ZaatarLABS Get in touch →
Legal

Privacy policy.

How our apps handle your information, including optional Smart Dentist, Smart Budget, Smart Billing and Smart Coach measurement.

Effective 25 October 2026

The short version

Who this policy applies to

This policy covers all apps published by ZaatarLABS on the Apple App Store and Google Play, our web apps (such as The Smart Billing at billing.zaatarlabs.com), and the website at zaatarlabs.com. The apps currently in scope are: The Smart Dentist, The Smart Billing, The Smart Coach, roCARD, My Pizza Calculator, The Smart Hand Calculator, The Smart Trix Calculator, The Smart Budget, and The Smart Padel. Any future app we publish will collect, at most, the same categories of data described here.

ZaatarLABS is run by an independent developer based in the United Arab Emirates. Smart Dentist, The Smart Budget, The Smart Billing and The Smart Coach use the limited measurement described below to improve the apps and assess Apple Ads.

What we don't do

Where the records you create are kept

The information you enter into a ZaatarLABS app — patient records, client lists, invoices, business card details, budget transactions, calculator results, and so on — is stored in a private database on your device using Apple's Core Data. We do not have a server that holds this information. Smart Dentist for Android, The Smart Padel (from 3.0) and The Smart Billing (from 6.0) are different: their clinics, padel groups and businesses are kept on your account on our servers, as the sections for Smart Dentist for Android, The Smart Padel and The Smart Billing explain. From roCARD 2.2, we also keep a copy of a business card you add to Apple Wallet, as roCARD's section explains.

If your device is signed in to iCloud and you have iCloud sync enabled for the app, Apple's CloudKit will sync that database to your other Apple devices through your own iCloud account. ZaatarLABS has no access to your iCloud, no master copy, and no recovery key. iCloud sync is governed by Apple's Privacy Policy.

The Smart Budget additionally supports household sharing: when you opt in and invite a partner, the budget data you choose to share is exchanged through a private CloudKit Share that lives in your iCloud account. Invitations and the shared records are routed entirely through Apple's iCloud infrastructure; ZaatarLABS does not see, store, or relay any of it. You can revoke the share at any time from inside the app, which removes your partner's access immediately.

The Smart Padel up to version 2.x is built entirely on your own iCloud: groups, games, rosters, scores, chat messages and player photos live in your private CloudKit database and are shared through a private CloudKit Share, and we never see them. From version 3.0, The Smart Padel keeps your groups on your account on our servers, so iPhone and Android players can share them; when you update, the app copies your groups from your iCloud to your account. Its section explains what is stored and your choices.

The Smart Billing up to version 5.x keeps your businesses in the app and in your own iCloud, and we never see them. From version 6.0, The Smart Billing keeps each business on your account on our servers, so your devices, the web app, Android and the team you invite can use it; when you update and sign in, the app copies your businesses from your iCloud to your account. Its section explains what is stored and your choices.

The network calls our apps make

To be transparent, here is every network request a ZaatarLABS app may make, and why.

1. First-launch ping

When you launch one of our apps for the first time on a device, the app sends a single one-time message to a ZaatarLABS first-launch service. The message contains: Apple's vendor identifier (it is not your Apple ID, but can distinguish a device across apps from the same vendor), a randomly generated install ID, the bundle identifier, the app version and build number, the iOS version, the device model (e.g. "iPhone16,2"), the device locale (e.g. "en_AE"), and the timezone.

We use this so we have a rough sense of how many active installs each app has and which iOS versions to keep supporting. Nothing you enter into the app is included, and the message is not sent again on later launches. The Smart Hand Calculator sends this to zaatarlabs.com/api/first-launch; Smart Dentist 5.0.1, The Smart Budget, The Smart Billing 5.0 and The Smart Coach (from 3.0) send it to services.zaatarlabs.com/api/first-launch (their earlier versions use billing.zaatarlabs.com/api/first-launch, the same service at its earlier address). Older versions and other apps may use the legacy smart-billing-dashboard.azurewebsites.net/api/first-launch address.

In Smart Dentist 5.0.1 on iPhone and iPad, disabling Improve Smart Dentist in Settings prevents a pending first-launch report; it does not erase historical reports. Mac retains its existing first-launch behaviour. Older app versions may not offer this in-app control. In The Smart Budget, the first-launch message is separate from the measurement settings described below. In The Smart Billing 5.0.1 on iPhone and iPad, disabling Improve The Smart Billing in Settings, like Smart Dentist, prevents a pending first-launch report; it does not erase historical reports. Mac retains its existing first-launch behaviour. In The Smart Coach, the first-launch message is separate from the measurement settings, and it is sent on every platform, Mac included. Local-network permission does not control these internet requests.

2. roCARD — Apple Wallet passes and your card

When you tap "Add to Apple Wallet" inside roCARD, the app sends the contents of that business card to the ZaatarLABS pass server (rocard.zaatarlabs.com), so that a signed .pkpass file can be generated and returned to your device. Only a server holding our Apple PassKit signing certificate can produce a valid Wallet pass. The card includes your name, job title, company, the contact details in its QR code (such as phone numbers, email, website, social links and address), your card photo and logo, and the app version, language setting and device type. Our network provider also tells the server which country the request comes from.

From roCARD 2.2, ZaatarLABS keeps a copy of that card. We use it to run the Wallet feature and for our own marketing, such as telling you about roCARD and our other apps. It is stored on our UAE-hosted systems, linked to you by its contact details, never sold, and never shared with advertising networks or data brokers. It is kept separate from our app measurement and is never combined with it. Earlier versions of roCARD did not send their version, and cards they sent were not kept. To stop marketing messages, use the unsubscribe link in any message or email support@zaatarlabs.com; to have your card deleted from our systems, email us from the address on the card. We delete it and make sure it is not added again.

If you never use "Add to Apple Wallet", no card data leaves your device. Scanning a paper business card in roCARD 2.2 reads the card on your device with Apple's text recognition; the photo and the text it finds are not sent anywhere.

3. The Smart Budget — currency exchange rates

If you record transactions in a currency other than your base currency, the app fetches publicly published currency exchange rates from a free, no-account public API (cdn.jsdelivr.net, with a Cloudflare Pages mirror as a fallback). The request contains no personal data — only the currency code being looked up. Rates are cached on your device so the app keeps working offline.

4. The Smart Budget — Apple Intelligence

On supported devices, The Smart Budget uses Apple's Foundation Models framework to read bank texts and notifications, clean up garbled merchant names, sort transactions into your categories, write the short text on some Insights cards, answer questions in the Money Advisor, read a receipt photo or screenshot you capture, and read a bank statement you choose to import.

On iOS 26 these calls run entirely on your device using Apple's bundled language model.

On iOS 27 a request may run on your device or in Apple's Private Cloud Compute — Apple's own servers built for private AI processing. Apple states that data sent to Private Cloud Compute is used only to fulfil the request, is not stored, and is not accessible to Apple. What can be sent: the text of a bank alert, the question you ask the Money Advisor together with the figures needed to answer it, a receipt photo or screenshot you capture to add a transaction, and — only when you import a statement — that statement's contents (for a PDF, images of its pages). Importing a statement always uses Private Cloud Compute; if you do not want that, do not use statement import.

These Apple Intelligence requests are never sent to a ZaatarLABS server or to any third party. We never see your prompts, your transactions or the answers.

