Privacy Policy

Effective date: October 24, 2026

1. Who we are and who is responsible for your data

spaceslot (the "Service") is operated by Smart HR (the "Operator", "we", "us" or "our").

This Privacy Policy explains what personal information the Service processes, why it is processed, who may receive it, how long it may be retained and how you may exercise your rights. It is intended to reflect the Israeli Protection of Privacy Law, 5741-1981, and applicable regulations, as amended from time to time.

The Service is used by businesses, clinics, studios, offices and other entities ("Organizations") to manage rooms and the people who book them.

Responsibility for personal information depends on the purpose and circumstances of the processing. For information processed in connection with an Organization's management of its members, rooms and bookings, the Organization generally determines the purposes of processing. The Operator processes that information to provide the Service and in accordance with its contractual arrangements with the Organization.

We may also process certain information for our own purposes, including account security, abuse prevention, technical operation, support and compliance with legal obligations. In those cases, we are responsible for the processing activities for which we determine the purposes and means, subject to applicable law.

The Organization that invited you may have its own privacy notice or policies describing how it uses information about you. You should review those materials where relevant.

2. Information we process

Depending on how you use the Service and how your Organization has configured it, we may process the following categories of information:

Identity and contact details - your name, email address and phone number, entered by your Organization when it invites you or by you when you complete your profile.
Membership details - the Organization or Organizations you belong to, your role, member type (for example, hourly or shift-based), hours allowance and usage, access tags that determine which rooms you can see, and whether your membership is suspended.
Bookings - the room, date and time, duration, title, status, recurrence information, and details of who requested, approved, rejected, changed or cancelled a booking.
Sign-in and technical data - one-time sign-in codes, which are valid for a limited period; session records, including your IP address and browser or device type (user agent); and IP-based request counts used for rate limiting and security.
Activity logs - records of selected actions, such as adding or removing members, changing roles or hours, and approving or cancelling bookings, including who performed the action and when.
Support and communications information - information you provide when contacting us for support, reporting an issue or communicating with the Operator.

We do not collect passwords or payment card details through the Service. We do not intentionally collect precise location data or use the Service for advertising. The Service does not process room payments; payments for room use are arranged between you and your Organization, outside the Service.

We do not intend the Service to collect patient records or other sensitive personal information that is unnecessary for room booking. Please do not enter patient names, medical details, treatment information or other sensitive personal information about another person into booking titles, room names or descriptions, closure reasons or any other field. Booking details may be visible to other members or Administrators in your Organization, depending on its settings and your permissions.

If you submit information about another person, you are responsible for ensuring that you are authorized to do so and that the submission complies with applicable law and your Organization's instructions.

3. How we use information and the basis for processing

We process information, as applicable, for the following purposes:

to create and manage accounts and enable sign-in;
to show room availability and create, manage and track bookings, approvals and hours;
to send service emails, including invitations, sign-in codes, booking confirmations, approvals, rejections and cancellations, and booking reminders where the relevant Organization has turned them on, as configured by that Organization;
to provide Organizations with reports and information about room usage;
to detect and prevent abuse, fraud, unauthorized access and security incidents;
to provide support, troubleshoot errors, maintain and improve the Service;
to maintain appropriate operational, security and audit records;
to comply with applicable laws, regulations, lawful requests and legal obligations; and
to establish, exercise or defend legal claims, where reasonably necessary and permitted by law.

The applicable legal basis and responsibility for processing depend on the particular activity, the relevant Organization's role, the Operator's role and the requirements of Israeli law. Where consent is required, it will be sought as required by law. This Policy does not treat consent as the legal basis for every processing activity.

Providing personal information is generally voluntary unless otherwise required by law. However, certain information, including your email address, is necessary to create or access your account and use the Service. If you do not provide required information, we may be unable to provide the relevant features or services.

4. Who can access or receive information

Depending on the type of information and the circumstances, it may be accessible to or shared with the following recipients:

Your Organization - its authorized Administrators and Managers may access your details, bookings, hours and activity information within that Organization, according to their permissions. Other members may see bookings in room calendars, either with full details or only as "busy", depending on the Organization's settings. The Service separates each Organization's data from every other Organization's, so one Organization cannot access another's data through it.
Our authorized personnel - a limited number of authorized personnel may access Organization Data when reasonably necessary to provide support, maintain the Service, investigate a technical problem or handle a security issue, subject to access controls and confidentiality obligations.
Service providers - we use third-party providers to host, store, maintain and operate the Service. The providers currently used for these functions are Vercel (hosting and file storage), Neon (database) and Resend (email delivery).
Professional advisers - we may disclose information to professional advisers, auditors, insurers or other service providers where reasonably necessary for legitimate business, legal, security or operational purposes, subject to applicable law and appropriate safeguards.
Legal and regulatory recipients - we may disclose information when required by law, a valid court order or a competent authority, or where disclosure is otherwise permitted or required by law to protect rights, safety or security.
Business transfers - in the event of a proposed or completed merger, acquisition, restructuring, financing or sale of all or part of the relevant business, information may be transferred to a successor or relevant transaction party, subject to applicable law and appropriate safeguards.

