Privacy Policy

1. A note on how dentfol.io works

dentfol.io is a portfolio tool for dentists, not a patient records system. Dentists voluntarily build a professional profile and choose what to publish. A published profile is public and can be indexed by search engines. You control the publish state of your profile as a whole and of each showcase case individually, and you can unpublish or delete content at any time.

2. Data we collect

2.1 Account data

• Email address — for authentication and service communication.
• Sign-in method — email/password or Google sign-in, handled through Supabase Auth. If you use Google, we receive basic account identifiers from Google to create your session; we never receive your Google password.

2.2 Profile content you create

The information you add to build your page, most of which becomes public when you publish:

• Name, professional credentials, headline, and biography.
• Profile photo.
• Education, experience, and certifications.
• Practice details, and locations with their hours and phone numbers.
• Insurance carriers accepted and languages spoken.
• Showcase cases: a title, a patient-friendly caption, before/after photos, and a private clinical note (the note is for your reference and is not published on your public page).
• Publish attestation records (type and timestamp) for any case with photographs, as described above.

2.3 Booking & contact form data

dentfol.io also hosts a public booking page used by our companion mobile app. When a patient or prospective patient uses it, we collect only their name and contact details so the dentist can respond. We deliberately do not collect clinical or health information through this form.

2.4 Technical & usage data

• Device & connection data — browser type, operating system, and IP address, processed to serve and secure the site.
• Privacy-friendly analytics — aggregated page views and performance metrics through Vercel, gathered subject to your cookie choice.
• Error reports — diagnostic details (including account identifiers and browser information) sent to Sentry when something breaks, so we can fix it.

2.5 Payment data

• Subscription status — your current tier and billing cycle.
• Payment details — processed by Lemon Squeezy, our payment provider and merchant of record. We never see or store your full card number.

3. Lawful bases for processing (GDPR)

4. How we use your data

• Build, host, and publicly display the profile pages you choose to publish.
• Authenticate you and keep your account secure.
• Manage your subscription and process payments.
• Deliver booking and contact requests to the relevant dentist.
• Monitor performance, diagnose errors, and improve the service.
• Respond to your support requests and send essential service notices.

We do not sell your personal data, and we do not use published profile content for any purpose other than operating and displaying dentfol.io.

5. Service providers we share data with

We use a small set of trusted processors to run dentfol.io. We share only what each needs to do its job.

Each provider maintains its own privacy policy: Supabase, Vercel, Sentry, Lemon Squeezy, and Google.

6. International data transfers

Our providers are primarily located in the United States, so your data may be transferred to and processed there. Where required, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses and the data processing agreements we hold with each provider. If you have questions about transfers, contact privacy@dentfol.io.

7. Data retention

8. Your rights & choices

Depending on where you live, you have some or all of the following rights. To exercise most of them you don't need to email us at all — the tools are built into your account.

• Access & portability — export your data in a machine-readable format from account settings.
• Erasure (GDPR Article 17 / "right to be forgotten") — permanently delete your account from account settings. This removes your profile data and every photo you uploaded.
• Rectification — edit or correct your information at any time in the editor.
• Publication control — unpublish your profile or any individual case whenever you want, removing it from public view.
• Object or restrict — object to, or ask us to limit, processing based on legitimate interests.
• Withdraw consent — change your cookie choice or opt out of marketing at any time, without affecting processing already carried out.
• No sale of data (CCPA/US) — we do not sell or "share" your personal information as those terms are defined under US state privacy laws, and we do not discriminate against you for exercising a right.
• Complain — lodge a complaint with your local data protection authority. EU residents can find theirs via the EDPB.

For anything you can't do in-app, email privacy@dentfol.io and we'll respond within 30 days.

9. Cookies

We keep cookies to a minimum. A consent banner lets you accept or decline analytics; essential cookies are always on because the site can't function without them.

You can change your choice through the banner or your browser settings at any time.

10. Data security

• Data is encrypted in transit (TLS) and at rest.
• Row-level security in the database keeps your private data (including private clinical notes) accessible only to you.
• Authentication is handled by Supabase Auth using industry-standard practices.
• Access to production systems is limited to authorized personnel, and we apply security updates promptly.

11. Children's privacy

dentfol.io is intended for licensed dental professionals and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the product evolves. We'll post the revised version here with a new "Last updated" date and, for material changes, notify you by email or in-app.

13. Contact us