Bank text automation (iOS 27). The optional Shortcuts automation hands every incoming text to the app, because iOS cannot filter by bank. Each text is checked on your iPhone first. A text that is not a bank alert is dropped immediately: it is not read further, not stored, not logged and not sent anywhere. One-time passcodes are dropped.

If Apple Intelligence is unavailable or switched off, the app falls back to built-in rules and keeps working without these features. You can also switch it off inside the app: Settings → Apple Intelligence.

5. The Smart Billing — Apple Intelligence

On supported devices, The Smart Billing uses Apple's Foundation Models framework for the Business Assistant, which answers questions about your own books and can read but never change them, and for the Client Brief, a short summary of one client's account.

On iOS 27 these requests run in Apple's Private Cloud Compute where it is available, and otherwise on your device. On iOS 26 they run on your device. What can be sent to Private Cloud Compute: the question you ask, together with the figures from your books needed to answer it (for example totals, client names and amounts owed), or, for a Client Brief, that client's billing figures. Apple states that data sent to Private Cloud Compute is used only to fulfil the request, is not stored, and is not accessible to Apple.

Receipt scan reads the receipt photo on your device: with Apple Intelligence on iOS 27, or with Apple's text recognition on earlier versions. The photo is not sent to Private Cloud Compute.

These Apple Intelligence requests are never sent to a ZaatarLABS server or to any third party. If Apple Intelligence is unavailable or switched off, the Business Assistant and Client Brief are hidden and the rest of the app works as before.

6. The Smart Coach — Apple Intelligence

On supported devices, The Smart Coach uses Apple's Foundation Models framework for the Practice Assistant, which answers questions about your own practice and can read but never change your records, for the Client Brief, a short summary of one client before a session, and for Scan Receipt, which reads a receipt photo into an expense.

On iOS 27 the Practice Assistant and the Client Brief run in Apple's Private Cloud Compute where it is available, and otherwise on your device. On iOS 26 they run on your device. What can be sent to Private Cloud Compute: the question you ask the Practice Assistant, together with the records needed to answer it (for example client names, appointments, session dates and #themes, and amounts invoiced, paid or owed), or, for a Client Brief, that client's record: their sessions and #themes, an excerpt of the notes from recent sessions, workshops attended, the next appointment and what is owed. Apple states that data sent to Private Cloud Compute is used only to fulfil the request, is not stored, and is not accessible to Apple.

Scan Receipt reads the receipt photo on your device: with Apple Intelligence on iOS 27, or with Apple's text recognition otherwise. The photo is not sent to Private Cloud Compute.

These Apple Intelligence requests are never sent to a ZaatarLABS server or to any third party. If Apple Intelligence is unavailable or switched off, the Practice Assistant and Client Brief are hidden and the rest of the app works as before.

7. Standard outbound links

From inside the apps, you can tap links that open external destinations such as the App Store, your mail or messaging app, the WhatsApp deep link wa.me, or our website zaatarlabs.com. When you do, your device makes the request — not us — and the destination's own privacy policy applies.

Smart Dentist: usage and Apple Ads measurement

Starting with version 5.0.1 on iPhone and iPad, Smart Dentist includes optional usage and Apple Ads measurement. These features help ZaatarLABS understand which features people use, whether they return to the app, where technical problems occur and whether Apple Ads leads to subscriptions. The new features do not run on Mac, including the iPhone/iPad app running on a Mac. Existing first-launch reporting and subscription administration are described separately below.

Usage information. We collect limited events about onboarding (including whether existing iCloud data was found when the app first opens), subscription screens, active days, use of features such as the 3D tooth chart and procedure catalog setup, Practice sharing and the success or failure of supported actions. For example, an event can tell us that a patient or treatment plan was saved, but does not include the record itself. Events include a random installation reference, an event reference, the event time, app version, build, platform and fixed categories describing the action or outcome. From version 5.2 they also include how many times the app crashed or stopped responding on a day, as Apple's MetricKit reports it: a count in broad bands (once, 2 to 5, 6 or more), never crash logs, stack traces or anything you entered. From version 5.2 they can also include how many days after the download the app was first opened, in broad bands (the same day, 1, 2–7, 8–30, or 31 or more days); the number of patients in broad bands (1, 2, 3, 4–10, 11–50, 51–200, 201 or more), reported once per band; and that the app was opened from one of our App Store events.

This measurement does not include patient names, contact information, patient or clinical record identifiers, diagnoses, treatment details, documents, images, invoice amounts or your clinic's revenue. Technical events use predefined categories rather than the contents of records or free-text error messages.

Apple Ads and subscriptions. We request available acquisition information through Apple's AdServices framework. This may include campaign, ad-group, keyword and ad identifiers and a conversion category. An attribution token is sent to our service and Apple to obtain the result; we do not retain that token in the measurement database.

A separate random reference connects acquisition information with verified App Store subscription transactions. From version 5.2, when “Improve Smart Dentist” is on, a verified purchase is also linked to that installation's usage reference, whether or not “Measure Apple Ads” is on, so we can learn which features matter to subscribers and where they are; that link is never counted in advertising results. Because a purchase can be linked to both, the two references can be connected through it. These records can include transaction and subscription-chain identifiers, product, purchase and original purchase dates, renewal or revocation information, ownership, price and currency. They do not include payment-card details or patient records. A result without Apple attribution is not, by itself, proof that an installation was organic.

We use this information internally to assess our apps and advertising. We do not send patient or workflow records to advertising networks, sell this measurement data or use IDFA, device fingerprinting or data brokers for this measurement. Product-usage and advertising references are separate random references; from version 5.2 a purchase linked to both connects them, as described above. For purchases made in earlier versions with “Improve Smart Dentist” on, we may also connect a purchase to that installation’s app activity when the app’s own record of the purchase matches the App Store transaction in plan and time (within about a minute), and only when exactly one installation matches; family-shared purchases are never matched this way. Because persistent references and subscription identifiers can link records over time, we do not describe these records as fully anonymous.

Country (from version 5.2). When a measurement reference is created, or when the app updates to 5.2, our service records the country of the connection as reported by Cloudflare's network: a two-letter code such as AE or MX, nothing finer. We never store your IP address. The country is kept with that reference and lets us count subscribers by country; it is deleted with the reference when you turn the setting off.

Your choices. In Settings → Privacy, you can change “Improve Smart Dentist” and “Measure Apple Ads.” Both are initially enabled. Turning either off stops new collection for that purpose, removes its pending local measurement records and requests deletion of the associated server measurement records. If you are offline, the app keeps the limited state needed to retry; open the app with an internet connection so the request can complete. Re-enabling a setting creates a new measurement reference.

These choices do not change patient records, subscription access or purchases. They do not delete separate records used for subscription administration or records already held by the historical first-launch service. Deleting the app does not itself send a server deletion request. Contact us using the privacy contact details in this policy for requests concerning separate historical records.

Retention. Unsent events and purchase submissions older than seven days are discarded the next time the app processes its queue. Detailed server usage events, daily activity summaries, attribution and measurement purchase records have no fixed expiry: we keep them for as long as they help us understand and improve our apps, review them, and delete records we no longer need. They are tied to random references, not to names or email addresses, and we do not link them to your identity. Turning off a setting still requests deletion of the associated server measurement records, as described above. Installation references and settings remain while measurement is enabled; the app also keeps a bounded set of transaction acknowledgements to avoid repeat submissions.

After a measurement deletion request, we retain a minimal revoked-reference record, without its events, attribution or purchase records, to reject late submissions. It expires after 13 months of inactivity. These retention rules describe the new measurement store, not separate subscription-administration records or historical first-launch records.

