Privacy policy

1. Who operates this demo

SHIFT AUTOMATION operates this demo through the Meta developer app named Agentic (App ID 2042684293285898). BrightSmile Dental Clinic is a fictional demonstration name. This policy covers this WhatsApp demo and this policy page; it does not describe every SHIFT AUTOMATION service or its separate voice-agent project.

The demo receives incoming WhatsApp text messages and sends automatic English replies to invited testers. AI-enabled tests use Google Gemini to answer fictional clinic FAQ questions and follow the conversation. It does not provide medical care, create appointments, transfer chats to a human, arrange callbacks or collect payments. Audio and media processing are not enabled.

2. Information we receive

When you message the Meta-provided test WhatsApp number, Meta can deliver the following information to our webhook:

• Your WhatsApp sender identifier, normally your phone number, and any WhatsApp display name or contact information included in the event.
• The message content you send, its type, Meta message ID, message timestamp and information about the receiving test number.
• Other information included in the incoming event, such as reply context or media identifiers and descriptions, where supplied by Meta.

The workflow extracts text, sender identifier, message ID, timestamps, receiving phone-number ID and a duplicate-event flag. Its execution history can also retain the original incoming event data. The current workflow does not download media files; media references or metadata may still be present in a received event. Please use text-only test messages.

Delivery and status events may reach the webhook infrastructure, but the workflow is configured to exclude status-only notifications from incoming-message processing.

3. Why and how we use this information

We use information to answer invited English test messages, maintain limited context for follow-up questions, inspect test results, troubleshoot failures and prevent repeated replies. An operator may review the execution history for these purposes.

This workflow has no connection to Google Sheets, Google Calendar, Sarvam, Maya or the voice-agent booking backend. Replies are sent through the official WhatsApp Cloud API. We do not sell message data or send marketing through this workflow.

4. Processing, storage and service providers

The current message route is WhatsApp/Meta → an HTTPS ngrok tunnel → a local webhook proxy → n8n on the operator’s Mac. Execution data is stored in the local n8n database. Message IDs and their processing times are also stored in workflow data for duplicate detection.

Meta processes the WhatsApp communication under its own terms and privacy notices. ngrok carries webhook traffic to the local system and may process connection and service data. The local proxy does not intentionally write message bodies or verification query strings to its application logs; the tunnel launcher disables ngrok’s request inspection and log output. These settings do not eliminate service-provider processing or all possible system diagnostics.

For AI-enabled tests, the text of the current question, limited conversation history, clinic reference information and receptionist instructions are sent to Google Gemini. The AI request does not intentionally include your WhatsApp sender identifier, profile name, webhook metadata or system credentials. Basic redaction removes recognizable email addresses, phone-like long numbers and credential-like text from the AI request, but it cannot identify every personal detail: anything you type into a conversation may still contain identifying information. Original text may remain in local execution records.

This demo may use the Gemini API free tier. Google states that free-tier content may be used to improve its products. Do not send real patient information or sensitive data. Google applies its own terms, data handling and retention rules; local deletion does not establish removal from Google or other independent providers. See Google Gemini API terms and free-tier data-use information.

n8n is self-hosted rather than used as a cloud execution service. Depending on instance settings, the n8n software can send operational telemetry or version-check information to n8n; this policy does not promise that all telemetry is disabled.

When this policy is hosted on Cloudflare, Cloudflare receives information needed to serve and protect the page, such as your IP address and request/browser information. This static page contains no forms, scripts, advertising trackers or cookies set by its own code. WhatsApp webhook traffic is not routed through this policy site.

If you email us, your email provider and our email provider process the message. These services may process information in locations outside your country. Their processing and retention are governed by their own applicable policies, in addition to our handling of records under our control.

5. Retention and backups

Test messages and event data remain in n8n execution history until they are deleted by an operator or removed by n8n’s execution-pruning settings. A fixed maximum retention period for this running demo has not yet been independently verified, so we do not promise automatic deletion after a specific number of days.

In AI-enabled tests, conversation memory is kept separately for each WhatsApp sender in the local n8n workflow. Context is limited to the last 12 short exchanges and a bounded history size. Sessions expire after 24 hours without interaction and are cleared by later-message or hourly cleanup while n8n is running. If the Mac or n8n is stopped, scheduled cleanup resumes when the service runs again. These limits apply to conversation context, not all execution history or backups.

The original duplicate-detection code removes message-ID entries older than 30 days when a later message runs that cleanup. The additional persistent duplicate history is bounded to 10,000 entries. These controls do not establish deletion of the original execution records, provider records or backups.

A complete backup/export inventory and backup-retention schedule have not yet been verified. Copies may therefore exist in system backups or operator exports, and deleting a live execution does not establish that every historical copy has been erased. A deletion request includes asking the operator to identify relevant copies under our control and explain any remaining retention limits. We do not promise immediate or complete erasure from independent provider systems or unknown backups.

6. Access, correction and deletion requests

Email nandish2614@gmail.com with the subject BrightSmile WhatsApp Demo Privacy Request. You may ask what demo information we hold about you, request a correction, request deletion, or ask us to stop processing further test messages.

Include the WhatsApp number used for the test and its approximate date/time so we can locate the records. Please do not include medical information, passwords, PINs, OTPs or identity documents. We may request a proportionate confirmation that you control the relevant account before disclosing or deleting records.

Requests are handled manually. The operator reviews the relevant execution records, conversation-memory entries, duplicate-detection entries and identifiable copies under our control, and responds with the action taken or any limitation. There is no automatic deletion command in the current WhatsApp workflow and no guaranteed completion deadline stated here. You can stop participating by not sending further messages; that alone does not delete earlier records. Requests relating to Meta’s own retained data must also be directed to Meta.

View standalone data-deletion instructions →

7. Security and appropriate use

The public tunnel exposes the specific production webhook rather than the n8n editor. The local proxy restricts paths and methods, and the official WhatsApp Trigger checks Meta’s webhook signature using the App Secret. These measures reduce risk but do not guarantee absolute security. n8n’s credential protection is separate from storage of message execution data.

This demo is intended for invited testing, not emergencies or real patient intake. It is not intended for children. Do not rely on it for diagnosis, treatment, appointment confirmation or urgent assistance.

8. Contact and changes

Privacy contact: SHIFT AUTOMATION
nandish2614@gmail.com

We will update this page when the demo’s data handling changes. The date above identifies the latest version. Further changes to AI providers, appointment integrations or other data destinations require a fresh review of this policy.