Privacy Policy
Last updated:
SmileCraft AI ("SmileCraft," "we," "our," or "us") is operated by Alborz Solutions LLC. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our website at smilecraft.app, our web application at app.smilecraft.app, and our Enterprise API (collectively, the "Services").
By using the Services, you agree to the practices described in this policy. If you do not agree, please discontinue use.
1. Information We Collect
Account information: When you register, we collect your name, email address, practice name, and payment information (processed by our payment provider; we do not store full card numbers).
Face photos and simulation data: When you or your patients submit photos for smile simulation, we receive and process those images to generate AI results. Photos uploaded through the consumer app or API are used solely to provide the requested simulation and are not used for model training.
Usage and technical data: We collect log data (IP address, browser type, pages viewed, actions taken, timestamps) and aggregate analytics to operate and improve the Services. This marketing site does not set its own analytics cookie.
Analytics: This site uses cookieless web analytics, which counts visits without cookies and without building a profile of you across other websites.
Communications: Email you send us is retained by SmileCraft. Booking details submitted through the scheduling link are handled by Calendly, not stored on this marketing site.
2. How We Use Your Information
- Provide, operate, and maintain the Services (including generating smile simulations).
- Process payments and manage subscription plans.
- Respond to support requests and schedule demos.
- Send transactional emails (receipts, job-completion notices, credential issuance). Marketing emails are opt-in only.
- Detect and prevent fraud, security incidents, and policy violations.
- Comply with applicable laws and legal process.
- Improve the Services through aggregate, de-identified analysis.
We do not sell your personal information or face photos to third parties.
3. Protected Health Information (PHI) and HIPAA
If you use SmileCraft AI in a clinical context and share patient images that constitute Protected Health Information under the Health Insurance Portability and Accountability Act ("HIPAA"), the following applies:
- You are responsible for obtaining appropriate patient authorization before uploading PHI.
- Enterprise API partners handling PHI must execute a Business Associate Agreement (BAA) with SmileCraft before using a live API key. Sandbox keys must not be used with real patient data.
- The product application at app.smilecraft.app implements HIPAA-eligible technical safeguards: encryption in transit (TLS) and at rest, per-account access controls, and processing logs. This marketing website does not store patient photos.
- Patient photos and generated outputs are automatically deleted approximately one day after upload. Result presigned URLs expire within 1 hour; download promptly. No PHI is retained beyond that period unless contractually agreed in writing.
4. Data Sharing and Disclosure
We share information only in the following circumstances:
- Service providers: We use third-party providers for cloud hosting, storage and compute, AI processing, authentication, payment processing, demo scheduling, and transactional email. They process information only to provide their services to us and are bound by written agreements.
- Legal requirements: If required by law, regulation, court order, or governmental authority, we may disclose information as legally compelled.
- Business transfer: In the event of a merger, acquisition, or sale of assets, we will provide notice before your information is transferred to a successor entity.
- With your consent: Any other disclosure requires your explicit prior consent.
5. Data Retention
Account data is retained for the duration of your account plus up to 7 years after closure for legal and tax purposes. Face photos and generated simulation images are automatically deleted approximately one day after upload. High-resolution result URLs (presigned links) expire within 1 hour of generation; you must download and store results in your own system within that window. No face photo or simulation output is retained beyond that period unless longer retention is separately agreed in writing for enterprise partners. You may request deletion of your account data at any time by emailing support@smilecraft.app.
6. Security
The product application uses TLS in transit and encryption at rest, plus scoped access roles and database security rules. This marketing website is served over TLS. No system is 100% secure; promptly notify us at support@smilecraft.app if you believe your account has been compromised.
7. Your Rights
Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to object to certain processing. California residents may have additional rights under the CCPA/CPRA. To exercise any right, contact us at support@smilecraft.app. We will respond within 30 days.
8. Children
The Services are not directed to individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has submitted data, contact us immediately for deletion.
9. Changes to This Policy
We may update this policy periodically. Material changes will be communicated by email or prominent notice on the site at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.
10. Contact
Questions or requests: support@smilecraft.app
Phone: +1 949 283 2327
Alborz Solutions LLC · c/o Harvard Business Services, Inc., 16192 Coastal Hwy, Lewes, DE 19958