Privacy Policy

[OWNER AND COUNSEL INPUT: Identify the legal entity operating Afterping, the people and services covered by this notice, and whether Afterping acts as a controller, processor, service provider, or another role for each category of information. Confirm whether a separate customer-facing data-processing agreement is needed.]

Account and authentication information. The authentication schema includes a user name, email address, email-verification state, account and session records, and email-verification records. Session records can include an expiry time, IP address, and browser user-agent. The schema includes credential fields; confirm which credential data is actually retained and how it is protected before this description is finalized.

Lead records entered by contractors. The lead model includes name, optional email and phone, source, lead type, consent status, opt-out status, a manual send-block flag, recovery status, notes, assigned workflow, follow-up date, booking outcome, and creation and update times.

Activity history and templates. Lead activity records contain an activity type, summary, and timestamp. Saved recovery message templates contain a channel (SMS or voice), category, name, content, and creation and update times.

[OWNER INPUT: Confirm whether production stores additional information through integrations, support operations, logs, or separate systems that are not represented by these application models.]

• A person provides account details when registering and verifying an Afterping account.
• A contractor or authorized account user enters and updates lead records and message templates in the app.
• The app records lead creation and update activity in its lead history.
• The authentication setup sends an account-verification email through the Polsia email proxy.
• If analytics is enabled for a deployment, the site code creates a browser visitor ID in local storage and sends an analytics beacon. See the analytics section below.

[OWNER INPUT: Confirm all production collection points, including imports, integrations, support, call or message systems, and any third-party sources. The inspected app does not establish that such sources are connected.]

The app uses account information for account registration, email verification, and role-based access. Admin-facing tools let an authorized admin manage lead records, review their status and activity, manage saved templates, and filter an audience preview.

The audience endpoint returns a filtered count only. Its filters include lead type, source, recovery status, consent eligibility, and whether a booking outcome exists. The inspected endpoint does not return the matching lead list or send or queue a message.

The checked-in API routes for lead records, templates, and audience counts require an admin role. This statement describes those routes in the inspected code and is not a broader claim about every production system or access path.

[OWNER INPUT: Confirm additional business purposes, analytics purposes, support access, and any processing outside these app features.]

Afterping’s website advertises AI voice and SMS recovery. In the checked-in application, SMS and voice templates can be stored and edited, and an audience count can be previewed; the inspected app routes do not send or queue those messages. The repository does not establish whether a separate production system enables messaging, voice calls, AI, call recording, transcription, or related integrations.

[OWNER INPUT: Verify deployed behavior and list any data used by message or voice providers, AI systems, integrations, or human review. Include their purposes, recipients, and opt-out and consent handling only after verification.]

The application’s authentication system uses account sessions. Confirm the session cookie names, contents, duration, and whether any non-essential storage is used before describing cookie choices or controls.

The app shell includes a Polsia analytics beacon when a deployment analytics slug is configured. The browser code stores a random visitor ID as polsia_vid in local storage and sends the slug and visitor ID to the configured Polsia analytics base (or its default Polsia endpoint). The deployment setting and actual analytics practices are not available in this repository.

[OWNER INPUT: Confirm whether analytics is enabled in production, what events and identifiers are collected, analytics retention and use, cookie/local-storage controls, consent requirements, and whether other tracking technologies are active.]

Account-verification emails are sent through the Polsia email proxy. When configured, the analytics beacon is sent to the Polsia analytics endpoint. The repository does not identify the production hosting, database, email-proxy subprocessors, or any separate messaging, voice, AI, or integration providers.

[OWNER INPUT: List each provider and recipient, its role and information access, and the applicable contractual terms. Confirm whether customers direct any sharing with their own systems or vendors.]

[OWNER INPUT: Set and verify retention periods and deletion procedures for account, lead, activity, template, session, verification, analytics, support, and provider-held data. Describe export, backup, and post-termination handling only after confirming how they work.]

[OWNER AND COUNSEL INPUT: Confirm the security measures and incident-response process that are in place and approve any description for publication. This draft does not promise a particular safeguard, certification, or security outcome.]

[OWNER INPUT: Identify production storage locations and any cross-border processing or transfer, including provider locations and safeguards used where applicable. These details are not established by the inspected repository.]

[COUNSEL INPUT: Describe the rights and choices that apply by location, how an individual can make a request, how identity and authority are checked, response timelines, and any applicable limits or appeals. Confirm how a contractor customer should handle requests about lead records it provided.]

[OWNER AND COUNSEL INPUT: Confirm whether the service is intended for or available to children, any age threshold, and the steps to take if information about a child is submitted. No age rule is established by the repository.]

[OWNER AND COUNSEL INPUT: Set how changes will be approved, the notice method, and when an updated notice takes effect. Confirm whether a version or effective date should be displayed on this page.]

The company contact email provided for this app is afterping-7@polsia.app.

[OWNER INPUT: Confirm that this inbox is authorized and monitored for privacy requests, or provide the correct privacy contact and mailing address. Counsel should approve the final contact and request process.]