Privacy Policy

This Privacy Policy explains what information SmileShop PBC ("SmileShop," "we") collects, why, and what your rights are. Short version: we collect the minimum we need to run the Platform, we don't sell your data, and we don't run third-party ad trackers across our editorial content.

1. What we collect

Information you give us:

• Email address — when you subscribe to our newsletter, submit a deal, or sign in to the free Leads Dashboard.
• Deal submissions — name, email, phone, and the public URL of the office's deal page. Used for verification and to contact the submitter about their listing.
• Leads Dashboard data — patient names, phone numbers, emails, appointment dates, notes, and treatment value, entered into the dashboard by office staff. This data is private to the office that entered it. Patients who tap "Call" or "Visit" on a deal also generate an anonymous lead record (deal id, click timestamp, approximate device/location) before any identification.
• Office Boost purchases — for offices that buy a Boost, we collect the office email address (for receipts and the magic management link), office name, and payment metadata from Stripe. We never see or store card details. The email is used only for boost receipts, renewal reminders, and lead recaps — not for marketing without a separate opt-in.

Information collected automatically:

• Page views & sessions — page path, anonymous session ID, approximate city/region (from IP geolocation, never stored as your raw IP), device class, referrer.
• Click & dwell tracking — clicks on deal CTAs and time-on-page, used to measure what's useful.
• Cookies — small files for session ID and preferences. We do not use third-party advertising trackers across our editorial pages.

Financial account data (Financial Connections):

• What we retrieve — when you apply for in-house financing through your dental office's SmileShop link, you may choose to connect your bank account using Stripe Financial Connections. With your explicit consent, we retrieve, via Stripe, your account holder name, account type, current balance, and recent transaction history (typically the most recent ~100 posted transactions per linked account). This is used solely to verify your income, identify recurring obligations, and assess affordability for the financing plan.
• Read-only & limited scope — the connection is read-only. SmileShop cannot move money, initiate transfers or debits, change your account, or log in to your bank. You authorize this access at the time of your application and may disconnect the connection at any time through your bank's permissions or by contacting us.
• How the data is shared — the bank connection is established and authenticated directly between you and Stripe; SmileShop never receives or stores your bank login credentials. Stripe transmits the retrieved account data to SmileShop for underwriting analysis. We do not sell this data and do not share it with your dental office beyond the affordability result of your application.
• Retention — the retrieved transaction data is used to generate your financing analysis and is retained only for as long as necessary to support that analysis and any resulting payment agreement, after which it is deleted. See Section 5.

2. How we use it

• To run, secure, and improve the Platform.
• To send the newsletter and welcome emails you signed up for. You can unsubscribe anytime.
• To deliver the free Leads Dashboard to claimed offices, including instant call-alert emails when a patient taps "Call" on one of their deals.
• To publish aggregate, anonymized statistics about platform activity (e.g., total deals listed, total calls driven).
• To comply with the law and respond to lawful requests.

3. What we do NOT do

• We do not sell your personal data.
• We do not share patient personal data with dental offices unless you explicitly contact them (e.g., by tapping the "Call" or "Visit" button on a deal, which signals interest to that office).
• We do not record or listen to phone calls. We do not provide tracking phone numbers.
• We do not share data between offices. Each claimed office only sees leads tied to its own listings.
• We do not run third-party advertising trackers on our editorial content.

4. Service providers we use

• Stripe — payment processing for donations and office memberships, and, with your separate consent, retrieval of financial account data via Stripe Financial Connections for financing affordability verification.
• Resend — transactional and newsletter email delivery.
• Base44 — hosting and database infrastructure.
• Google Analytics 4 / Search Console — aggregate site analytics (no advertising profiles).

Each provider is contractually bound to use your data only to provide their service to us.

5. Retention

• Newsletter subscribers — until you unsubscribe.
• Deal listings and lead records — retained while the office is active on the Platform, and for up to 24 months after for audit and dispute resolution.
• Boost payment records — retained for 7 years to meet tax and accounting obligations.
• Anonymous analytics — up to 26 months.

6. Your rights

Depending on where you live (e.g., California, EU), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten"), subject to legal retention requirements.
• Opt out of marketing emails (link at the bottom of every email).

To exercise any of these rights, email hello@smileshop.ai. We respond within 30 days.

7. Security

We use industry-standard encryption in transit (TLS) and at rest. No system is perfectly secure — please don't email us sensitive documents unless asked.

8. Children

The Platform is not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have, contact us and we'll delete it.

9. Changes

We'll post material changes here and update the version stamp at the top. Continued use of the Platform after changes means you accept the updated policy.

10. Contact

Email hello@smileshop.ai.