Existing first-launch reporting. The existing first-launch service receives an installation reference, Apple's vendor identifier, app and operating-system versions, device model, locale and time zone. From version 5.2 it also stores the country Cloudflare's network reports for that request (never the IP address). These identifiers are not names or email addresses, but can distinguish installations or devices. Historical launch records remain separate from the new usage dataset. On iPhone and iPad, switching off “Improve Smart Dentist” also prevents a pending first-launch report; it does not retroactively erase historical reports. Mac keeps its existing first-launch behaviour.

Processing location and providers. Requests travel over encrypted HTTPS through Cloudflare to ZaatarLABS' self-hosted service in the United Arab Emirates. Apple provides App Store transaction and acquisition services. Network providers process connection information, including IP addresses, to deliver and protect these requests. The new measurement database does not store IP addresses. This statement does not mean that network providers never process or retain connection logs.

Smart Dentist on the web (dentist.zaatarlabs.com)

Smart Dentist on the web opens your clinic's records in a browser. After you sign in with your Apple Account, your browser talks directly to Apple's iCloud (CloudKit). Your records don't pass through or get stored on a ZaatarLABS server, and Apple handles the sign-in. We never see your password. On a computer you mark as “This is the clinic's computer” (off by default), the web app keeps the records it has loaded in that browser, encrypted, so it opens faster. Signing out deletes them. On any other computer it keeps nothing after the page closes.

Optional counts (“Improve Smart Dentist” in the web app's Settings). At most once a day per browser, the web app counts:

These counts use a random reference created in that browser. They are never linked to your Apple Account, an installation of the app, a purchase or a person, and never include patient data. Turning the setting off stops them and deletes what our service holds for that reference.

The Smart Budget: usage and Apple Ads measurement

Starting with version 2.0.1, The Smart Budget on iPhone includes optional usage and Apple Ads measurement. It helps ZaatarLABS understand which features people use, whether they return to the app, where technical problems occur and whether Apple Ads leads to subscriptions. It does not run when the iPhone app is used on a Mac. The existing first-launch message is described in section 1 above.

Usage information. With “Improve The Smart Budget” on, we collect limited app activity in fixed categories: which ways of capturing spending are used (for example bank texts, notifications, receipts or statement import), onboarding steps (including whether existing iCloud data was found when the app first opens), how many days after the download the app was first opened, in broad bands (the same day, 1, 2–7, 8–30, or 31 or more days), the number of transactions in broad bands (1, 2–10, 11–50, 51–200, 201–1,000, more than 1,000), reported once per band, use of features such as budgets, goals, capture setup, the Money Advisor and household sharing, which reports are viewed and which chart controls are used, whether Apple Intelligence is available, subscription screens viewed, plans chosen and purchase outcomes, active days, and technical outcomes such as whether a supported action succeeded or failed. Events include a random installation reference, an event reference, the event time, app version, build, platform and fixed categories describing the action or outcome.

This measurement never includes amounts, merchants, accounts, names, transaction details, the text of bank alerts or notifications, statement contents, receipt images, questions you ask the Money Advisor, or anything you type. Technical events use predefined categories rather than free-text error messages.

Apple Ads and subscriptions. With “Measure Apple Ads” on, we request available acquisition information through Apple's AdServices framework. This may include campaign, ad-group, keyword and ad identifiers and a conversion category. An attribution token is sent to our service and Apple to obtain the result; we do not retain that token in the measurement database.

A separate random reference, added to your App Store purchases, connects acquisition information with the signed App Store purchase transaction. These records can include transaction and subscription-chain identifiers, product, purchase and original purchase dates, renewal or revocation information, ownership, price and currency. They do not include payment-card details or your budget data. A result without Apple attribution is not, by itself, proof that an installation was organic.

Your purchase and your app activity. Starting with version 2.1, with “Improve The Smart Budget” on, when you buy or restore a subscription or the Lifetime purchase, or a renewal reaches the app, the app also sends the signed App Store transaction with its random usage reference. This links that installation's app activity to the purchase and its subscription chain (product, purchase date, renewals and whether it began with a free trial or an offer), so we can understand, for example, how long after the first launch people subscribe and which screen they subscribed from. It adds no name, email address, amounts, merchants or anything you type, and we do not link it to your identity. Turning off “Improve The Smart Budget” stops this and requests deletion of the link with the other usage records.

We use this information internally to assess our apps and advertising. It does not use Apple's advertising identifier (IDFA), and it does not track you across other companies' apps or websites. We do not send budget data to advertising networks, sell this measurement data or use device fingerprinting or data brokers for it. Product-usage and advertising references are separate random references. When both settings are on and you make a purchase, the same App Store transaction is sent with each, so the two can be connected through that purchase. For purchases made in earlier versions with “Improve The Smart Budget” on, we may also connect a purchase to that installation’s app activity when the app’s own record of the purchase matches the App Store transaction in plan and time (within about a minute), and only when exactly one installation matches; family-shared purchases are never matched this way. Because persistent references and subscription identifiers can link records over time, we do not describe these records as fully anonymous.

Your choices. In Settings → Privacy, you can change “Improve The Smart Budget” and “Measure Apple Ads.” Both are initially enabled. Turning either off stops new collection for that purpose, removes its pending local measurement records and requests deletion of the associated server measurement records. If you are offline, the app keeps the limited state needed to retry; open the app with an internet connection so the request can complete. Re-enabling a setting creates a new measurement reference.

These choices do not change your budget data, subscription access or purchases, and they do not control the first-launch message described in section 1. Deleting the app does not itself send a server deletion request. Contact us using the privacy contact details in this policy for requests concerning separate historical records.

Test installations. TestFlight and development builds, and devices ZaatarLABS marks for its own testing, are excluded: they send no measurement, and a device marked for testing withdraws both settings and requests deletion of anything already sent.

Retention. The Smart Budget uses the same measurement store and retention as Smart Dentist. Unsent events and purchase submissions older than seven days are discarded the next time the app processes its queue. Detailed server usage events, daily activity summaries, attribution and measurement purchase records have no fixed expiry: we keep them for as long as they help us understand and improve our apps, review them, and delete records we no longer need. They are tied to random references, not to names or email addresses, and we do not link them to your identity. Turning off a setting still requests deletion of the associated server measurement records. After a measurement deletion request, we retain a minimal revoked-reference record, without its events, attribution or purchase records, to reject late submissions; it expires after 13 months of inactivity.

Processing location and providers. Requests travel over encrypted HTTPS through Cloudflare to ZaatarLABS' self-hosted service in the United Arab Emirates. Apple provides App Store transaction and acquisition services. Network providers process connection information, including IP addresses, to deliver and protect these requests. The measurement database does not store IP addresses.

The Smart Billing: usage and Apple Ads measurement

Starting with version 5.0.1, The Smart Billing on iPhone and iPad includes optional usage and Apple Ads measurement. It helps ZaatarLABS understand which features people use, whether invoices actually get sent, whether people return to the app, where technical problems occur and whether Apple Ads leads to subscriptions. It does not run on Mac, including the iPhone and iPad app running on a Mac. The existing first-launch message is described in section 1 above.

