Privacy Policy

This Privacy Policy explains how DOSBLACK LLC (a limited liability company organized in Wyoming, USA; the "Company", "we", "us") collects, uses, shares, and protects your personal data when you use the service offered under the Esphia brand (the "Service").

1. Scope of This Policy — Our Two Different Roles

While using Esphia, your data may be processed in two different ways:

• If you are the business subscribed to the Service (the account holder), we are the data controller for your account and billing data — we are directly responsible to you for that data.
• If you are a customer of a business (someone who chats with or books an appointment through an Esphia widget), your data is processed on that business's instructions — that business is the data controller, and we are only the data processor. In this case, we recommend directing your requests to that business first; if you contact us directly, we will forward your request to the relevant business.

2. Data We Collect

Account and business data

• Name, email address, password (stored encrypted)
• Business name, address, phone number, working hours, services offered, and staff information
• Configuration preferences you set yourself, such as the assistant's personality/tone

Payment data

Payments and subscription management are handled through Paddle (our authorized reseller) — we do not store your card details on our own systems.

Your customers' data (widget/chat)

We process, on your behalf and for the purpose of providing the Service, the name, phone number, email (if provided), and chat/appointment content that your customers share while booking through the Esphia chat widget.

Usage and security data

To prevent abuse and keep your account secure, we keep an audit log of sign-in times, IP address, and critical actions you take (such as creating/canceling appointments or changing settings).

3. Why We Process Your Data

• To provide the Service and perform our contract with you (performance of a contract)
• To process payments, prevent fraud, and keep your account secure (legitimate interest)
• To comply with our legal obligations (e.g. billing records)
• Where you have given explicit permission (e.g. non-essential cookies)

4. Who We Share Your Data With

We do not sell your data. We share it, to a limited extent, with the following trusted subprocessors to run the Service:

• Supabase — database and authentication infrastructure
• Vercel — application hosting
• Anthropic (Claude API) — processes the relevant message content to generate the chat assistant's AI responses
• Paddle — payment and subscription management
• Resend — delivery of appointment confirmation/cancellation and account notification emails

These providers process your data only on our behalf, on our instructions, and under their own privacy/security commitments.

5. International Data Transfers

The providers listed above may host data in the United States and/or the European Union. Where a transfer is made outside the European Economic Area, we expect our providers to rely on recognized safeguard mechanisms such as Standard Contractual Clauses (SCCs).

6. Data Retention

We keep your data for as long as your account is active and to the extent necessary to provide the Service. When you close your account, we delete data that falls outside our legal retention obligations within a reasonable period.

7. Security

Every business's data is isolated at the database level (Row-Level Security), connections are encrypted (TLS), and rate limiting is applied to API requests. That said, no system is 100% secure; we take reasonable precautions but cannot offer an absolute guarantee.

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to access your data, rectify or erase it, restrict processing, receive your data in a portable format, object to processing, and withdraw any consent you've given. To exercise these rights, contact us at privacy@esphia.com.

9. Additional Information for California Residents (CCPA/CPRA)

If you are a California resident, you may have the right to learn what categories of personal data we collect, to request deletion of that data, and to opt out of the "sale"/"sharing" of your data. We do not sell your data or share it for advertising purposes in any way. For requests, contact us at privacy@esphia.com.

10. European Union Representative

Our Company is not currently established in the European Union. We have not yet appointed an EU representative under GDPR Article 27; we will update this section as our business grows. For data subject requests originating from the EU, you can reach us directly at privacy@esphia.com.

11. Cookies

We currently use only necessary cookies to run the Service (such as for sign-in and interface preferences) — these don't require your consent. If we add analytics or marketing cookies in the future, we will ask for your explicit consent through the cookie notice on our site.

12. Children's Privacy

Our Service is directed at businesses and is not knowingly intended to collect data from anyone under the age of 16.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes through your account or by email.

14. Contact Us

For questions about this policy: privacy@esphia.com