Privacy policy
Last updated: July 2026
1. Who we are
Slate ("we") operates a cloud system for issuing invoices, receipts and VAT reports for freelancers and businesses in Israel, at app.slate.co.il. This policy describes what information is collected as part of using the service, what it's used for, and where it goes. For privacy questions, you can reach us through the contact page.
2. What information we collect
| Category | Details |
|---|---|
| Account details | Email address (for passwordless verification and login) |
| Business details | Business name, business type, dealer/company number, phone, address, city, logo |
| Your customers | Information you enter about your customers - name, ID/company number, phone, email, address. You are responsible for this data toward your own customers |
| Documents and expenses | Invoices, receipts, reports and expenses you produce or enter, including amounts, payment details, and files you upload (e.g. receipt photos) |
| Technical information | IP address (for security and rate-limiting), activity and error logs |
| Location (optional) | If you allow it in the browser, GPS location is used to auto-fill an address at signup - see section 4 |
3. What we use the information for
- Providing the service - issuing documents, managing customers and expenses, VAT reports.
- Identity verification and secure login (a one-time email code or Google sign-in).
- Meeting regulatory obligations - retaining fiscal documents as the law requires, and requesting allocation numbers from the Tax Authority when required.
- Running AI features at your request - see section 5.
- Securing the system and preventing misuse.
4. Third parties and data processors
We rely on the following providers, to whom data may pass as part of running the service:
| Provider | Purpose | Data shared |
|---|---|---|
| Railway | Server and application hosting | All system traffic |
| Supabase | Database storage | All system data |
| Resend | Sending emails (verification codes, updates) | Your email address and the message content |
| Google (Sign in with Google) | Login/signup | Email address and Google identity, when choosing Google sign-in |
| AI providers (Anthropic / Google) | AI features - receipt scanning, books assistant, document drafting | The content you send for processing (a receipt photo, a question, free text) - only while using the feature |
| Israel Tax Authority | Requesting allocation numbers (Israel Invoice) | Details of tax invoices subject to the allocation requirement, when the account is connected |
| Payment processor | Collecting subscription fees | Transaction details; credit card details are provided directly to the payment processor and are not stored by us |
| OpenStreetMap / Nominatim | Converting location to an address (geocoding) | GPS coordinates, when using automatic address fill |
Some of these providers are located outside Israel, so data may be transferred and stored abroad (the database is hosted in the European Union). We work to ensure these transfers meet legal requirements.
5. Artificial intelligence features
The system's AI features operate only at your initiative: content is sent to the AI provider only when you activate a feature (uploading a receipt photo, asking a question, requesting a draft). The result is always a draft requiring your approval - no AI output is saved as a document, expense, or message without your explicit approval. We do not use your content to train models.
6. Cookies
We use an essential session cookie to keep you logged in (an httpOnly cookie). Google's login service may set its own cookies. On the marketing site we also use an analytics cookie (Google Analytics) to understand usage. We do not use advertising cookies.
7. How long information is retained
- Fiscal documents (invoices, receipts, credit notes) - retained as the law requires (7 years), and cannot be deleted before then, even after the account is closed.
- Non-fiscal information (e.g. a customer card with no documents) - retained as long as the account is active, and can be deleted at your request.
- Security logs - retained for a limited period, for security purposes only.
8. Your rights
Subject to applicable law, you have the following rights regarding your personal information:
- The right to review information collected about you.
- The right to correct inaccurate information.
- The right to delete information (except information we are legally required to retain).
- The right to receive a copy of your information (portability).
- The right to object to certain processing.
To exercise a right, contact us. We will respond within the period set by law.
9. Information security
We take measures to protect information, including: traffic encryption (HTTPS), full separation between different customers' data at the server level, passwordless authentication, digital signing of fiscal documents, encryption of sensitive secrets in the database (AES-256-GCM), and access restriction. No measure provides absolute security, but we work continuously to reduce risk. More detail on the security page.
10. Changes to this policy
We will update this policy from time to time. The current version will be published on this page with the update date, and a material change will be brought to your attention.
11. Contact
For privacy questions: get in touch.