Usage information. With “Improve The Smart Billing” on, we collect limited app activity in fixed categories: onboarding steps, and your answer to the reminders question during onboarding; whether this is a new download, a re-download or an update; how many days after the download the app was first opened, in broad bands (the same day, 1, 2–7, 8–30, or 31 or more days); the number of clients in broad bands (1, 2, 3, 4–5, 6–10, 11 or more), reported once per band; when an invoice, receipt, quotation or advance-payment document is shared, and the kind of destination chosen (for example WhatsApp, email, Messages, print or Files); whether a recorded payment was full or partial, and how it was made (cash, card, transfer, cheque, other or credit); actions on a bill (voided, reissued, duplicated, deleted, marked as sent, a payment changed or deleted); whether a receipt scan filled in the expense; which reports are viewed and which chart controls are used; use of the iPad and Mac sidebar; use of the ready-made services and item icons, and which category of icon was picked; when the What's New screen is shown; which Siri shortcuts are run; opening the app from an App Store In-App Event; use of the Business Assistant and Client Brief, and whether Apple Intelligence answered on the device or in Private Cloud Compute; whether Apple Intelligence is available; subscription screens viewed, plans chosen, plan changes and purchase outcomes; when the app asks for an App Store rating; active days; from 6.0, the way you signed in (Apple, Google or email), a way to sign in added or removed, a new device's first download of your businesses and whether it finished, the two-people question (shown, and which version was kept), a change our server set aside and the kind of reason, the update prompt, the result of moving from iCloud and how many businesses moved (in broad bands), that an account was deleted, whether a data export was made, opening a client or bill from search, on iPhone, iPad and Mac how the move from iCloud ended, how many records it waited for or could not move yet (in broad bands) and whether this device forwarded changes from a device still on an older version that day, and team actions (an invitation sent, resent, withdrawn, accepted or declined, a role changed, a business handed over, a member removed or leaving) with their outcome; and technical outcomes such as whether a supported action succeeded or failed. Events include a random installation reference, an event reference, the event time, app version, build, platform and fixed categories describing the action or outcome.

This measurement never includes client names or contact details, VAT or tax numbers, amounts, invoice, receipt or quotation contents, item or expense details, receipt images, questions you ask the Business Assistant, or anything you type. Technical events use predefined categories rather than free-text error messages.

Apple Ads and subscriptions. With “Measure Apple Ads” on, we request available acquisition information through Apple's AdServices framework. This may include campaign, ad-group and keyword identifiers. An attribution token is sent to our service and Apple to obtain the result; we do not retain that token in the measurement database.

A separate random reference, added to your App Store purchases, connects acquisition information with the signed App Store purchase transaction. These records can include transaction and subscription-chain identifiers, product, purchase and original purchase dates, renewal or revocation information, ownership, price and currency. They do not include payment-card details or your billing records. A result without Apple attribution is not, by itself, proof that an installation was organic.

Your purchase and your app activity. Starting with version 5.1, with “Improve The Smart Billing” on, when you buy, restore or change a subscription or the Lifetime purchase, the app also sends the signed App Store transaction with its random usage reference. This links that installation's app activity to the purchase and its subscription chain (product, purchase date, renewals and whether it began with a free trial or an offer), so we can understand, for example, how long after the first launch people subscribe and which screen they subscribed from. It adds no name, email address or anything you type, and we do not link it to your identity. Turning off “Improve The Smart Billing” stops this and requests deletion of the link with the other usage records. On Android (from 6.0), with “Improve The Smart Billing” or “Measure ad campaigns” on, the app sends the Google Play purchase (its product and purchase token) with that switch's random reference; our measurement server checks it with Google and keeps the purchase's order and subscription-chain identifiers, product and dates, not the token, linked to that installation's activity or ad campaign in the same way.

We use this information internally to assess our apps and advertising. It does not use Apple's advertising identifier (IDFA), and it does not track you across other companies' apps or websites. We do not send your billing records to advertising networks, sell this measurement data or use device fingerprinting or data brokers for it. Product-usage and advertising references are separate random references. When both settings are on and you make a purchase, the same App Store transaction is sent with each, so the two can be connected through that purchase. For purchases made in earlier versions with “Improve The Smart Billing” on, we may also connect a purchase to that installation’s app activity when the app’s own record of the purchase matches the App Store transaction in plan and time (within about a minute), and only when exactly one installation matches; family-shared purchases are never matched this way. Because persistent references and subscription identifiers can link records over time, we do not describe these records as fully anonymous.

Your choices. In Settings → Privacy, you can change “Improve The Smart Billing” and “Measure Apple Ads.” Both are initially enabled. Turning either off stops new collection for that purpose, removes its pending local measurement records and requests deletion of the associated server measurement records. If you are offline, the app keeps the limited state needed to retry; open the app with an internet connection so the request can complete. Re-enabling a setting creates a new measurement reference.

These choices do not change your clients, invoices or other records, your subscription access or purchases. Turning off Improve The Smart Billing also prevents a pending first-launch message (section 1). Deleting the app does not itself send a server deletion request. Contact us using the privacy contact details in this policy for requests concerning separate historical records.

Test installations. TestFlight and development builds, and devices ZaatarLABS marks for its own testing, are excluded: they send no measurement, and a device marked for testing withdraws both settings and requests deletion of anything already sent.

Retention. The Smart Billing uses the same measurement store and retention as Smart Dentist. Unsent events and purchase submissions older than seven days are discarded the next time the app processes its queue. Detailed server usage events, daily activity summaries, attribution and measurement purchase records have no fixed expiry: we keep them for as long as they help us understand and improve our apps, review them, and delete records we no longer need. They are tied to random references, not to names or email addresses, and we do not link them to your identity. Turning off a setting still requests deletion of the associated server measurement records. After a measurement deletion request, we retain a minimal revoked-reference record, without its events, attribution or purchase records, to reject late submissions; it expires after 13 months of inactivity.

Processing location and providers. Requests travel over encrypted HTTPS through Cloudflare to ZaatarLABS' self-hosted service in the United Arab Emirates. Apple provides App Store transaction and acquisition services. Network providers process connection information, including IP addresses, to deliver and protect these requests. The measurement database does not store IP addresses.

The Smart Coach: usage and Apple Ads measurement

Starting with version 4.0.1, The Smart Coach on iPhone and iPad includes optional usage and Apple Ads measurement. It helps ZaatarLABS understand which features people use, whether sessions turn into bills and bills get sent, whether people return to the app, where technical problems occur and whether Apple Ads leads to purchases. It does not run on Mac, including the iPhone and iPad app running on a Mac. The existing first-launch message is described in section 1 above.

Usage information. With “Improve The Smart Coach” on, we collect limited app activity in fixed categories: onboarding steps, and your answer to the reminders question during onboarding; whether this is a new download, a re-download or an update; how many days after the download the app was first opened, in broad bands (the same day, 1, 2–7, 8–30, or 31 or more days); active days; which kind of record was saved (for example a client, session, bill, payment, advance, expense, workshop, appointment or agreement) and whether it was new or edited; the number of clients in broad bands (1, 2, 3, 4–5, 6–10, 11 or more), reported once per band; whether a session was logged in the app or with Siri; when a bill is created from sessions or for a workshop, with the number of sessions in broad bands; when an invoice, receipt, advance receipt, agreement, session note or sessions statement is shared, and the kind of destination chosen (for example WhatsApp, email, Messages, print or Files); whether a recorded payment was full or partial, and how it was made (cash, card, transfer, cheque, other or credit); actions on a bill (voided, reissued, deleted, marked as sent, a payment changed or deleted); when you send an appointment reminder, and whether by SMS or WhatsApp; whether a receipt scan filled in the expense; which reports are viewed and which chart controls are used; use of the iPad and Mac sidebar; whether a new client was also saved to your Contacts; which Siri shortcuts are run; opening the app from an App Store In-App Event; use of the Practice Assistant and Client Brief, and whether Apple Intelligence answered on the device or in Private Cloud Compute; whether Apple Intelligence is available; subscription screens viewed, plans chosen, plan changes and purchase and restore outcomes; when the app asks for an App Store rating; and technical outcomes such as whether a supported action succeeded or failed. Events include a random installation reference, an event reference, the event time, app version, build, platform and fixed categories describing the action or outcome.

