1. Who we are
Slate ("we") operates a cloud system for issuing invoices, receipts and VAT reports for freelancers and businesses in Israel, at app.slate.co.il. This policy describes what information is collected as part of using the service, what it's used for, and where it goes. For privacy questions, you can reach us through the contact page. The service is intended for users aged 18 and over, and we do not knowingly collect information about minors. This policy complements the terms of use.
2. What information we collect
| Category | Details |
|---|---|
| Account details | Email address (for passwordless verification and login) |
| Business details | Business name, business type, dealer/company number, phone, address, city, logo |
| Your customers | Information you enter about your customers - name, ID/company number, phone, email, address. You are responsible to your own customers for this data |
| Documents and expenses | Invoices, receipts, reports and expenses you produce or enter, including amounts, payment details, and files you upload (e.g. receipt photos) |
| Technical information | IP address (for security and rate-limiting), activity and error logs |
| Location (optional) | If you allow it in the browser, GPS location is used to auto-fill an address at signup - see section 4 |
You are under no legal obligation to give us information, but without the details marked as required we cannot run the service or issue documents that meet legal requirements. The information is held in our database and used only for the purposes listed in section 3.
For information about your customers, the database is yours: you decide what to enter and for what purpose, and you are responsible for having a lawful basis to hold it. Slate holds and processes that information for you and only on your instructions, as part of providing the service, and makes no independent use of it. A request from one of your customers about their information will be referred to you.
3. What we use the information for
- Providing the service - issuing documents, managing customers and expenses, VAT reports.
- Identity verification and secure login (a one-time email code or Google sign-in).
- Meeting regulatory obligations - retaining fiscal documents as the law requires, and requesting allocation numbers from the Tax Authority when required.
- Running AI features at your request - see section 5.
- Securing the system and preventing misuse.
- Operational messages about your account and the service, and marketing email only after you explicitly agree to it, with an unsubscribe link in every message.
We do not sell personal information, do not pass it to advertisers, and do not make automated decisions that have a legal effect on you.
4. Third parties and data processors
We rely on the following providers, to whom data may pass as part of running the service:
| Provider | Purpose | Data shared |
|---|---|---|
| Hosting provider | Server and application hosting | All system traffic |
| Managed database provider | Storage of system data | All system data |
| Resend | Sending emails (verification codes, updates) | Your email address and the message content |
| Google (Sign in with Google) | Login/signup | Email address and Google identity, when choosing Google sign-in |
| AI providers (Anthropic / Google) | AI features - receipt scanning, books assistant, document drafting | The content you send for processing (a receipt photo, a question, free text) - only while using the feature |
| Google Cloud Vision | Reading the text on a receipt photo before the details are extracted | The receipt photo you upload, while using receipt scanning |
| Israel Tax Authority | Requesting allocation numbers (Israel Invoice) | Details of tax invoices subject to the allocation requirement, when the account is connected |
| Payment processor | Collecting payment, if and when a paid service is offered. The service is free today and nothing is charged | Transaction details; credit card details are provided directly to the payment processor and are not stored by us |
| OpenStreetMap / Nominatim | Converting location to an address (geocoding) | GPS coordinates, when using automatic address fill |
Some of these providers are located outside Israel, so data may be transferred and stored abroad. We work to ensure these transfers meet legal requirements.
5. Artificial intelligence features
The system's AI features operate only at your initiative: content is sent to the AI provider only when you activate a feature (uploading a receipt photo, asking a question, requesting a draft). The result is always a draft requiring your approval - no AI output is saved as a document, expense, or message without your explicit approval. We do not use your content to train models.
In receipt scanning, the photo may first go through text recognition (OCR) in Google Cloud Vision, and only the recognized text is sent to the model that extracts the expense details.
6. Cookies
We use an essential session cookie to keep you logged in (an httpOnly cookie). Google's login service may set its own cookies. On the marketing site and in the app we also use an analytics cookie (Google Analytics) to understand usage. It loads on your first visit, and the notice at the bottom of the screen tells you so. To stop this collection, click "Decline" in that notice, block cookies for this site in your browser settings, or install the Google Analytics opt-out add-on. We do not use advertising cookies.
7. How long information is retained
- Fiscal documents (invoices, receipts, credit notes) - retained as the law requires (7 years), and cannot be deleted before then, even after the account is closed.
- Non-fiscal information (e.g. a customer card with no documents) - retained as long as the account is active, and can be deleted at your request.
- Security logs - retained for a limited period, for security purposes only.
- After an account is closed - you have 30 days to download your data and documents, including an Open Format export. After that, non-fiscal information is deleted, and fiscal documents are kept until the retention requirement ends.
8. Your rights
Subject to applicable law, you have the following rights regarding your personal information:
- The right to review information collected about you.
- The right to correct inaccurate information.
- The right to delete information (except information we are legally required to retain).
- The right to receive a copy of your information (portability).
- The right to object to certain processing.
To exercise a right, contact us. We will respond within the period set by law.
9. Information security
We take measures to protect information, including: traffic encryption (HTTPS), full separation between different customers' data at the server level, passwordless authentication, digital signing of fiscal documents, encryption of sensitive secrets in the database (AES-256-GCM), and access restriction. No measure provides absolute security, but we work continuously to reduce risk. More detail on the security page.
To handle a support request or an incident, an authorized member of our team may view your account. Viewing is read-only, time-limited and recorded in an activity log, and does not allow issuing, editing or deleting documents on your behalf.
If we become aware of a serious security incident affecting your information, we will notify you and the relevant authorities as the law requires, and explain what happened and what we did about it.
10. Changes to this policy
We will update this policy from time to time. The current version will be published on this page with the update date, and a material change will be announced 30 days in advance.
11. Contact
For privacy questions: get in touch.