Privacy policy

Cyshel Creative Ltd, Gartziani 6, Tel Aviv, Israel, is the controller of the personal data collected across its services ("we", "us").

One exception concerns Looks: appointment books and client lists that a studio manages in Looks belong to that studio, and the studio is responsible for them. We process that data on the studio's behalf and under its instructions.

For everything else, we decide how data is collected and what it is used for.

For any privacy question or request, contact us at legal@cyshel.com or by post at Gartziani 6, Tel Aviv, Israel.

Account data comes from your Google or Apple sign-in or from your phone number: your name, email address and phone number. Booking data covers appointments, treatments, deposits and payment status; full card numbers go directly to Tranzila and never reach us.

A studio using Looks enters data about its clients: names, phone numbers, treatment notes and photos. We also store content that you upload to the services.

In Lineapp we process approximate location only if you turn location sharing on, and it is not kept. Device, usage and crash data is collected to operate the services; on services that show the cookie banner, analytics data is collected only per your consent choices.

We process data to provide the services you asked for, including managing accounts, appointments and payments. The basis for this is the performance of our contract with you.

Securing the services, diagnosing faults and preventing abuse rest on our legitimate interest in reliable operation. On services that show the cookie banner, usage analytics and marketing measurement happen only with your consent, given through it; on services the banner has not reached yet, basic usage measurement and advertising measurement rest on our legitimate interest in understanding how the services are used and how our advertising performs, and the Cookie Policy lists the ways to limit them.

We also process data to meet legal duties, including keeping tax and billing records.

Our processing is governed by the Israeli Protection of Privacy Law 5741-1981, including Amendment 13, in force since August 2025.

The law requires notice at the point of collection, compliance with database duties, and heightened care for sensitive data, including treatment notes and photos.

The following providers process data on our behalf:

Amazon Web Services: Hosting, databases, file storage and the sign-in service (Cognito). Data is stored in the United States.

Google: Sign-in with a Google account and usage measurement (Google Analytics), per your consent choices on services that show the cookie banner.

Apple: Sign in with Apple and app distribution through the App Store.

Mixpanel: Product analytics, and in the Lineapp and Commander apps also session replay: your screen interactions in the app are recorded to diagnose faults and improve it.

Meta: Advertising measurement (pixel), per your consent choices on services that show the cookie banner.

Sentry: Error monitoring and crash reports, to operate the service.

Tranzila: Card payment processing. Card details are held by Tranzila, never by us.

A studio using Looks receives the booking data of its own clients only.

We disclose data when the law requires it, and we do not sell personal data.

Hosting and most of our processors are located in the United States (AWS).

Transfers are made under the Privacy Protection (Transfer of Data Abroad) Regulations 5761-2001, and with safeguards such as standard contractual clauses for visitors from the European Economic Area.

Account data is kept while the account is active, plus a short wind-down period after it closes.

Booking and billing records are kept for the statutory retention periods, up to seven years for tax records. Consent records are kept for 12 months.

On your request we delete data, subject to legal holds.

We protect data with encryption in transit, access controls and a managed sign-in service (AWS Cognito). Card details are vaulted at the payment processor, never with us.

No security measure is absolute, so we cannot promise complete protection. We work to reduce the risk and keep our safeguards current.

Under the Israeli Protection of Privacy Law you may inspect the data we hold about you, ask us to correct it and ask us to delete it. Visitors from the European Economic Area also have GDPR-style rights: access, rectification, erasure, restriction, portability and objection.

To exercise a right, email us at legal@cyshel.com. We may ask you to verify your identity before we handle the request.

Clients of a studio exercise rights over studio-owned records with the studio itself, and we assist it in responding.

We send marketing messages only with your prior opt-in consent, per section 30A of the Israeli Communications Law (Telecommunications and Broadcasting) 5742-1982.

Every message carries an opt-out, and you can also opt out by emailing legal@cyshel.com.

The services are not directed at children under 16. When we learn that we hold data of an underage user, we delete it.

Cookies and similar technologies are described in the Cookie Policy, including the full list and how to change your choices. The list is maintained there only.

You may lodge a complaint with the Israeli Privacy Protection Authority. Visitors from the European Economic Area may also complain to their local supervisory authority.

Updates to this policy will be posted here with a new effective date. We will notify you of material changes.