Privacy Policy

1. A note on how dentfol.io works

dentfol.io is a portfolio tool for dentists, not a patient records system. Dentists voluntarily build a professional profile and choose what to publish. A published profile is public and can be indexed by search engines. You control the publish state of your profile as a whole and of each showcase case individually, and you can unpublish or delete content at any time.

2. Data we collect

2.1 Account data

• Email address — for authentication and service communication.
• Sign-in method — email/password or Google sign-in, handled through Supabase Auth. If you use Google, we receive basic account identifiers from Google to create your session; we never receive your Google password.

2.2 Profile content you create

The information you add to build your page, most of which becomes public when you publish:

• Name, professional credentials, license or credential number, issuing state or organization, verification URL, headline, and biography.
• Professional-verification submissions, including legal professional name, individual NPI, state-license information, practice contact information, automated registry results, administrator review notes, and verification status. Private review notes and evidence are not published.
• Profile photo, including an AI-edited headshot if you choose to generate and save one. A source image chosen for the headshot tool is sent to the AI provider for that edit but is not saved as your dentfol.io profile photo unless you explicitly approve and apply the result.
• Education, experience, and certifications.
• Practice details, and locations with their hours and phone numbers.
• Insurance carriers accepted and languages spoken.
• Showcase cases: a title, a patient-friendly caption, before/after photos, and any de-identified drafting note you choose to keep (the note is private and is not published on your public page). Do not enter patient names, dates, record numbers, appointment details, or other identifiers.
• Publish attestation records (type and timestamp) for any case with photographs, as described above.

2.3 Call-to-book data

dentfol.io provides a link that calls the practice directly. We do not collect the caller's name, contact details, appointment reason, call audio, transcript, or call contents. We increment daily totals for: call-button selections (call taps), visitors who optionally report that they booked, and visitors who report that they did not book. Those totals are stored by dentist, practice location, date, and page source. We do not store a visitor, cookie, session, or device identifier with these totals. A reported outcome is not an appointment confirmation.

2.4 Technical & usage data

• Device & connection data — browser type, operating system, and IP address, processed to serve and secure the site.
• Privacy-friendly analytics — aggregated page views and performance metrics through Vercel, gathered subject to your cookie choice.
• Hosting and security logs — our infrastructure providers may process IP address, request time, and request path to deliver and protect the service, independently of optional analytics.
• Error reports — diagnostic details (including account identifiers and browser information) sent to Sentry when something breaks, so we can fix it.

2.5 Payment data

• Subscription status — your current tier and billing cycle.
• Payment details — processed by Lemon Squeezy, our payment provider and merchant of record. We never see or store your full card number.

3. Lawful bases for processing (GDPR)

4. How we use your data

• Build, host, and publicly display the profile pages you choose to publish.
• Authenticate you and keep your account secure.
• Manage your subscription and process payments.
• Connect a visitor's device to the listed practice phone and count aggregate call-to-book actions.
• Monitor performance, diagnose errors, and improve the service.
• Respond to your support requests and send essential service notices.

We do not sell your personal data, and we do not use published profile content for any purpose other than operating and displaying dentfol.io.

5. Service providers we share data with

We use a small set of trusted processors to run dentfol.io. We share only what each needs to do its job.

Each provider maintains its own privacy policy: Supabase, Vercel, Sentry, Lemon Squeezy, OpenAI, Anthropic, and Google.

6. International data transfers

Our providers are primarily located in the United States, so your data may be transferred to and processed there. Where required, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses and the data processing agreements we hold with each provider. If you have questions about transfers, contact privacy@dentfol.io.

7. Data retention

8. Your rights & choices

Depending on where you live, you have some or all of the following rights. To exercise most of them you don't need to email us at all — the tools are built into your account.

• Access & portability — export your data in a machine-readable format from account settings.
• Erasure (GDPR Article 17 / "right to be forgotten") — permanently delete your account from account settings. This removes your profile data and every photo you uploaded.
• Rectification — edit or correct your information at any time in the editor.
• Publication control — unpublish your profile or any individual case whenever you want, removing it from public view.
• Object or restrict — object to, or ask us to limit, processing based on legitimate interests.
• Withdraw consent — change your cookie choice or opt out of marketing at any time, without affecting processing already carried out.
• No sale of data (CCPA/US) — we do not sell or "share" your personal information as those terms are defined under US state privacy laws, and we do not discriminate against you for exercising a right.
• Complain — lodge a complaint with your local data protection authority. EU residents can find theirs via the EDPB.

For anything you can't do in-app, email privacy@dentfol.io and we'll respond within 30 days.

9. Cookies

We keep cookies to a minimum. A consent banner lets you accept or decline analytics; essential cookies are always on because the site can't function without them.

You can change your choice through the banner or your browser settings at any time.

10. Data security

• Data is encrypted in transit (TLS) and at rest.
• Row-level security and access controls limit private drafting data to the account owner and authorized service personnel and processors who need access to operate or secure the service.
• Authentication is handled by Supabase Auth using industry-standard practices.
• Access to production systems is limited to authorized personnel, and we apply security updates promptly.

11. Children's privacy

dentfol.io is intended for licensed dental professionals and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the product evolves. We'll post the revised version here with a new "Last updated" date and, for material changes, notify you by email or in-app.

13. Contact us