This measurement never includes client names or contact details, session notes or #themes, amounts, invoice numbers, the contents of invoices, receipts, agreements or other documents, workshop or expense details, receipt images, questions you ask the Practice Assistant, or anything you type. Technical events use predefined categories rather than free-text error messages.

Apple Ads and purchases. With “Measure Apple Ads” on, we request available acquisition information through Apple's AdServices framework. This may include campaign, ad-group, keyword and ad identifiers. An attribution token is sent to our service and Apple to obtain the result; we do not retain that token in the measurement database.

A separate random reference, added to your App Store purchases, connects acquisition information with the signed App Store purchase transaction, for subscriptions and the Lifetime purchase. These records can include transaction and subscription-chain identifiers, product, purchase and original purchase dates, renewal or revocation information, ownership, price and currency. They do not include payment-card details or your practice records. A result without Apple attribution is not, by itself, proof that an installation was organic.

Your purchase and your app activity. Starting with version 4.1, with “Improve The Smart Coach” on, when you buy, restore or change a subscription or the Lifetime purchase, the app also sends the signed App Store transaction with its random usage reference. This links that installation's app activity to the purchase and its subscription chain (product, purchase date, renewals and whether it began with a free trial or an offer), so we can understand, for example, how long after the first launch people subscribe and which screen they subscribed from. It adds no name, email address or anything you type, and we do not link it to your identity. Turning off “Improve The Smart Coach” stops this and requests deletion of the link with the other usage records.

We use this information internally to assess our apps and advertising. It does not use Apple's advertising identifier (IDFA), and it does not track you across other companies' apps or websites. We do not send your practice records to advertising networks, sell this measurement data or use device fingerprinting or data brokers for it. Product-usage and advertising references are separate random references. When both settings are on and you make a purchase, the same App Store transaction is sent with each, so the two can be connected through that purchase. For purchases made in earlier versions with “Improve The Smart Coach” on, we may also connect a purchase to that installation’s app activity when the app’s own record of the purchase matches the App Store transaction in plan and time (within about a minute), and only when exactly one installation matches; family-shared purchases are never matched this way. Because persistent references and subscription identifiers can link records over time, we do not describe these records as fully anonymous.

Your choices. In Settings → Privacy, you can change “Improve The Smart Coach” and “Measure Apple Ads.” Both are initially enabled. Turning either off stops new collection for that purpose, removes its pending local measurement records and requests deletion of the associated server measurement records. If you are offline, the app keeps the limited state needed to retry; open the app with an internet connection so the request can complete. Re-enabling a setting creates a new measurement reference.

These choices do not change your clients, sessions, bills or other records, your subscription access or purchases, and they do not control the first-launch message described in section 1. Deleting the app does not itself send a server deletion request. Contact us using the privacy contact details in this policy for requests concerning separate historical records.

Test installations. TestFlight and development builds, and devices and Apple Accounts ZaatarLABS marks for its own testing, are excluded: they send no measurement, and an installation marked for testing withdraws both settings and requests deletion of anything already sent.

Retention. The Smart Coach uses the same measurement store and retention as Smart Dentist. Unsent events and purchase submissions older than seven days are discarded the next time the app processes its queue. Detailed server usage events, daily activity summaries, attribution and measurement purchase records have no fixed expiry: we keep them for as long as they help us understand and improve our apps, review them, and delete records we no longer need. They are tied to random references, not to names or email addresses, and we do not link them to your identity. Turning off a setting still requests deletion of the associated server measurement records. After a measurement deletion request, we retain a minimal revoked-reference record, without its events, attribution or purchase records, to reject late submissions; it expires after 13 months of inactivity.

Processing location and providers. Requests travel over encrypted HTTPS through Cloudflare to ZaatarLABS' self-hosted service in the United Arab Emirates. Apple provides App Store transaction and acquisition services. Network providers process connection information, including IP addresses, to deliver and protect these requests. The measurement database does not store IP addresses.

Smart Dentist for Android

Smart Dentist for Android keeps your clinic on your account: its records are stored on our servers so that your phones, tablets, staff and front-desk computer can use them, and a copy is kept encrypted on each device so it works offline.

Who is responsible. Your clinic decides what it records about its patients and is responsible for that data. We store and process it only to run Smart Dentist for your clinic, and we never sell it or use it for advertising.

What we store for an account. Your email address (and your name, when you sign in with Google), and the sign-in method you chose (Google or an emailed code). For a clinic on an account: every record of the clinic, including patients' names, contact details, dental and medical records, X-rays and photos, appointments, bills, payments and expenses, and the clinic's settings. We also keep the clinic's subscription, as Google Play reports it.

Your phone's contacts. Smart Dentist reads your phone's contacts only when you choose Import from Contacts, and only the contact you pick: its name, phone numbers, email address, birthday and photo fill in the new patient, who is then kept like every patient. With “Also save to my Contacts” on, a new patient is also added to your phone's contacts, on the phone only.

Where it is stored. On Cloudflare's servers. A clinic in the European Union or the European Economic Area is stored in the EU, decided by its country when it is created. Accounts, sign-ins and clinic memberships are stored in Western Europe for everyone. Data is encrypted in transit and at rest.

Who can see it. The account that owns the clinic and the staff it invites. We access a clinic's data only to keep the service running, when the clinic asks us to, or when the law requires it.

Usage and ad measurement. With “Improve Smart Dentist” on, the app tells us which features are used (for example that a patient or a bill was saved, never what it contains), how many days passed between download and first open, and roughly how many patients the clinic has (in ranges). With “Measure ad campaigns” on, it tells us the ad campaign that brought the install, from Google Play's install referrer. Each switch has its own random reference, never your name, email, account or clinic. When you subscribe, the subscription is linked to these references so we can see, in totals, which features and campaigns lead people to subscribe, and how long that takes. Turning a switch off stops that measurement and deletes what it holds. This measurement goes to the same service as Smart Dentist's on iPhone and iPad and follows its retention.

Google services. The document scanner and text recognition run on your device through Google Play services, which send Google diagnostic and usage information (device and app information, performance and error data) under Google's privacy policy. Purchases, reviews and Google sign-in are handled by Google under Google's privacy policy. If you ask Gemini or another assistant on your phone about your clinic (today's schedule, your next appointment, this month's unbilled total, finding a patient or booking an appointment), Smart Dentist gives the assistant what you asked for, which can include patient names; the assistant may process it on Google's servers, under Google's privacy policy.

Your choices. You can export a Clinic Backup at any time, and delete your account in the app (Settings → Account and sync) or on the web. Deleting your account deletes it, its sign-ins and every clinic it alone owns, with all their records.

How long we keep it. As long as the account and clinic exist. Deleted data leaves our servers within 30 days (backups included).

Children. Smart Dentist is for dental clinics, not for children. A clinic may record its patients, who may be children; that data is the clinic's.