We do not sell personal information and do not share personal information for third-party advertising purposes.

We seek to limit access and disclosure to what is reasonably necessary for the relevant purpose. The providers and recipients may change as the Service develops. Where a change materially affects this Policy or requires notice or consent under applicable law, we will take the appropriate steps.

5. Storage and transfers outside Israel

Our service providers may store or process information on servers outside Israel, including in the European Union and the United States. The countries and locations involved may depend on the provider, the services used, the selected configuration and the location of the relevant infrastructure.

Where personal information is transferred outside Israel, we take steps intended to ensure that the transfer and subsequent processing comply with applicable Israeli law, including the Protection of Privacy Law and the regulations governing transfers of information to databases abroad. Depending on the circumstances, this may involve a permitted transfer basis, appropriate contractual commitments or other safeguards.

Information may also be processed by service providers or their subprocessors in locations outside Israel, subject to the relevant arrangements and applicable law.

6. Cookies and similar technologies

The Service uses strictly necessary cookies or similar technologies to operate essential functionality, including maintaining your sign-in session and remembering which Organization you are viewing.

We do not use advertising cookies or third-party tracking cookies.

If we introduce analytics, optional cookies or other tracking technologies in the future, we will update this Policy and provide any notices, choices or consent mechanisms required by applicable law.

7. Security

We implement technical and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration or disclosure, taking into account the nature of the Service and the information processed. These measures include:

encrypted connections using HTTPS;
separation of Organization data and access restrictions;
role-based permissions;
passwordless sign-in using time-limited one-time codes;
rate limiting and measures designed to prevent unauthorized access;
activity logs for selected sensitive actions; and
restricted administrative access for support and security purposes.

No system can be guaranteed to be completely secure. We will respond to security incidents in accordance with applicable law, including any applicable notification, reporting and remediation requirements.

Users must protect access to their email accounts and must not share sign-in codes or invitation links. If you suspect unauthorized access to your account, notify your Organization or the Operator promptly.

8. How long we retain information

We retain information for as long as reasonably necessary for the purposes described in this Policy, subject to applicable law, contractual obligations and legitimate retention requirements. Retention may depend on the type of information and the context, including:

Active membership information - while your membership or the relevant Organization's use of the Service remains active, and for a reasonable period thereafter where necessary for administration, security, dispute resolution or legal compliance.
Past bookings and activity logs - these may remain available to the relevant Organization after a User is removed, where reasonably necessary for operational records, accounting, security, audit purposes or resolving disputes, subject to applicable law and the relevant contractual arrangements.
Sign-in codes and invitation links - these expire after a short period, can no longer be used after expiry, and are deleted within a day of expiring.
Session and technical records - session records, including the IP address and browser type, are deleted 30 days after the session expires. IP-based request counts used for rate limiting are deleted after one day.
Backups - information may remain in protected backups for a limited period before being overwritten or deleted in accordance with the applicable backup cycle.
Support records - these may be retained for as long as reasonably necessary to resolve requests, maintain service history, protect rights or comply with legal obligations.

When an Organization stops using the Service, its data may be exported, deleted or retained according to the applicable agreement, the Organization's lawful instructions and the Operator's legal obligations. Data is not necessarily deleted immediately when a User is removed or an Organization's subscription ends.

9. Your rights and how to contact us

Subject to the conditions and limitations of applicable law, you may have rights to review personal information held about you and to request correction or deletion of information that is inaccurate, incomplete, unclear or out of date.

The availability and scope of these rights depend on the applicable legal provisions and the circumstances. Information may need to be retained where required or permitted by law, for example to comply with a legal obligation or establish, exercise or defend a legal claim.

For information about your membership, room bookings and hours, your Organization is usually the best first point of contact because it manages those aspects of the Service.

You may also contact the Operator at privacy@spaceslot.work. We will review your request and, where appropriate, coordinate with the relevant Organization. We may ask you to verify your identity or provide additional information reasonably necessary to process the request.

We will handle requests within the time limits and according to the procedures required by applicable law. If we are not responsible for the relevant processing, we may refer the request to the Organization or assist in coordinating the response, as appropriate.

10. Children

The Service is intended for adults aged 18 and over and is not directed at children.

If you believe a person under 18 has been granted access to the Service, please contact the Operator or the relevant Organization so the situation can be reviewed.

11. Changes to this Policy

We may update this Policy from time to time. The effective date at the top of the page indicates when it was last updated.

If a change is material, we will provide reasonable notice through the Service or by email, where practicable and appropriate.

Where a change requires consent or another procedure under applicable law, we will follow the applicable requirements. Continued use of the Service does not replace consent where separate consent is legally required.

12. Contact

For questions about this Policy or your personal information, please contact:

Smart HR
Email: privacy@spaceslot.work

Please do not include passwords, sign-in codes or unnecessary sensitive personal information in correspondence.