Privacy Policy

SmileForge (“SmileForge,” “we,” “us”) provides illustrative smile previews for dental practices. This policy explains what we collect when you take a smile photo and request a preview, how it is used, who it is shared with, and how long it is kept. It applies to the SmileForge preview experience, including the branded capture pages a practice may link you to and the public demonstration used by dental practices evaluating SmileForge.

What we collect

• Facial image. A single photo frame of your face and smile, captured with your consent through your device camera.
• Generated preview. The rendered “after” image (and, if you request it, a short generated video) derived from that photo.
• Contact details. The name, email, and optional phone number you enter so a practice can follow up with you.
• Practice demonstration details. If you are evaluating SmileForge for a dental practice, we collect your practice name, name, work email, and optional phone number so we can open the demonstration and follow up about the service.
• Technical and attribution data. Request timestamps, IP address, an internally hashed repeat-visit signal, approximate location supplied by a trusted hosting proxy when available, browser/device information, language, referring page, and campaign parameters. We use this information to understand where inquiries originate, measure campaigns, enforce preview limits, and identify possible unauthorized access. IP location is approximate and is not treated as a precise physical address.
• Share-management cookie. When you create a smile share page, we place an essential, page-scoped cookie in that browser so you can turn the link off from the shared page. It expires with the link after no more than seven days and is not used for advertising or cross-site tracking.
• Connected practice mailbox information. When an authorized practice administrator connects Google Workspace, we receive the verified primary email address, hosted Workspace domain, Google account identifier, granted permission list, and an offline authorization token. The token is encrypted before storage.

How we use it

• To generate and display your before/after smile preview.
• At your direction, to create a revocable share page that lets people with the link view your before-and-after photos for up to seven days. A verified silent video is included only if you select that separate option.
• To deliver your preview and contact details to the dental practice you engaged with, so they can respond to you.
• To secure the service, prevent abuse, and control processing costs.
• To limit complimentary patient transformations to three per email and practice during a rolling seven-day period.
• To measure aggregate lead sources, geography, device mix, and repeat-access patterns.
• To respond to dental practices that request and use the public demonstration.
• To send practice-approved follow-up from the connected Google Workspace mailbox during the practice’s configured sending days and hours.

We do not sell your personal information, and we do not use your photo to train AI models. We do not use covert browser fingerprinting or free people-search services to build hidden identity profiles.

Who we share it with

• The dental practice whose capture link you used. They receive your preview and contact details to follow up with you.
• Service providers that make the preview possible: a media-capture provider, an image/video processing provider, and a cloud storage/database provider. Their processing is governed by their service terms, account settings, and our instructions.
• Google Workspace when a practice connects its own mailbox for follow-up delivery. SmileForge requests only the send-email permission. We do not request or use permission to read inbox messages, contacts, drafts, or calendars.
• People and platforms you choose. If you create a smile share page and send its link, anyone who receives the link can view the selected before-and-after photos until the link is turned off or expires. If you use a device share sheet, social network, text message, or email app, that provider receives the link and any sharing text under its own privacy terms. SmileForge does not put your name, email address, or phone number on the share page.

Google user data

Google account data is used only to verify that the connected sender belongs to a hosted Google Workspace domain and to send messages the practice has configured. We do not use Google user data for advertising, profiling, or model training, and we do not sell it. Disconnecting the mailbox immediately disables local access and pauses automated delivery. SmileForge’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How long we keep it

Photos and generated previews are stored only as long as needed to deliver the preview and support the practice’s follow-up, and are retained no longer than 12 months unless a longer period is required by law. You may request earlier deletion at any time.

Practice demonstration contact records are retained only as long as needed to respond to the practice, manage the business relationship, and satisfy applicable recordkeeping obligations.

A patient-created smile share link expires after seven days and can be turned off earlier from the result screen. Turning it off prevents future access through SmileForge, but it cannot recall screenshots, downloads, messages, or cached copies already made by a recipient or third-party sharing platform.

Security

Uploaded photos and generated media are held in private storage. Regular capture and practice access is protected through scoped credentials and time-limited delivery. A smile share page is an exception you must create deliberately: it uses an unguessable, expiring link, checks that link again when serving same-origin media, and can be revoked. Because anyone with that link can open the page, you should send it only to people you trust.

Your choices and rights

Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you, and to withdraw consent. To make a request, contact the practice you engaged with or email us using the address below and we will act on verified requests as required by applicable law, including the GDPR and CCPA.

Children

SmileForge is intended for adults. We do not knowingly collect a minor’s photo without verifiable consent from a parent or guardian. If you believe a minor’s data was submitted, contact us and we will delete it.

A note on medical information

A smile preview is an illustrative marketing visualization, not a diagnosis, treatment plan, or clinical guarantee. Where a preview is handled by a dental practice as part of its patient records, that practice’s own privacy and HIPAA notices also apply to its use of your information.

Contact

Questions or requests: privacy@smileforge.app.