Contact. Email info@zaatarlabs.com.

The Smart Padel (from 3.0)

From version 3.0, The Smart Padel keeps your padel groups on your account on our servers, so the players in a group can use iPhone or Android and see the same games, scores and chat. A copy is kept on each phone so the app works offline.

What we store for your account. Your phone number, checked with a code; your name and, when you sign in with Apple or Google, your email address (Apple may give us a private relay address instead); the way you sign in; your profile (display name, level, photo and pinned groups); and your time zone, language, country, platform and app version, so notifications arrive at the right time and in the right form.

What we store for your groups. Everything a group's members put in it: members and their roles, players, games, sign-ups and waiting lists, schedules, scores, results and chat messages, with their photos. The members of a group see what is in it; we access a group's data only to keep the service running, when you ask us to, or when the law requires it.

Sign-in codes. To check your phone number, we send it to Twilio, which sends you the code by text message or by a phone call and checks it, under Twilio's privacy policy. Sign in with Apple and Sign in with Google are handled by Apple and Google under their privacy policies.

Inviting friends by their number. When a group admin invites people, the numbers they pick from their contacts or type are sent to our server, only to show the invite to each person in the app, now or when they sign up with that number. An invite ends when it is answered or withdrawn, or after 30 days. Someone not yet on Smart Padel gets the invite from the admin's own WhatsApp or Messages, never from us. The app sees only the contacts you pick, never your address book.

Notifications. Our server sends notifications through Apple's push service on iPhone (and Google's Firebase Cloud Messaging on Android). For this we keep your devices' push tokens and the kinds of notifications you switched off.

Our marketing. We use your name, email address and phone number for our own marketing, such as telling you about Smart Padel and our other apps. They are never sold and never shared with advertising networks or data brokers, and they are kept separate from app measurement and never combined with it. To stop marketing messages, use the unsubscribe link in any message or email support@zaatarlabs.com.

Moving from iCloud. When you update to 3.0, the app copies the groups on your iPhone and in your iCloud to your account, and links your old iCloud identifier to your account so your scores and messages stay yours. The copy in your iCloud stays where it is. For a few weeks, a 3.0 phone in a group also passes on what members still on 2.x write.

Usage measurement. With “Improve Smart Padel” on (Me → Privacy), the app tells us which features are used, for example that a game was scored or an invite was sent, never names, group names, messages or anything you type. It uses a random reference, never your name, number or account, and goes to the same service as our other apps' measurement. Turning it off stops it.

Where it is stored. On Cloudflare's servers. Data is encrypted in transit and at rest.

Your choices. You can change your phone number in the app (Me → Account → Phone Number), switch off any kind of notification, and delete your account in the app (Me → Account → Delete Account). Deleting your account deletes it, its sign-ins, phone number and profile; groups you own pass to their next admin; your scores stay in your groups' history under your player name, and your chat messages show as “Former member”. Once deleted, we no longer use your details for marketing, even if you sign up again.

How long we keep it. As long as your account and your groups exist. Deleted data leaves our servers within 30 days (backups included).

Children. The Smart Padel is not directed to children under 13.

Contact. Email info@zaatarlabs.com.

The Smart Billing (from 6.0)

From version 6.0, The Smart Billing keeps each business on your account on our servers, so your iPhone, iPad and Mac, the web app at billing.zaatarlabs.com and the Android app show the same business, and so you can invite your team to it. A copy is kept on each device so the app works offline.

Who is responsible. Your business decides what it records about its clients and is responsible for that data. We store and process it only to run The Smart Billing for your business. We never sell it, never use it for our marketing or for advertising, and never share it.

What we store for your account. Your email address (Apple may give us a private relay address instead); your name, as Apple or Google gives it or as you type it, which you can change; the ways you sign in (Apple, Google or a code we email you from no-reply@mail.zaatarlabs.com), each with that provider's identifier for you, and for Apple an encrypted token used only to end Sign in with Apple when you delete your account; each device you are signed in on (a scrambled sign-in token, when it was first and last used, and the device's name, such as “iPhone 16 Pro”); and which platforms you have used (iPhone, iPad, Mac, Android, web) and when, for our totals. You can add more ways to sign in to the same account, and remove them while one remains. We don't ask for a phone number, and we don't store your time zone, app version or IP address; we keep a language only on a team invitation, so its emails are written in the language it was sent in, until the invitation is deleted (your IP address is used only to limit repeated sign-in attempts, and is not kept).

What we store for a business. Every record of the business: its clients and their contact details (including a national ID or tax number, if you enter one), bills, receipts and payments, credit and advances, quotations, items and stock, expenses with their receipt photos, attachments, client pictures, each bill's timeline, and the business's settings (name, logo, tax number, VAT, currency and numbering). For a business moved from iCloud, we also keep the iCloud record names of its business records (random identifiers), so all your devices land in the same business. We also keep your plan, as the App Store or Google Play reports it.

Who can see it. The account that owns the business and the people it invites to that business, each with the role the owner gives them (Manager, Staff or Accountant). An invitation is to one business only: the people you invite never see your other businesses. We access a business's data only to keep the service running, when you ask us to, or when the law requires it. No ZaatarLABS tool shows a business's records; we see only totals, such as how many accounts and businesses there are and on which platforms.

Who changed what. When you work with a team, The Smart Billing keeps, for each record in a business, which team member last changed it and when, so the team can see who made a change. It is kept with the record, deleted with the record or the business, and when someone deletes their account, the record no longer says who they were.

Team invitations. When you invite someone, we email the invitation to the address you type. If they join with an account that has a different email address, we email that invited address a code to confirm it is them. An invitation expires after 7 days. When someone joins, we keep the address they were invited at with their place on your team, so you can tell who is who, and delete it when they leave or you remove them. We delete the address of an invitation you withdraw at once, and of one that expires after 30 days; for 30 days after someone joins, you also see which account they joined with. Sign-in and confirmation codes are kept scrambled, last 10 minutes and are deleted once used or expired. Replies to our emails go to support@zaatarlabs.com. The owner sees the names and email addresses of the business's team, and can remove anyone at any time.

Your phone's contacts. The Smart Billing reads your contacts only when you choose Import from Contacts, and only the contact you pick fills in the new client, who is then kept like every client. On a Mac, Import from Contacts asks for access and shows your contacts in a list that is never saved. With “Also save to my Contacts” on, a new client is also added to your device's contacts, on the device only. On Android, Import from Contacts asks for access to your contacts the first time you use it, so that the contact you pick brings its name, phone number and email address; only that contact fills in the new client, and nothing else is read or kept. “Also save to my Contacts” opens your Contacts app with the details filled in; you save it there.

Subscriptions on every platform. A plan bought in the App Store, on Google Play or on the web unlocks The Smart Billing on your iPhone, iPad, Mac, the web and Android. The app sends our server the store's signed record of your purchase; Apple sends us renewal, cancellation and refund notices, and for Google Play our server checks your purchase with Google, so we know your plan and when it ends. We keep only a scrambled, one-way form of the purchase's identifier, with the product, until when it gives you the plan, whether it renews, the store's state and whether it was a test purchase; it is tied to your account and deleted with it, and we never see your card or payment details. If you buy through Google Play, our server also keeps your purchase token, encrypted, only to check that purchase with Google each day and when your plan reaches its end, so your plan is right on every device. Our server never shares it or uses it for anything else, and it is deleted with your account, or 60 days after the purchase ends. This is kept apart from usage measurement and never combined with it. The Smart Billing's plans support Apple Family Sharing: a family member who shares your plan gets it on their own account, for their own businesses, and never sees yours. If you buy a plan on the web at billing.zaatarlabs.com, Paddle.com, our reseller and merchant of record, takes the order: it receives your email address, country and payment details to process the payment, any tax and any refund, under its own privacy policy, and tells us only which plan you bought and until when. Paddle never receives your account's identifier, only a one-time reference to the order. We keep Paddle's customer number encrypted, only to manage your web subscription for you: Paddle's page for your card and receipts, cancelling or resuming it, and a refund you ask for.

