// Legal

Privacy Policy

Effective date: March 21, 2026

Sellora AI ("we", "us", or "our") provides an AI-powered WhatsApp appointment booking platform for dental clinics operating in the Gulf region (Saudi Arabia and the United Arab Emirates). This Privacy Policy describes how we collect, use, store, share, and protect personal data when our platform is used — both by dental clinics ("Clients") that subscribe to our service, and by patients ("End Users") who interact with our AI assistant through WhatsApp.

1. Who We Are

Sellora AI is a software-as-a-service (SaaS) business that provides AI-powered receptionist and appointment booking tools for dental clinics via the WhatsApp Business Platform. We act as a data processor on behalf of our dental clinic clients, who are the data controllers for their patients' information.

2. Data We Collect

From End Users (patients) via WhatsApp:

• WhatsApp phone number (used as a unique session identifier)
• Full name (provided voluntarily during booking)
• Appointment details: requested date, time, and type of dental service
• Content of messages exchanged with our AI assistant during the booking conversation

From Clients (dental clinics):

• Clinic name, location, and contact information
• Google Calendar access for availability checking and event creation
• WhatsApp Business phone number and associated Meta Business account details
• Service and pricing information provided for the AI assistant's knowledge base

3. How We Use Personal Data

• To operate the AI booking assistant and enable real-time appointment scheduling
• To check calendar availability and create appointment events in Google Calendar
• To send appointment confirmation messages to patients via WhatsApp
• To notify dental clinic owners of new bookings via WhatsApp
• To maintain conversation context during an active booking session
• To improve the accuracy and performance of our AI assistant

We do not use personal data for marketing, profiling, or any purpose beyond operating the booking service.

4. Legal Basis for Processing

• Contractual necessity: Processing is necessary to fulfill the appointment booking service requested by the End User.
• Legitimate interests: We process clinic configuration data to operate and maintain the platform for our Clients.
• Consent: End Users initiate contact voluntarily via WhatsApp and provide their information to complete a booking.

5. Third-Party Service Providers

We work with the following third-party processors to deliver our service:

Provider	Purpose	Data Processed
Meta Platforms, Inc. (WhatsApp Business API)	Message delivery between patients and the AI assistant	Phone numbers, message content
Voiceflow	AI conversation processing and flow management	Phone numbers, message content, booking details
Make.com	Workflow automation for calendar checks and notifications	Name, phone, appointment details
Google LLC (Google Calendar)	Availability checking and event creation	Name, phone, service type, appointment date/time
Railway	Cloud server hosting for the WhatsApp bridge	Incoming message payloads (transient, not stored)

6. Data Sharing

We do not sell, rent, or trade personal data to any third party. Patient booking information is shared only with the specific dental clinic the patient is booking an appointment with. We do not share data with advertisers or data brokers.

7. Data Retention

• Appointment records in Google Calendar are retained according to the dental clinic's own retention settings
• Conversation data in Voiceflow is retained for up to 30 days for session continuity
• Message logs on our server are not persistently stored — they are processed in real time and discarded

Clients may request earlier deletion of their data at any time. End Users may request deletion of their booking records by contacting us directly.

8. Data Security

We implement appropriate technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. All data is transmitted over encrypted HTTPS connections. Access to production systems is restricted to authorized personnel only.

9. Your Rights

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request correction of inaccurate data
• Right to deletion: Request deletion of your personal data from our systems
• Right to object: Object to certain types of processing
• Right to data portability: Request your data in a portable format

To exercise any of these rights, contact us below. We will respond within 30 days.

10. WhatsApp and Meta Platform Policy

Our service operates through the WhatsApp Business Platform provided by Meta Platforms, Inc. All interactions via WhatsApp are subject to Meta's Privacy Policy and WhatsApp's Terms of Service. We comply fully with the WhatsApp Business Policy and Meta Platform Terms. We do not use WhatsApp message data to target users with advertisements or share it with third parties beyond what is described in this policy.

11. Children's Privacy

Our service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we make material changes, we will update the effective date at the top of this page.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data: