Privacy policy

1. Who operates this demo

SHIFT AUTOMATION operates this demo through the Meta developer app named Agentic (App ID 2042684293285898). BrightSmile Dental Clinic is a fictional demonstration name. This policy covers this WhatsApp demo and this policy page; it does not describe every SHIFT AUTOMATION service or its separate voice-agent project.

The current demo receives and displays incoming messages for integration testing. It does not provide medical care, create real appointments, send automatic replies or connect messages to an AI model. Changes to these activities require an updated policy before they are introduced.

2. Information we receive

When you message the Meta-provided test WhatsApp number, Meta can deliver the following information to our webhook:

• Your WhatsApp sender identifier, normally your phone number, and any WhatsApp display name or contact information included in the event.
• The message content you send, its type, Meta message ID, message timestamp and information about the receiving test number.
• Other information included in the incoming event, such as reply context or media identifiers and descriptions, where supplied by Meta.

The workflow extracts text, sender identifier, message ID, timestamps, receiving phone-number ID and a duplicate-event flag. Its execution history can also retain the original incoming event data. The current workflow does not download media files; media references or metadata may still be present in a received event. Please use text-only test messages.

Delivery and status events may reach the webhook infrastructure, but the workflow is configured to exclude status-only notifications from incoming-message processing.

3. Why and how we use this information

We use the information to verify delivery from the official WhatsApp Cloud API into our self-hosted n8n workflow, inspect test results, troubleshoot failures and identify repeated events. An operator may review the execution history for these purposes.

This workflow has no connection to Google Sheets, Google Calendar, Sarvam, Maya, the voice-agent booking backend or an AI model. It contains no message-sending step. We do not use this workflow to sell message data, send marketing or train an AI model.

4. Processing, storage and service providers

The current message route is WhatsApp/Meta → an HTTPS ngrok tunnel → a local webhook proxy → n8n on the operator’s Mac. Execution data is stored in the local n8n database. Message IDs and their processing times are also stored in workflow data for duplicate detection.

Meta processes the WhatsApp communication under its own terms and privacy notices. ngrok carries webhook traffic to the local system and may process connection and service data. The local proxy does not intentionally write message bodies or verification query strings to its application logs; the tunnel launcher disables ngrok’s request inspection and log output. These settings do not eliminate service-provider processing or all possible system diagnostics.

n8n is self-hosted rather than used as a cloud execution service. Depending on instance settings, the n8n software can send operational telemetry or version-check information to n8n; this policy does not promise that all telemetry is disabled.

When this policy is hosted on Cloudflare, Cloudflare receives information needed to serve and protect the page, such as your IP address and request/browser information. This static page contains no forms, scripts, advertising trackers or cookies set by its own code. WhatsApp webhook traffic is not routed through this policy site.

If you email us, your email provider and our email provider process the message. These services may process information in locations outside your country. Their processing and retention are governed by their own applicable policies, in addition to our handling of records under our control.

5. Retention and backups

Test messages and event data remain in n8n execution history until they are deleted by an operator or removed by n8n’s execution-pruning settings. A fixed maximum retention period for this running demo has not yet been independently verified, so we do not promise automatic deletion after a specific number of days.

The duplicate-detection code removes message-ID entries older than 30 days when a later message runs that cleanup. It is not a scheduled deletion job: if no later message is processed, those identifiers can remain longer.

A complete backup/export inventory and backup-retention schedule have not yet been verified. Copies may therefore exist in system backups or operator exports, and deleting a live execution does not establish that every historical copy has been erased. A deletion request includes asking the operator to identify relevant copies under our control and explain any remaining retention limits. We do not promise immediate or complete erasure from independent provider systems or unknown backups.

6. Access, correction and deletion requests

Email nandish2614@gmail.com with the subject BrightSmile WhatsApp Demo Privacy Request. You may ask what demo information we hold about you, request a correction, request deletion, or ask us to stop processing further test messages.

Include the WhatsApp number used for the test and its approximate date/time so we can locate the records. Please do not include medical information, passwords, PINs, OTPs or identity documents. We may request a proportionate confirmation that you control the relevant account before disclosing or deleting records.

Requests are handled manually. The operator reviews the relevant execution records, duplicate-detection entries and identifiable copies under our control, and responds with the action taken or any limitation. There is no automatic deletion command in the current WhatsApp workflow and no guaranteed completion deadline stated here. You can stop participating by not sending further messages; that alone does not delete earlier records. Requests relating to Meta’s own retained data must also be directed to Meta.

View standalone data-deletion instructions →

7. Security and appropriate use

The public tunnel exposes the specific production webhook rather than the n8n editor. The local proxy restricts paths and methods, and the official WhatsApp Trigger checks Meta’s webhook signature using the App Secret. These measures reduce risk but do not guarantee absolute security. n8n’s credential protection is separate from storage of message execution data.

This demo is intended for invited testing, not emergencies or real patient intake. It is not intended for children. Do not rely on it for diagnosis, treatment, appointment confirmation or urgent assistance.

8. Contact and changes

Privacy contact: SHIFT AUTOMATION
nandish2614@gmail.com

We will update this page when the demo’s data handling changes. The date above identifies the latest version. Adding an AI provider, automatic replies, appointment integrations or other data destinations requires a fresh review of the policy.