Moving from iCloud. When you update to 6.0 and sign in, the app copies the businesses on your device and in your iCloud to your account; pictures follow in the background. The copy in your iCloud stays as it was: the app never deletes or changes it. For six weeks, a device on 6.0 also passes on what one of your devices still on 5.x writes to iCloud.

The web app (billing.zaatarlabs.com). You sign in with the same account. The web app has no Business Assistant. Optional counts (“Improve The Smart Billing” in the web app's Settings → Privacy): at most once a day per browser, it counts that it was opened (with whether you own the open business or are on its team, and the account's plan), which way you signed in and whether it worked, whether the business came from this computer's copy or was downloaded, the kind of change you saved and whether it saved, whether charts were shown in 3D or flat, which report you opened, which kind of document you sent and how (email, WhatsApp, Messages, print or a file), the kind of export you made and whether it worked, team actions (an invitation sent, answered or withdrawn, a role changed, a member removed or leaving) and whether they worked, a way to sign in added or removed, the two-people question (shown, and which version was kept), the update bar, and, once plans are sold on the web, the plans offer shown and a checkout opened, completed, failed or refused, the plan's management page opened, a web plan cancelled or resumed or its card updated (the plan only), never what any of them contain: no names, amounts, numbers or anything you type. These counts use a random reference created in that browser. They are never linked to your account, an installation of the app, a purchase or a person, and never include your business's data. Turning the setting off stops them and deletes what our service holds for that reference.

What the web app keeps in your browser. Your sign-in, your language, a few display choices (sorting, the period each report shows) and a list of the clients you opened recently, as random record names, never their details. Your business itself is kept in the browser only if you turn on This computer (the web app's Settings → This computer; off unless you turn it on), as an encrypted copy, so the next visit starts faster. Signing out, turning This computer off or deleting your account removes your sign-in, that copy and the recent list from the browser. The counts above keep a random reference in the browser, and keep the counts waiting to be sent only while This computer is on.

Signing in on the web. Sign in with Apple takes you to Apple's page and back to billing.zaatarlabs.com, which hands Apple's answer to the page and keeps nothing. The sign-in page loads Google's sign-in button from accounts.google.com, so Google can see that the page was opened; it is loaded only on that page. Signing in with a code sends your email address to us so we can email you the code.

Sending a document from the web. The web app makes the PDF in your browser and saves it to your computer. Email and Messages open your own apps with the message written. WhatsApp opens WhatsApp's website (wa.me) with your client's number and the message in its link, and nothing is sent until you send it there.

The web app sets no cookies, loads no fonts or scripts from other sites (apart from Google's sign-in button above and, on the plan screen once plans are sold on the web, Paddle's checkout script from cdn.paddle.com, which also asks Paddle for the prices), and sends no first-launch ping.

The Business Assistant. On iPhone, iPad and Mac it uses Apple Intelligence, as its section explains. On Android it uses Google's Gemini Nano on the phone, on phones that have it. What it reads and writes stays on your phone; Google's ML Kit, which runs it, may send Google anonymous usage and performance information about the feature, never your content.

Google services on Android. Scan Receipt reads the receipt's text on your phone with Google's ML Kit text recognition (through Google Play services); the photo is never uploaded, and ML Kit may send Google usage and performance information, never your content. Sign in with Google, purchases and in-app review prompts are handled by Google Play under Google's privacy policy; our server checks each purchase with Google Play. Sign in with Apple opens Apple's own page in a browser tab. The Android app uses no push notifications, no Firebase and no advertising ID, and its launcher shortcuts carry no client data.

Usage and ad measurement. On iPhone, iPad and Android, “Improve The Smart Billing” and “Measure Apple Ads” (on Android, “Measure ad campaigns”) work as The Smart Billing's measurement section describes; on Android, “Measure ad campaigns” reads the ad campaign that brought the install from Google Play's install referrer instead of Apple Ads. Each switch uses a random reference, never your name, email address, account or business, and is never joined to your account. When you buy in the app, the store's record of the purchase can also carry the anonymous reference our measurement uses for your install, if you allowed it. Our account server ignores it, our measurement never reads your account, and the two are never joined. Turning a switch off stops it and deletes what it holds. The Mac app does not use this measurement.

On your devices. Your sign-in is kept in your device's Keychain (on Android, encrypted with a key held in the phone's Android Keystore). The apps send us no push tokens: changes arrive over a live connection while the app is open. Your device's Spotlight index of bills and clients, and any export file you make, stay on your device.

Where it is stored. By Cloudflare, Inc., in its data centres. A business in the European Union or the European Economic Area is stored in the EU, decided by its country when it is created or moved. Accounts, sign-ins and team memberships are stored in Western Europe for everyone. Data is encrypted in transit and at rest.

Your choices. You can export all of your businesses' data at any time (Export All Data, in Settings under your account or under Data), leave a team, and delete your account in the app or on the web (Delete Account, in Settings under your account). Deleting your account deletes it, its sign-ins and every business it owns, with all their records and pictures; that business's team loses access at once. To keep a business for your team, hand it over to one of them first. If you are a member of someone else's business, deleting your account removes you from it. How to delete your Smart Billing account, step by step.

How long we keep it. As long as your account and your businesses exist. Deleted data leaves our servers within 30 days (backups included).

Children. The Smart Billing is for businesses, not for children.

Contact. Email info@zaatarlabs.com.

Permissions our apps may request

iOS asks for your explicit permission before any app touches sensitive data. Our apps request only what they need for a feature to work, and you can deny or revoke any of these permissions at any time in iOS Settings → Privacy & Security. Denying a permission disables that one feature; nothing else. Smart Dentist for Android asks the same way for the camera, notifications and the calendar, and you can change them in Android's Settings → Apps.

What each app touches — at a glance

The table below is a quick reference. "Network" means the first-launch ping plus any feature-specific calls described above.

