Privacy Policy

We use the collected information to:

• Deliver appointment confirmation, reminder, cancellation, and review-request messages via WhatsApp on behalf of the business customer
• Operate the AI chatbot to respond to inbound customer questions about pricing, availability, and bookings
• Execute re-engagement and win-back campaigns as configured by the business
• Authenticate and maintain the Vagaro OAuth connection to retrieve appointment and customer data
• Detect and honor STOP / UNSUBSCRIBE opt-out requests in compliance with CTIA guidelines
• Prevent duplicate or fraudulent message delivery using idempotency mechanisms
• Provide business customers with message analytics and performance data
• Improve, debug, and maintain the reliability of our platform
• Comply with applicable legal obligations

We do not sell end-customer personal data to third parties. We do not use end-customer data for advertising or marketing unrelated to the business that collected it.

Sentio integrates with the Meta WhatsApp Business Cloud API. By using Sentio, business customers and their end-users acknowledge that:

• All WhatsApp messages are transmitted through Meta's infrastructure and are subject to WhatsApp's Privacy Policy and WhatsApp Business Policy
• Sentio processes WhatsApp message data solely to provide the automation services described in this policy and does not use it for any purpose prohibited by Meta's platform policies
• Message content accessed through the WhatsApp Business API is used only to deliver requested services and is not shared with third parties except as necessary to operate the service (e.g., sending to OpenAI for AI response generation — see Section 4)
• End-customers may opt out of automated messages at any time by replying STOP to any message. Sentio processes opt-outs immediately and suppresses all future messages to that number

Sentio relies on the following third-party services to deliver its functionality. Each provider's data handling is governed by their own privacy policies:

When customer message content is sent to OpenAI for AI response generation, it is processed solely to generate a reply and is subject to OpenAI's Privacy Policy. We do not instruct OpenAI to train models on customer data.

We may also disclose information if required by law, court order, or government authority, or to protect the rights, safety, or property of Sentio, its customers, or the public.

• Conversation history: Retained for up to 90 days to enable contextual AI responses, then automatically deleted
• Message logs and analytics: Retained for up to 12 months to allow business customers to review performance
• Idempotency records: Purged on a rolling basis (typically within 48 hours)
• Opt-out records: Retained indefinitely to prevent re-messaging opted-out numbers
• Business account data: Retained for the duration of the account and for up to 90 days after account deletion, then permanently removed

We implement industry-standard security measures including:

• HMAC-SHA256 signature verification on all incoming webhooks from Meta and Vagaro
• Encryption in transit (TLS 1.2+) for all data exchanges
• Encryption at rest for database storage via Supabase's infrastructure
• Per-tenant data isolation — no business customer can access another's data
• OAuth 2.0 for third-party authentication (no raw credentials stored)
• Access controls limiting staff access to production data

No method of transmission or storage is 100% secure. In the event of a data breach that affects your rights, we will notify affected parties as required by applicable law.

Sentio is not directed to individuals under the age of 13 (or 16 in applicable jurisdictions). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly.

Sentio operates globally and your data may be processed in countries other than your country of residence, including the United States and Canada. By using our services, you consent to the transfer and processing of your information in these countries, which may have different data protection laws than your jurisdiction. We take appropriate safeguards to ensure your data is protected in accordance with this policy wherever it is processed.

We may update this Privacy Policy from time to time. We will notify business customers of material changes via email or through the platform. The updated policy will be posted on this page with a revised effective date. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your data, contact us at: