The data you enter into BTU is the heart of your business. This policy explains transparently what information is collected, how it is secured, who processes it — and what rights you have under the Israeli Protection of Privacy Law, 5741-1981, including Amendment No. 13.
1.1. This policy applies to the btu.917.co.il website and to the BTU system (together: "the Service"), and it forms an integral part of the Terms of Use.
1.2. This policy is drafted in accordance with the Israeli Protection of Privacy Law, 5741-1981, and the regulations enacted under it — including the Protection of Privacy Regulations (Data Security), 5777-2017 — and takes into account Amendment No. 13 to the Law, which came into force in August 2025.
1.3. The Service involves two types of data subjects: the account holder (the installer or the business that registered for the Service) and data subjects whose details the account holder enters — their customers and employees. With respect to the information entered by the account holder, the account holder is the controller of the database and is responsible for the lawfulness of its collection, and BTU acts on their behalf as a holder and processor of the information for the sole purpose of operating the Service.
1.4. Providing information to the Service depends on the user's own will and consent; it is not an obligation under law, but it is required in order to receive the Service.
Signing in to the Service is performed using a Google account. For the sign-in itself we receive from Google only the user's name and email address. We do not receive the password of the Google account, and we have no access to the user's mailbox (Gmail), to Google Drive, to their contacts or to their files. Connecting Google Calendar is a separate and optional permission: it is not part of the sign-in, it is not required in order to use the Service, and it is granted only if the account holder initiates it and approves it separately — full details in Section 3 below.
Any information the account holder chooses to enter for the purpose of managing their business: customer details, addresses and contacts, plans and documents, projects and designs, equipment files, service calls, contracts, quotes, price lists, employee and technician data, expenses and financial data.
Technical data collected automatically for operation, security and troubleshooting: records of sign-ins and of actions in the system (activity log), IP address, browser and device type, timestamps and error logs. This data serves us for securing the system and improving the Service, and it is not sold and not used for advertising.
If — and only if — the account holder connects Google Calendar in the settings on their own initiative, we receive access to the calendar they selected for the purpose of two-way synchronization of events. Full details — which permissions are requested, what is stored, what is not stored and how to disconnect — appear in Section 3 below.
3.1. The connection is entirely optional. BTU operates in full also without a connection to Google Calendar, and all of the system's capabilities are available without it. Access to the calendar is opened only after the account holder chooses, on their own initiative, in the settings screen ("Calendar, holidays and weather"), to click "Connect your Google Calendar" and approves the permissions on Google's consent screen. The connection is available to the account holder only and applies only to their own Google account.
3.2. Which permissions (scopes) we request and what each one enables:
Both permissions are used solely for the calendar synchronization described here. We do not request permissions broader than what is required for this purpose.
3.3. What we actually store:
3.4. What we do not collect and do not store:
3.5. Storage of the tokens and their protection. The tokens are stored in a dedicated table on the server (gcal_accounts), separately from the user's settings, and they serve solely the synchronization process that runs on the server. The tokens are not returned to the client (the browser) in any screen and in any API call of the system, are not displayed in the interface and are not included in data exports. All communication with Google is encrypted with TLS, access to the database is restricted and monitored, and the backups are stored encrypted — as detailed in the data security section of this policy.
3.6. Sharing, advertising and model training. Google Calendar data serves solely to operate the synchronization for you, as described above. We do not sell it, we do not share it with any third party (other than Google itself, which is the other side of the synchronization), we do not use it for advertising, for profiling or for marketing, and we do not use it — and do not permit others to use it — for training artificial intelligence models. Calendar data is not sent to the artificial intelligence providers mentioned in the data processors section. Human access to calendar data does not take place, other than where you have expressly requested it for the purpose of support, where it is required for the security of the system or for troubleshooting, or where it is required under law.
3.7. Disconnecting, revoking the permission, and what is deleted:
3.8. Limited Use statement. BTU's use of information received from Google APIs, and any transfer of such information to another application, will comply with the Google API Services User Data Policy — including the Limited Use requirements. This is the wording of the statement:
BTU's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google's full policy: https://developers.google.com/terms/api-services-user-data-policy
The information is processed for the following purposes only: providing and operating the Service; identification and sign-in; billing and collection; support and customer service; data security and fraud prevention; compliance with obligations under law; Google Calendar synchronization — solely for an account holder who connected their calendar on their own initiative, as detailed in Section 3; and improving the Service on the basis of operational data. We do not sell personal information and we do not disclose it to third parties for marketing purposes.
