  • WhatsApp: pressing a WhatsApp button opens the application; from that moment WhatsApp's privacy policy applies.

The data is stored in the database and backups of Amazon Web Services in the Tel Aviv region, in Israel. Some of the providers listed above, mainly Google services and Cloudflare, may process the data sent to them outside Israel. Such a transfer is made only to the extent needed for the stated purpose, subject to the law governing the transfer of data outside Israel, and under an agreement binding the provider to the level of protection the law requires. The details of students and parents entered in the App are not sent to artificial-intelligence models; what is sent to them is set out in the section "Holders and sub-processors".

The data is kept only as long as it is needed for the purpose it was collected for, or for the period the law requires. The main periods:

  • The account details and business data of the teacher or school: as long as the account exists, and 30 more days after a deletion request, after which they are erased. If at the time of deletion there is a month not yet billed or a debt in collection, the erasure may be delayed until collection ends, and no longer than 60 additional days.
  • Accounting documents and billing records: kept for the period the law requires, with the identifying details in them replaced by an anonymous record after the account is deleted.
  • Text of support chat conversations: 90 days.
  • Contact details a visitor left in the chat: 365 days.
  • Portal searches: 90 days.
  • Sign-in: the sign-in is kept for up to 30 days and is deleted on sign-out; expired or revoked sign-in records, used one-time links and rate-limit records are deleted in a periodic sweep.
  • Network addresses: the sign-in log of the owner dashboard, which holds the network address of every attempt, is kept for 90 days; rate-limit records are deleted in a periodic sweep, and reveals and searches in the Portal are kept as a hash only, as stated above.
  • Join requests the teacher has finished handling, address and browser hashes of reveals in the Portal, the shared address cache, the content of closed incidents, and the payment provider's notices: deleted or emptied in a periodic sweep according to the period set in the system's code for each of them.
  • Backups: erased data may remain in the hosting backups until they rotate in the normal cycle, and is used in that period for nothing but restoration.

Right of access (section 13 of the Law): you are entitled to inspect the personal data about you that we hold. A teacher and a Scheduler see and update the data on the App's screens and can export all of it at any time, even when the account is locked. Any other access request is made in writing to (email address - to be published soon) and is answered within 30 days of receipt, as set by the Protection of Privacy Regulations (Conditions for Inspecting Data and Procedure for Appealing a Refusal), 5741-1981; a refusal, if any, is given in writing with its reasons.

Right of correction and deletion (section 14 of the Law): data that is not correct, complete, clear or up to date can be corrected on the App's screens or by writing to us. You can delete the account yourself on the "More" screen under "Delete account" (for a private teacher and for a school Scheduler alike): the account is locked at once, and after 30 days the data is erased (or later if a month not yet billed or a debt in collection remains, and no longer than 60 additional days), except records the law requires to be kept, from which the identifying details are removed.

A person whose data was entered by a teacher or a school (a student, a parent, a school teacher) should apply to the teacher or the school, who are the controllers of the data; you can also write to us at (email address - to be published soon) and we will pass the request on and help with the answer. A person who left contact details in the chat or asked to join a teacher may ask us to delete them.

If you believe we infringed your privacy or did not answer your request, you have the right to lodge a complaint with the Privacy Protection Authority, and to apply to the courts under any law.

We use only cookies that are essential to operating and securing the Service, and no tracking, analytics or advertising cookies of our own; this is why no cookie consent banner is shown. The cookies:

  • Sign-in and security of a teacher and a Scheduler: teaching_at, teaching_rt, teaching_csrf, and teaching_oauth when signing in with Google.
  • A school teacher on a personal link: teaching_member and teaching_member_csrf.
  • The owner dashboard (the owner only, on signing in to the dashboard): teaching_admin, teaching_admin_csrf, teaching_admin_challenge, teaching_admin_unlock, and teaching_admin_drive (a short-lived cookie while the owner connects a backup drive).
  • Support chat: teaching_support, a random conversation identifier.
  • Local browser storage (not sent to us): the theme, the language, the accessibility settings (text size, contrast, link highlighting and stopped animations), and the dismissal of the install banner; in the tab only: the reveal state in the Portal. It can be cleared in the browser settings.
  • Third parties: Cloudflare Turnstile and a Google advertisement (if enabled) may set cookies of their own under their policies; they are not under our control.

To know how many visitors the public Portal pages have and which pages lead to registration, the Service counts page views, clicks on sign-up links and completed registrations. The count is made without cookies and without a persistent identifier: no network address, browser identification, referring page address or account identifier is stored; only a general class of the visit's origin is kept (direct, search engine, social network, other or an internal page of the site). A visitor is represented by a hash of the network address and the browser together with a random value that changes every day and is deleted shortly after, so that no person can be reconstructed from it and no days can be linked. The records are deleted automatically at the end of a fixed period, and serve aggregate counts only.

The Company does not currently send advertisements by email, only operational and legally required notices (address verification, password reset, charges, access, personal links and reports), which are not advertisements. If the Company starts to send advertisements, it will send them only to those who consented expressly and in advance, in a separate checkbox that is not pre-ticked, in accordance with section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982; every advertisement will be marked with the word "advertisement" at the start of the subject and will include a simple way to unsubscribe. Consent may be withdrawn at any time through the unsubscribe link, in the account settings or by writing to (email address - to be published soon). We record the time of the consent, the wording shown and its source, and we stop sending to an address that reported the messages as spam or to which messages bounce.

The Company applies the security duties of section 17 of the Law and of the Protection of Privacy Regulations (Data Security), 5777-2017, at the security level that applies to its databases under the Regulations, among them: encryption of communications (HTTPS); storing passwords as hashes only; separation of each teacher's and school's data at the database level, so that one account cannot read another's data; access rights narrowed by role; two-step verification for the owner dashboard; removal of passwords, tokens and card data from the system logs; an audit log of actions; backups; and agreements with sub-processors under regulation 15 of the Regulations.

No system is entirely immune. In a serious security incident, as defined in the Regulations, we report to the Privacy Protection Authority at once as required, notify the controllers whose data was affected, and notify the data subjects when the Authority so directs or when needed to reduce the harm.

Data about students who are minors is entered by the teacher or the school and on their responsibility, including obtaining the parent's consent to its use and to the sending of messages. The Company does not approach minors, does not show them targeted advertising and does not collect data from them directly, except an anonymous search in the Portal and use of the student area through a personal link given by the teacher. An account in the Service is opened only by a person who is at least 18 years old; a student who is a minor is entered by an adult, and the Service does not verify age.

We update this policy when the Service, the providers or the law change. The updated text is published on this page with the date of the update, and a material change in the purposes of processing or in the recipients of the data is also notified to account holders by a notice in the Service or by email before it takes effect.

For questions, exercising your rights and reporting a suspected breach of privacy: (email address - to be published soon), or by post to (company details - to be published soon), (address - to be published soon). We answer promptly and within the time limits the law sets.