Privacy Policy

Adapted from the Basecamp open-source policies (https://github.com/basecamp/policies, commit 05fb1f9ddaaf604fc5816990fa66f3ffd7f0a462) / CC BY 4.0. Source file: privacy/index.md. See Changes from the template.

Your data is yours, not ours. This policy says what we collect about you and why, who sees it, how long we keep it, where it is stored and what your rights are. We do not sell personal data.

True today, and what applies to real clinics

The Service remains a proof of concept; no real clinic has signed our legal documents, and the demo content is fictional. The public site offers a read-only demo of the fictional Clínica Dentária Jacarandá dashboard with a prerecorded fictional example call. Visitors cannot start live calls, and the current demo does not create visitor accounts or individual sandbox copies. The data of clinic staff and callers is described in the sections below and, for call data, in the Data Processing Addendum.

Who this policy covers

"We" means Peraditus, Lda, NIF 515457558, Avenida da República, N.º 856, 1.º, Esq.º Frente, 4450-240 Matosinhos, Porto (verified against the Certidão Permanente; see Provider identification at the end of this page). For the data in this policy we are the controller.

This policy covers:

• staff of our client clinics who use the dashboard
• people who contact us about the Service, such as clinic owners and prospective clients
• visitors to our web pages
• the people who hold a billing relationship with us

This policy does not cover the data of people who phone a clinic. When a caller reaches the Service, the clinic is the controller of that call data and we process it on the clinic's behalf, under the Data Processing Addendum. That covers call audio, transcripts, caller phone numbers, names, appointment details, messages and anything a caller says, including health information. If you called a clinic and have a question about your data, contact that clinic. Its patient privacy notice tells you how. If you contact us instead, we pass your request to the clinic the same working day.

What we collect and why

We collect only what we need to run the Service for the clinic you work for.

Your dashboard account

When your clinic invites you, we store your email address, the clinic you belong to and your role (owner or staff). We use them to let you sign in with a one-time code and to show you only your clinic's data. The lawful basis is our contract with your clinic and our legitimate interest in running it securely.

Public demo

The current public demo is a fixed, read-only dashboard with a prerecorded fictional example call. It does not ask visitors to sign in, create visitor accounts or sandboxes, or start a live call. The lawful basis for data about demo visitors still needs confirmation (open item L18). Any records left by the former email and anonymous visitor-sandbox demo are historical; the current demo does not create more of them.

Clinic-member sign-in runs on Supabase Auth. Supabase also keeps sign-in records for the account. Exactly which fields Supabase records, for example IP addresses, is not confirmed (open item L16 covers Supabase terms).

What you do in the dashboard

Knowledge versions and message status changes are stored with a time, not with the name of the staff member who made them. Telemetry events about a dashboard request can carry your user id (see the next section).

Service telemetry

Our servers record technical events, such as a request that failed or how long a booking took. Events carry ids (your user id, the clinic id, the call id) and counts. Before an event leaves our server, our code removes secrets, transcripts, summaries, names and email addresses, and keeps only the last three digits of phone numbers. We use telemetry to find and fix faults. The lawful basis is our legitimate interest in a working, secure Service.

Billing information

When paid plans exist, we will store the clinic's legal name, NIF, billing address and payment records, to invoice and to meet tax law. No payment processor is chosen yet (open item L9). This section is updated before the first invoice.

Contacting us

If you write to us, we keep the correspondence so we have the history if you write again. The lawful basis is our legitimate interest in answering you.

Cookies

The dashboard sets only the cookies it needs to keep you signed in and to remember which clinic you chose. We use no advertising cookies, no analytics cookies and no third-party trackers today. If that changes, we update this policy first.

When we access or share your information

• To run the Service. Our subprocessors store and process data for us. They are listed in Subprocessors.
• To help you, with your permission. If you ask for support, we ask before we look at your clinic's account.
• To fix an error. If an automated process fails, we may look at the least data needed to fix it, then fix the cause.
• To investigate abuse. Under the Acceptable Use Policy.
• When the law requires it. We disclose data to an authority only when a valid legal order compels us. We tell the person affected first, unless the law forbids it.
• If the business changes hands. We tell you before your data moves to a new owner or a different policy.

Where your data is stored

The table lists where each provider stores data that this policy covers. "Verified" means a file in docs/providers/ records the fact from an official source or a live API response. Everything else is unverified.

The known United States locations in this table are Better Stack telemetry and Resend message content and logs. Better Stack telemetry carries ids and counts rather than names, email addresses or transcripts. Resend uses custom SMTP for sign-in and transactional email; its verified domains have sending region eu-west-1 configured (read back 2026-10-22). The planned move of telemetry to an EU region before real-clinic use remains unresolved (open item L20). Vercel request-log locations remain unverified. Call-data locations are described separately below and in the DPA.

Current clinic call data is covered by the DPA. The LiveKit worker records eligible call audio through managed Egress into private Supabase Storage; call records and captured transcripts are held in the Supabase database. The production LiveKit project and Supabase project are configured in Frankfurt, but those settings do not establish EU-only processing. Historical artifacts from the former ElevenLabs runtime are separate and may remain in its US storage under the earlier retention and deletion process. Details are in Subprocessors.

Transfers outside the EU

Where data leaves the European Economic Area, a transfer mechanism such as the EU Standard Contractual Clauses or an adequacy decision has to cover it. We have not yet confirmed the mechanism for any provider (open item L14). Until we do, we make no claim that these transfers are covered.

How long we keep it

Patient call records with transcripts, call recordings, voice session content, test call results and the message and booking queues are kept 6 months. Messages, booking intents and changes (12 months after the slot) and appointment requests are kept 12 months. A recording the caller refused is deleted at once. Notification opt-outs and settings stay while the clinic exists. These periods are the owner's decision of 3 November 2026. They are built in the source, not yet observed in Production: cleanup and physical deletion have not been verified; see section 9 of the Data Processing Addendum (open item L25). Historical ElevenLabs artifacts follow their separate former-runtime retention and deletion path.

How we secure your data

The controls that are in place, with the tests that check them, are in the Security overview. So is the list of controls that are not in place yet.

Your rights

Under the GDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy
• correct data that is wrong
• delete your data, where we have no legal reason to keep it. Deleting your dashboard account ends your access
• restrict or object to processing based on our legitimate interest
• give you your data in a portable format

No decision about you is made solely by automated means with legal or similar effects.

Write to support@transversal.io or [POSTAL ADDRESS] (open item L2: the address is set, the postal address is not). We may need to check your identity first, usually by replying to the email address on your account. We answer within one month, as the GDPR requires.

You can complain to a supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD). Our supervisory authority is the CNPD.

Changes and questions

We may update this policy. We change the date at the top and tell clinics as described in Policy updates. Questions go to support@transversal.io (open item L2: the address is set). That address is also our privacy contact for questions about this policy and about your rights.

Changes from the template

• Replaced 37signals and its products with the provider named in the company registry (Peraditus, Lda) and one Service.
• Kept the template's split between our own data as controller and customers' end-user data processed under the DPA, and applied it to callers.
• Removed the CCPA notice, CAPTCHA, advertising, ad-network hashing, mobile app permissions, newsletter and recruitment sections, because we have none of them.
• Removed the trash-can deletion periods and HEY encryption text.
• Replaced "all data in the US" with a location table built from our provider files, including the US telemetry region.
• Replaced US law enforcement text with a short rule for legal requests.
• Replaced the Article 49 derogation text with an open item for transfer mechanisms.
• Added lawful bases, GDPR response time, CNPD and the open items table.