Privacy policy

Al Dentech, a service of Black Reef AB (Swedish org. nr 559313-6483, “we”, “us”), runs advertising for dental clinics and provides a CRM where clinics manage the enquiries those ads generate. This policy explains what personal data we process, why, how long we keep it and what rights you have. It applies to aldentech.se, the Al Dentech CRM and our Facebook app.

1. Who is responsible

For leads, the dental clinic you contacted is the data controller and Al Dentech processes the data on the clinic's behalf. For our own website, our own customers and clinic staff accounts, Al Dentech is the data controller. You can reach us at privacy@aldentech.se.

2. What we collect

• Lead form submissions. When you fill in a lead form on Facebook or Instagram, or a form on a clinic's website, we receive what you entered, typically name, phone number, email address and your answers to the form's questions, plus the form, ad and campaign it came from and the time it was sent.
• Messages. When you send a Facebook Messenger or Instagram direct message to a clinic that uses Al Dentech, we receive the message, your name and profile picture as shown on Facebook or Instagram, and the clinic's replies.
• Online bookings. When you book through a clinic's booking page, your name, contact details, address and personal identity number are sent to the clinic's journal system (Muntra, Almasoft or Opus) to make the booking. We keep your name, contact details and the booked time; we do not store your personal identity number.
• Text messages. If the clinic texts you (for example a reply to your enquiry or a request for a Google review), we store your phone number and the text that was sent.
• Enquiries to us. If you contact Al Dentech through our website, we store your name, clinic, email and message.
• Clinic staff accounts. Name, email address, login details and activity in the CRM (for example notes and tasks you create).
• Technical data. Our hosting providers log basic request data such as IP address and browser type for security and troubleshooting. We do not use advertising or tracking cookies on aldentech.se; we only use cookies needed to keep you logged in.

3. Data we receive from Facebook and Instagram

When a clinic connects its Facebook Page (and the Instagram account linked to it), our Facebook app receives access tokens for them. We use them only for these purposes:

• Lead ads. To retrieve lead form submissions from the Page's lead ads as they arrive and deliver them to the clinic's CRM, together with the name of the form, ad and campaign they came from.
• Inbox. To receive Messenger and Instagram direct messages sent to the clinic, show them in the clinic's inbox in the CRM with the sender's name and profile picture, and send the replies the clinic's staff write there.
• Connecting. To list the Pages and Instagram accounts the person connecting manages, so they can choose which ones to connect.

The permissions we request are pages_show_list, pages_read_engagement, pages_manage_metadata, pages_manage_ads, leads_retrieval, business_management, pages_messaging, instagram_basic and instagram_manage_messages, and we use each of them only for the purposes above. We do not use Facebook or Instagram data for advertising, profiling or to build audiences, and we do not sell it or share it with anyone other than the clinic it belongs to. Access tokens are kept in a part of our database that only our server can read, on encrypted storage.

4. Why we use it (legal basis)

• To pass your enquiry to the clinic so they can contact you about the treatment you asked about (the clinic's legitimate interest and steps taken at your request).
• To provide the CRM to clinics under our agreement with them (contract).
• To keep our services secure and working (legitimate interest).
• To meet legal obligations, such as bookkeeping (legal obligation).

5. Who can see it

Each clinic's leads are visible only to that clinic's staff and to Al Dentech staff who manage the clinic's account. We use these service providers to run the service: Vercel (hosting), Supabase (database and login), 46elks (sending text messages) and, for bookings, the clinic's journal system (Muntra, Almasoft or Opus). They process data only on our instructions. Some providers may process data outside the EU/EEA; where they do, transfers are covered by the EU Standard Contractual Clauses or an adequacy decision. We never sell personal data.

6. How long we keep it

Leads are kept for as long as the clinic uses Al Dentech, or until the clinic or you ask us to delete them. When a clinic ends its agreement, its data is deleted within 30 days. Messages are kept in the same way as leads. When a clinic disconnects a Facebook Page, the access tokens for the Page and its Instagram account are deleted immediately and no new leads or messages are received. Staff accounts are deleted when they are removed from the clinic.

7. Your rights and how to delete your data

You have the right to access, correct or delete your personal data, to object to or restrict its processing, and to receive a copy of it. To use any of these rights, including deleting data we received from a Facebook or Instagram lead form:

• Email privacy@aldentech.se with the subject “Delete my data”, and include the name, email or phone number you used in the form.
• Or contact the clinic you sent the enquiry to directly.

We will confirm and complete the deletion within 30 days. You can also remove Al Dentech's access from your Facebook account under Settings & privacy → Settings → Apps and websites. If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se).

8. Changes

If we change this policy we will update the date at the top of this page.