Privacy Policy

This Privacy Policy explains how Fatoora ("we", "us", "the app") collects, uses, and protects information when you use our invoicing application and website at fatoora.dev.

Fatoora is operated by Haitham Slaibi, a licensed dealer (עוסק מורשה) no. 208966788, 52 Shuafat Road, Jerusalem, Israel. Questions about this policy, or about your data, go to mail@fatoora.dev.

1. Information we collect

• Account information — your name, email address, phone number, and password (stored only as a secure one-way hash).
• Business information — your business name, tax/registration ID, address, and logo.
• Invoicing data you enter — customers, invoices, line items, and payment status. This is your business data, stored on your behalf.
• Usage & device data — basic technical information needed to operate the service securely (e.g. session tokens, request logs).

2. How we use it

• To provide the invoicing service and generate tax invoices with Tax Authority allocation numbers.
• To verify your identity at sign-up, at every sign-in, and at password reset, via a one-time code sent by SMS or WhatsApp to the phone number on your account.
• To process your subscription and keep your account active.
• To secure the service and comply with legal and tax record-keeping obligations.

3. Payments

Every subscription is purchased in the mobile app and processed by Apple App Store or Google Play under their terms. We never receive your card details — there is no other way to pay for Fatoora, no card form anywhere in the product, and no card number ever reaches our servers.

4. Sharing with third parties

We do not sell your data. We share information only with service providers that help us run the app, and only as needed:

• Apple & Google — in-app subscription billing.
• SMS delivery provider (019) — delivery of verification codes and account notices; receives your phone number and the message.
• Meta / WhatsApp — an alternative channel for the same codes.
• AWS (Amazon Web Services), Tel Aviv region — secure hosting, database and backups, in Israel.
• Israel Tax Authority — allocation-number requests required to issue compliant invoices.

5. Data you keep about your customers

The invoices, receipts and other documents you issue name your own customers. That is your data about your customers, not ours — you decide why it is collected and what it is used for. Fatoora holds it on your behalf, as a holder (מחזיק) under the Privacy Protection Law, 5741-1981, and the Privacy Protection (Data Security) Regulations, 5777-2017, regulation 15 (outsourcing). You remain the owner of this database (בעל מסד הנתונים) at all times.

• Which data — your customers' names, ID numbers or VAT/company numbers, contact details, addresses, and the documents issued to them.
• Purpose — solely to issue and keep your business's invoices, receipts and related documents. Not for advertising, profiling, or any purpose of our own.
• Security — the same measures as section 10 below: encryption in transit, encrypted backups, credentials stored only as hashes, and access controls.
• Confidentiality — this data is not read, used, or disclosed except to provide the Service to you, or where the law requires it.

To provide the Service, this data passes through the following sub-processors:

If you close your account, this data is returned to you on request and then deleted with the rest of your books, subject to the seven-year retention in section 8. If a security incident affects this data, we will notify you.

6. Transfer of data abroad

Your books — invoices, receipts, and customer records — and their backups stay in Israel without exception (section 7). A narrower set of data leaves Israel, only as needed to provide a feature you chose to use:

• Apple and Google receive what is needed to bill and manage your own Fatoora subscription.
• Meta/WhatsApp receives a phone number and a one-time code when WhatsApp is chosen as a sign-in channel.

These transfers rest on your consent to use those features, and on each provider's own terms with its users. No invoice, receipt, or customer record is ever included in them.

7. Backups

Backups are encrypted and, like your books, stay in Israel — on the server itself and in AWS's Tel Aviv region storage. We keep daily backups for approximately 60 days, monthly backups for up to 8 years, and the signed documents themselves (invoices, receipts, credit notes) for the full retention period described in section 8.

8. Data storage & retention

Data is stored on servers located in Israel. Because Fatoora issues tax documents, some of it must be kept even after you ask us to delete your account — Israeli bookkeeping rules set the minimum, not us. What is kept, and for how long:

• Invoices and receipts, your business record, and the customers named on them — seven years from the end of the relevant tax year.
• A sealed record of who the account belonged to — your name, contact details and business number, kept for the same seven years alongside those documents so the Tax Authority can be told whose they are. It is reachable only by our administrators, never through the app.
• Subscription and payment records — for the period tax and accounting law requires.
• Sign-in and security logs — twelve months, as the Tax Authority requires of invoicing software, then deleted automatically.

These periods run on a date, not on a request: when they expire the records are deleted whether or not you ask.

9. Your rights

You may access, correct, or request deletion of your personal data, subject to the retention periods in section 8. To exercise these rights, email mail@fatoora.dev.

Closing your account does not take effect immediately: it is scheduled for the end of the calendar month in which you ask, nothing changes before then, and you can withdraw the request at any point until it happens. When it does, your login, name, email address and phone number are erased and every device is signed out — but the records listed in section 8, including the sealed identity record, are kept for their full period.

Full detail, and how to ask, is on the account deletion page.

10. Security

We protect your data with encryption in transit (HTTPS), passwords and verification codes stored only as salted hashes, encrypted storage of access credentials, two-factor authentication on sign-in, an optional biometric app lock, encrypted backups (section 7), and access controls. No method of transmission or storage is 100% secure, but we work to protect your information.

11. Children

Fatoora is a business tool and is not directed to children. You must be at least 18 years old to create an account.

12. Changes

We may update this policy from time to time. Material changes are announced in the app, and we will update the "Last updated" date above.

13. Contact

Questions about this policy? Email mail@fatoora.dev. See also the account deletion page.