The system is built on a multi-tenant architecture with complete isolation at the data level: every record is associated with the business to which it belongs, and every access to data is checked against the identity of the signed-in business. One business cannot view, search or reach in any way the data of another business — and neither can its employees, in accordance with the permissions defined by the account holder.
We implement the security measures required under the Protection of Privacy Regulations (Data Security), 5777-2017, in accordance with the security level applicable to the database. In the event of a serious security incident we will act in accordance with the reporting obligations under law, including reporting to the Israeli Privacy Protection Authority and notifying data subjects to the extent required.
The Service uses essential cookies only — session cookies required for identifying the signed-in user and for securing the account. We do not use advertising, tracking or profiling cookies of third parties. Blocking cookies in the browser may prevent signing in to the Service.
For the purpose of operating the Service we make use of external providers that process information on our behalf, to the minimum extent required and under security and confidentiality obligations:
| Provider | Role | What information |
|---|---|---|
| Sign-in service (OAuth) | Name and email address, for identification only | |
| Google Calendar | Two-way calendar synchronization — optional, only if the account holder connected their calendar on their own initiative | The synchronized calendar events (title, time, location, description), the identifiers of the events and the access tokens for the calendar that was selected; full details in Section 3 |
| PayPlus | Payment processing | The payment details are provided directly to PayPlus; credit card details are not stored on BTU's servers |
| Artificial intelligence (AI) providers | Analysis of documents that the user uploads on their own initiative (for example a photograph of an invoice or of a plan) | The content of the document is transferred for processing solely for the purpose of extracting the data, and is not used by the provider for training models, under the terms of our engagement with it |
| WhatsApp / Meta | Sending updates to the user's customers (such as "the technician is on the way") | Telephone number and the content of the message that is sent; the use is subject to Meta's privacy policy |
| Cloud storage and infrastructure providers | Hosting the system and backups | System data in a secure and encrypted environment |
Beyond this, personal information will be disclosed to a third party only where this is required under law, under a judicial order or at the demand of a competent authority, or in order to protect our rights in a legal dispute.
9.1. Under the Protection of Privacy Law, a data subject has, among others, the following rights:
9.2. How to exercise them: by email to [email protected], together with details enabling identification. We will handle the request and reply within the period prescribed by law.
9.3. A customer or an employee of an account holder who wishes to exercise rights with respect to information that was entered by that business — is welcome to approach the business directly (the controller of the information) or to approach us, and we will assist in coordinating with it.
9.4. A data subject who believes that their rights have been infringed may also approach the Israeli Privacy Protection Authority.
10.1. The information is retained for as long as the account exists. Upon cancellation of a subscription the account moves to a read-only state and the data is not deleted — so that the business does not lose its history, and so that it can be returned to at any time.
10.2. The account holder is entitled to export their data from the system in commonly used formats, at any time — including in the read-only state.
10.3. A request for complete deletion of the account and its data will be honored subject to law; information that we are obliged to retain under law (such as billing records and invoices) will be retained only for the period required, and thereafter will be deleted or anonymized.
10.4. Technical logs are retained for a limited period required for security and operational purposes, and are deleted or anonymized thereafter.
10.5. Google Calendar connection data — the refresh token, the access token, the syncToken, the details of the connected calendar and the link records between the events — is deleted from our server immediately upon disconnection of the calendar by the account holder, even if the account itself continues to exist, as detailed in Section 3.7.
Some of our infrastructure and processing providers operate outside Israel. Such transfer of information is carried out in accordance with the Protection of Privacy Regulations (Transfer of Information to Databases Abroad), 5761-2001 — including transfer to countries that ensure an adequate level of protection or under appropriate contractual undertakings by the provider.
The Service is intended for business use and is not directed at minors under the age of 18. We do not knowingly collect information about minors as users of the Service.
We may update this policy from time to time, including following changes in legislation or changes in the Service. Notice of a material change will be given within the system or by email, a reasonable time before it takes effect. The updated and binding version will always be published on this page, stating the date of the update.
For any question, request or enquiry on the subject of privacy and personal information you may contact us by email: [email protected].
BTU