AppCameraPhotosContactsCalendariCloudNetwork
The Smart DentistYesYesYesYesYesFirst-launch reporting and subscription administration; from iOS/iPadOS 5.0.1, optional usage and Apple Ads measurement in Settings; from 5.2, the connection's country (never the IP address). New measurement excludes Mac.
Smart Dentist for AndroidYesYes—Yes—The clinic on your account on our servers; Google Play purchases; optional usage and ad measurement in Settings; Google Play services for the scanner, text recognition and Gemini Nano
The Smart BillingYesYesYes—YesFirst-launch ping; from 5.0.1, optional usage and Apple Ads measurement in Settings on iPhone and iPad (not Mac); from 6.0, your account and businesses on our servers (sign-in, the same business on iPhone, iPad, Mac, Android and the web, Team). Business Assistant and Client Brief: Apple Intelligence on your device or in Apple's Private Cloud Compute
The Smart CoachYesYesYesYesYesFirst-launch ping; from 4.0.1, optional usage and Apple Ads measurement in Settings on iPhone and iPad (not Mac). Practice Assistant and Client Brief: Apple Intelligence on your device or in Apple's Private Cloud Compute
roCARDYesYesYes—YesFirst-launch ping + Wallet pass when used
My Pizza Calculator————YesNone
The Smart Hand CalculatorYesYes——YesFirst-launch ping only
The Smart Trix CalculatorYesYes——YesFirst-launch ping only
The Smart PadelYesYesYes (picker)—Up to 2.xFrom 3.0: your groups on your account on our servers; sign-in codes by Twilio; notifications; optional usage measurement in Me → Privacy
The Smart BudgetYesYes——YesFirst-launch ping + currency API; from 2.0.1, optional usage and Apple Ads measurement in Settings. Apple Intelligence on your iPhone or in Apple's Private Cloud Compute

Subscriptions and one-time purchases

The Smart Dentist, The Smart Billing, The Smart Coach and The Smart Budget are subscription apps. The Smart Hand Calculator, The Smart Trix Calculator, The Smart Billing Lifetime, The Smart Coach Lifetime, and the Lifetime tiers of The Smart Budget Pro and Household are one-time purchases. My Pizza Calculator and roCARD are free. All payments are processed by Apple — not by us, except Smart Dentist for Android and The Smart Billing on Android, whose purchases Google Play processes, and The Smart Billing bought on the web, which Paddle.com sells as our reseller; our server checks each purchase with Google or Paddle and never sees your card. From version 6.0, The Smart Billing's server also checks App Store purchases, so one plan works on every platform (details). We never see your card number, your Apple ID password, or your billing address. Apple sends our app a signed receipt that confirms whether you have an active entitlement; App Store transaction records do not provide your payment-card details, but their persistent identifiers can link purchases, renewals and subscription history. Apple also sends subscription notifications to our service for subscription administration. All subscription and Lifetime purchases of The Smart Budget Pro and Household support Apple Family Sharing.

If your work involves third parties

The Smart Dentist, The Smart Billing and The Smart Coach are practice-management and CRM tools for clinicians, businesses, and coaches. When you enter information about your patients, clients, or customers into the app, you are the data controller for that information — you decide what to enter, how long to keep it, and who can see your device. ZaatarLABS is a tool you use; we do not receive copies of those records and have no separate database of them, except for Smart Dentist for Android and The Smart Billing (from 6.0), where we store the clinic's or the business's records for it, as the sections for Smart Dentist for Android and The Smart Billing explain. You remain responsible for following the rules of your profession or jurisdiction (record-keeping, confidentiality, data-protection law, and so on).

The website (zaatarlabs.com)

We measure the website so we know which pages, posts and ads bring visitors, and which of them lead people to the App Store. Nothing the website records is linked to anything you enter in our apps.

What our own measurement records

For each page you view and each tap on an App Store link, the page sends our self-hosted service (through this site's own address, zaatarlabs.com/_zl/c, to services.zaatarlabs.com):

If you allow measurement, cookies also let us recognise your browser when you come back (a random visitor ID and a visit count), remember the first and latest link that brought you (for 30 days), and keep showing you the same version of a page while we test two versions. Without measurement, nothing is stored on your device: the visit ID lives only as long as the page is open, and the link that brought you is carried to the next page in its address.

App Store links on the site carry a campaign code naming the page and how you arrived (for example ig-the-smart-coach). Apple reports to us how many downloads came from each code, as totals that don't identify anyone.

Advertising: the Meta Pixel and the Google Ads tag

When we advertise on Meta (Instagram, Facebook) or Google, the site may load the Meta Pixel and the Google Ads tag, only if you allow advertising. They tell Meta and Google that you viewed a page or tapped an App Store link after seeing their ad, so we can tell which ads work, and they let us show our ads again to people who visited (remarketing). They set their own cookies (such as _fbp and _gcl_au), and Meta Platforms and Google receive your IP address and browser details, which they handle under their own policies (Meta, Google). With advertising allowed, our own server also sends Meta the same page views and App Store taps (Meta's Conversions API), with your IP address, browser details and the _fbp/_fbc cookie values, so Meta counts each event once even if its script doesn't load; we don't keep those details. Under California law this can count as "sharing" personal information for advertising; turning advertising off is how you opt out, and stops both.

Your choices

Cookies the website uses

Cloudflare, which serves the site, also counts page views with its Web Analytics, which uses no cookies. The site's fonts are served from our own site, not from Google. A content blocker can block these scripts; the advertising choice above is what stops the server-side events too.

The contact form on the site uses your own email client (a mailto: link) — your message is sent directly to info@zaatarlabs.com through your email account, not through any web form on our server.

Children

None of our apps are designed for or directed at children under 13, and we do not knowingly collect any information from children. The apps' App Store age ratings are set by Apple based on the app's content.

How long we keep things

The Smart Dentist, Smart Budget, Smart Billing and Smart Coach measurement store follows the retention explained in each app's section above, including the deletion request sent when you turn a setting off. Separate subscription-administration records and historical first-launch records are not part of that store.

Your rights

For most of our apps your data lives on your own device, and you control it directly:

If you are in a jurisdiction with data-protection laws (such as the UAE PDPL, the EU/UK GDPR, or California's CCPA) and you want to exercise rights of access, correction, deletion, restriction, or objection regarding the limited information that does reach our services (roCARD Wallet cards, accounts on The Smart Billing, The Smart Padel and Smart Dentist for Android and what they store, first-launch reports, website visit logs, subscription records or Smart Dentist, Smart Budget, Smart Billing and Smart Coach measurement), email info@zaatarlabs.com. We will respond within 30 days. To help us identify your records, please tell us roughly when you first installed the app and from what country.

For Smart Dentist, Smart Budget, Smart Billing and Smart Coach measurement, use the Settings controls described above. Contact us for other access or deletion requests; separate subscription records may remain where needed for administration or applicable obligations.

Where data is processed

Smart Dentist's current first-launch, measurement and subscription services, The Smart Budget's, The Smart Billing's and The Smart Coach's first-launch and measurement services, and the website visitor dashboard, are hosted by ZaatarLABS in the United Arab Emirates, reached over HTTPS through Cloudflare. Smart Dentist for Android's clinics are stored on Cloudflare's servers (a clinic in the European Union is kept in the EU), and its measurement goes to the same UAE service. Legacy app endpoints may use Microsoft Azure as described above. Apple processes iCloud, App Store and acquisition requests through its own infrastructure. Depending on your location and the provider, processing may take place outside your country. Provider processing is described in Apple's, Cloudflare's and Microsoft's privacy information, and, when you allow website advertising, Meta's and Google's. Contact us with questions about processing locations or international transfers.

Security

All network requests described in this policy use HTTPS (TLS). The current Smart Dentist, Smart Budget, Smart Billing and Smart Coach services use encrypted HTTPS through Cloudflare to our UAE-hosted infrastructure. Network providers may process connection logs; the new measurement database does not store IP addresses. No method of transmission or storage is ever 100% secure, and we cannot guarantee absolute security; we can promise that we don't ask for, store, or transmit anything we don't need.

Changes to this policy

If we change this policy, we'll post the new version on this page and update the "Effective" date at the top. Material changes (for example, adding a new category of data we collect) will be highlighted in a banner on this page for at least 30 days.

Contact

Questions, concerns, or rights requests: email info@zaatarlabs.com. We read everything that lands there.