Dolirah

Privacy Policy

Last updated: October 14, 2026

This policy explains what data Dolirah processes, why, with which providers, and what choices are available.

The Dolirah platform is operated by DOLIRAH Technologies Inc. (NEQ 1182627977), 444 Av Mc Naughton, Hemmingford, QC J0L 1H0, Canada ("Dolirah").

Dolirah acts in two distinct capacities. For the data of its own business customers (the subscribing businesses), Dolirah acts as controller. For the data those businesses enter about their own clients, Dolirah acts as a provider acting on behalf of the subscribing business, which remains responsible for it.

1. Account and business data

When an account is created and used, the platform processes the data needed to identify the customer and manage the contractual relationship.

  • Professional identity and contact details: name, email address, phone number.
  • Authentication data: password stored as a cryptographic hash, never in clear text; account verification status.
  • Business data: legal name, locations, addresses, opening hours, language and currency.
  • Roles and permissions assigned to the business's users.

2. Data about the subscribing business's own clients

The subscribing business enters data about its own clients into the platform. Dolirah hosts and processes it on that business's behalf.

  • Client records: name, email address, phone, preferences, notes and allergies where the business chooses to record them.
  • Appointment history: date, service, duration, amount, status, location, assigned staff member.
  • Commercial history: orders, line items, amounts, payments, invoices.
  • Communication preferences, including marketing consent and unsubscribes.

3. Technical data and logs

The platform keeps operational and security logs necessary for it to work correctly.

  • Audit logs of sensitive actions: denied access, support mode activation, governance changes.
  • Authentication logs, including failed attempts, for the purpose of limiting brute-force attacks.
  • Technical request data necessary for security and diagnostics.
  • Cookies strictly necessary for the authenticated session and for protection against cross-site request forgery (CSRF).
  • First-party audience measurement, with no third-party tool: a random pseudonymous identifier kept in the browser's storage, the pages viewed and where the visit came from (campaign parameters). It is turned off when the browser sends “Do Not Track” or “Global Privacy Control”. These statistics record neither IP addresses nor e-mail addresses.

4. Data processed by artificial intelligence features

When you use an artificial-intelligence-assisted feature, the content needed for the request is transmitted to a third-party model provider in order to produce a response.

Depending on the feature, this may include the conversation text, a description of the business, the list of its services and products, and the generated website content. Passwords are never transmitted.

The model providers are established outside Canada: the data concerned is therefore transferred outside the country.

5. Categories of third-party providers actually used

The categories below correspond to the integrations actually present in the platform. A named, up-to-date list of subprocessors is available on request at support@dolirah.com.

  • Payment processing: Stripe, Inc., for subscriptions and for routing payments to the subscribing business's own account (Stripe Connect).
  • Transactional and marketing email delivery: Resend, or an SMTP server configured by the operator.
  • Artificial intelligence models: Alibaba Cloud (DashScope service, Qwen models) and, depending on configuration, Anthropic.
  • WhatsApp messaging: only if a third-party service is explicitly configured by the operator; no provider is integrated by default.
  • Posting on TikTok: TikTok, only when the owner of a business connects their TikTok account (see section 10).
  • Hosting and infrastructure: the application, its database and the files uploaded to the platform are hosted on an OVHcloud server.
  • Off-site backups: a daily backup (database, uploaded files and technical configuration) is stored with Cloudflare R2. It is encrypted (AES-256) before it is sent.

6. Purposes and legal bases

  • Performance of the contract: providing the service, managing the account, billing and support.
  • Legitimate interest: platform security, prevention of fraud and abuse, service improvement.
  • Consent: marketing communications, withdrawable at any time.
  • Legal obligation: accounting and tax retention, responding to requests from competent authorities.

7. No sale of data

Dolirah does not sell personal data and does not make it available to third parties for advertising purposes. Data is shared only with the providers necessary to deliver the service, or where required by law.

8. Isolation between subscribing businesses

The platform is multi-business. Each subscribing business has an isolated space: one business's data is not accessible to another.

Support access by Dolirah staff is technically possible for diagnostic purposes; such access is logged.

9. Data retention and deletion

Data is retained for the duration of the subscription, then for as long as necessary to meet legal, accounting and evidentiary obligations.

Any request to delete or export data, including at the end of the contract, is sent by email to support@dolirah.com or through the Contact page; it is handled manually by the Dolirah team. There is currently no self-service tool to delete an account or to export all of a business's data. A business owner can, however, export their accounting data (expenses, sales, commissions) as CSV files from their dashboard.

When an Instagram professional account is connected, its owner can request at any time, from Instagram, the deletion of the data Dolirah obtained through that connection. The procedure, what is deleted, what is kept in pseudonymised form and what is kept as is are described on the "Data deletion" page (dolirah.com/suppression-des-donnees).

10. Connected TikTok account

The owner of a subscribing business can connect the business's TikTok account to post videos from Dolirah. The connection goes through TikTok's official authorization page: Dolirah never sees the TikTok password.

Data received from TikTok and kept: the account identifier specific to the Dolirah app (open_id), the display name, the username, the profile picture address, the permissions actually granted, and the access and refresh tokens, stored encrypted. For each video posted, Dolirah keeps the publish identifier returned by TikTok, its status, the link to the posted video, the title and the choices made by the owner (privacy, interactions, commercial disclosure, AI label).

Before each post, Dolirah reads from TikTok the options allowed for this account (privacy, comments, Duet, Stitch, maximum duration) so that it only offers what TikTok permits.

Purposes: identify the connected account, show it to the owner, post the videos the owner explicitly chooses, and follow the status of those posts. Dolirah never posts without an explicit action by the owner, and does not read the TikTok account's videos, followers, messages or statistics.

Tokens are renewed automatically when they are used. If access is removed from TikTok, Dolirah can no longer post and the owner sees that a reconnection is needed.

Disconnection: the owner can disconnect the TikTok account at any time from the connections page of the dashboard. Dolirah then asks TikTok to revoke access, and deletes the tokens and the account information. The history of posts already made (identifier, status, link, title and posting choices) stays in the business's space, which can request its deletion through the Contact page. Posted videos remain on TikTok: they are deleted from TikTok.

Data received from TikTok is processed by Dolirah only for the purposes above and is neither sold nor used for advertising.

11. Security

Technical measures are in place: encryption in transit, hashed passwords, role-based access control, login attempt throttling, audit logging and isolation of customer spaces.

No measure can guarantee absolute security.

Certifications: Dolirah does not currently claim any certification or attestation issued by an independent body (for example SOC 2 or ISO 27001). The absence of certification does not change the legal obligations that apply to Dolirah, in particular regarding the protection of personal information.

12. Your rights

Subject to applicable law, you may request access to your data, its correction, its deletion, and the withdrawal of your consent to marketing communications.

If you are a client of a business that uses Dolirah, please send your request directly to that business, which is responsible for your data. Dolirah will assist it in handling the request.

13. Contact

Person in charge of the protection of personal information: this function is exercised by the person with the highest authority within DOLIRAH Technologies Inc., as provided by Québec's Act respecting the protection of personal information in the private sector.

Contact details of the person in charge of the protection of personal information: email support@dolirah.com; mailing address DOLIRAH Technologies Inc., 444 Av Mc Naughton, Hemmingford, QC J0L 1H0, Canada.

Any question or request about this policy can also be sent through the Contact page on the Dolirah website.