Privacy Policy for Spreadle

Last updated: October 13, 2026

Spreadle ("we", "our", or "us") operates this website and provides custom websites, software, WhatsApp integrations, business workflows and hosted staff dashboards for businesses across industries. This policy covers personal information processed through our website and the relevant services we operate.

Contact Spreadle at spreadlellc@gmail.com or +91 87142 74576. To request removal of your information, see our data deletion instructions.

1. Spreadle and the business you contact

When you use a business's WhatsApp service or appointment dashboard, that business decides how to use its customer and appointment records. Spreadle operates and supports the connected software on its behalf. Smile Stories is one example of this service; our work is not limited to dental clinics. A business's own privacy notice also applies to records it controls independently, including clinic records.

2. Website enquiries and AI experiences

When you enquire about a project, you provide details such as your name, business name, email, phone number, project description and budget. The website contact form opens an email draft for you to review and send; submitting the form alone does not send the email. We use enquiries and project correspondence to prepare proposals, deliver services, provide support and communicate about invoices and service updates.

The website's Spreadler consultant and AI experience send your messages to Groq to generate replies. Custom bot descriptions and business details are also sent when you use the custom demo. Use sample information. The AI experience keeps conversation history in page memory and resets when you reload or leave. The floating project consultant keeps history in browser local storage until you clear it or your browser storage. Appearance preferences also use browser storage. Spreadle does not save these demo transcripts to a business database. These statements apply to the website AI experiences; WhatsApp appointment records are stored as described below. The demonstrated WhatsApp booking application does not send conversations to Groq.

3. WhatsApp and dashboard information

  • WhatsApp sender identifiers and phone numbers, profile names supplied with messages, inbound text and interactive button or list selections.
  • Patient names, phone numbers and self/family profile relationships linked to the WhatsApp account used to book.
  • Appointment service and doctor details, dates and times, status, booking identifiers and copies of patient details associated with a booking.
  • Booking-session state, pending profile details, message/webhook identifiers, timestamps, processing states, retry counts, error codes and DoctoSmart booking-attempt records.
  • Staff email/password authentication handled through Supabase, account and session identifiers, and relevant dashboard operational records. Where staff enable browser notifications, device push endpoints and subscription keys are stored to deliver alerts through the browser's push service.
  • Configured business messaging account and phone-number identifiers, clinic integration identifiers and server-side integration credentials needed to connect the services.

Message content is processed to understand a request and send a reply. Selected details become patient, session or appointment records; the demonstrated application does not store complete conversation transcripts in its database. Staff messages are sent through WhatsApp without a separate database conversation archive. Hosting and application processing can also generate technical logs, such as request metadata and error information.

4. Why we process this information

We respond to customer-initiated WhatsApp conversations, collect profile and appointment details, present service, doctor and booking choices, create and manage appointment records, and send confirmations and appointment-related staff messages. We also authenticate staff, support dashboard operations, prevent duplicate webhook actions and bookings, and diagnose reliability and security problems.

The demonstrated integration creates appointments in DoctoSmart and mirrors them in Supabase. Requests to change or cancel a DoctoSmart appointment are directed to reception. A reminder template has been submitted through WhatsApp Manager; template-management API integration and automatic template reminders are not currently implemented.

5. Access and service providers

Authorized staff of the relevant business access its profiles and appointment records through the dashboard. Spreadle accesses information when needed to operate, maintain or support the service. We do not sell personal information.

  • Meta/WhatsApp carries incoming and outgoing messages and associated messaging identifiers.
  • Supabase provides the application database and staff authentication, including patient, appointment, session and webhook-processing records.
  • DoctoSmart receives the patient and appointment information needed for the connected clinic booking and returns appointment availability and booking results.
  • Cloudflare serves the Spreadle website and supports webhook hosting or development tunnels in the configured WhatsApp setup. It handles traffic and related technical information for those services.
  • Vercel hosts the configured Next.js staff dashboard and handles its requests and related technical information.
  • Groq processes prompts for the separate website AI experiences described above.

Only providers involved in the service you use receive the information needed for their role. Providers may also process information under their own applicable terms and privacy notices. Information may be disclosed where required by applicable law.

6. Retention and deletion

Website enquiries and project correspondence remain in the systems used for communication and service administration while needed for those purposes. Website AI page memory and browser storage have the different lifetimes described above; clearing browser history does not remove appointment data from the application database.

WhatsApp patient profiles, appointment snapshots, webhook processing and DoctoSmart attempt records persist in Supabase. Booking sessions have an expiry checked when accessed and can be cleared by the booking flow; this is not a scheduled purge of every record. There is no general automatic deletion schedule for stored application records. Cancelling an appointment, hiding a booking or clearing the dashboard inbox does not delete all associated personal information.

Retention depends on the record's purpose and the business's instructions, subject to applicable law and platform requirements. Requests to remove records require manual review and action. Technical logs and any provider backups have separate lifecycles; removing an active database record does not necessarily erase every backup immediately. We do not promise a fixed log or backup retention period.

Meta Platform Data must be removed when no longer needed for a permitted purpose, when the relevant service or account ends, or when deletion is required by a user, customer business, Meta or applicable law. Any legally required retention must be limited to that requirement. This policy does not override Meta's applicable terms.

7. Access, correction and deletion requests

Email spreadlellc@gmail.com to request access, correction or deletion. Include the relevant business/service and the WhatsApp number with country code or staff email used with it. We may ask for proportionate confirmation that you control the account or are authorized to act for the person concerned. Do not send passwords, API tokens or detailed medical information.

We review requests for Spreadle-controlled records and coordinate with the relevant business for records we operate on its behalf. Independent clinic or provider records, including DoctoSmart records, may require action by that business or provider. See data deletion instructions for the manual request process and its limits.

8. Security and international processing

The connected application uses staff authentication, database access policies, server-side credentials and webhook signature validation. These measures reduce unauthorized access but cannot guarantee that every incident is prevented. You can report security concerns to our contact email.

Our providers operate infrastructure across countries. Depending on service configuration and provider operations, information may be processed outside India. We do not claim that all information stays in India or that stored dashboard data has WhatsApp end-to-end encryption.

9. Policy updates

We update this page when our processing changes. The revision date above identifies this version. Contact Spreadle with questions about this policy or your information.