Privacy Policy
Last Updated: November 2, 2026 · Effective Date: November 2, 2026
Summary for Business Owners
ctrlF provides AI follow-ups, official WhatsApp Business API integrations, and customer coordination software for clinics, salons, spas, and appointment-based businesses. We respect patient and client privacy: we never sell your customer data, we do not train public AI models on your private client conversations, and we provide both hosted SaaS and self-hosted deployment options for clients requiring complete data isolation.
1. Information We Collect
When you use ctrlF (“we”, “our”, or “us”), we collect information necessary to deliver appointment automation, shared team inboxes, and follow-up communications on your verified WhatsApp Business number:
- Account Information: Name, business name, business address, email, phone number, and administrative credentials.
- Customer Contact & Appointment Data: Customer phone numbers, appointment reservation dates, service names (e.g. balayage, dental checkup, physiotherapy session), and booking status tags.
- WhatsApp Messaging Metadata: Message delivery timestamps, read receipts, template approval statuses, and incoming inquiry text processed via our webhook integrations with Meta.
- Calendar & CRM Sync Data: Time slot availability and sync tokens through authorized integrations such as Google Calendar or your local scheduling software.
2. Meta WhatsApp Business API & Messaging Compliance
ctrlF communicates with end-users exclusively through the official Meta WhatsApp Business Platform (Cloud API / On-Premises API). By connecting your WhatsApp Business account:
- Communications sent via ctrlF adhere to WhatsApp’s Business Messaging Policies, including recipient opt-in requirements and customer-initiated 24-hour service windows.
- WhatsApp messages are encrypted in transit. We process message payloads solely to trigger your configured automation rules (such as 24-hour confirmation pings, no-show recovery nudges, or canned team replies).
- ctrlF does not share your customers’ phone numbers with third-party advertisers or data brokers under any circumstances.
3. Hosted SaaS vs. Self-Hosted Privacy Options
We recognize that clinics, medical wellness practices, and high-confidentiality salons may require strict data residency controls:
Hosted Cloud SaaS
Encrypted multi-tenant PostgreSQL databases with automated daily backups, SOC 2 compliant cloud infrastructure, and TLS 1.3 encryption.
Self-Hosted Deployment
Deploy ctrlF on your private cloud (AWS, GCP, Hetzner, or local on-premise server) so all customer records and conversation logs remain strictly inside your network perimeter.
4. Data Security & Encryption
We enforce industry-standard security protocols to protect sensitive appointment and communication data:
- All web traffic and API endpoints are encrypted using TLS 1.3.
- Database volumes are encrypted at rest with AES-256 standard encryption.
- Role-based access control (RBAC) ensures your front-desk receptionists, service specialists, and managers only access assigned customer records.
6. Your Privacy Rights (GDPR & CCPA)
Depending on your location, you and your business have the right to request access to the personal data we hold, request data correction, export your complete database records, or request complete deletion of your account and related messaging history.
To exercise these rights, contact our privacy team at privacy@ctrlf.app.
7. Contact Us
If you have any questions or feedback regarding this Privacy Policy or our WhatsApp Business data practices, please reach out: