Privacy Policy

For the personal data of your customers that passes through Vaelto (messages, attachments, contact details), you — the business using Vaelto — are the data controller and Vaelto acts as a data processor on your instructions.

For the data of the business account itself (your registration details, billing information, website analytics), Vaelto is the data controller.

As controller of your customers’ data, you are responsible for having a lawful basis to process it, for informing your customers, for the choice to send content to AI, for the choice of AI model, and for any use in sensitive or regulated areas (for example legal, medical or immigration services).

Vaelto provides the tool; you decide what data enters it and for what purpose.

From the business account: name and email at sign-up, workspace settings, and billing details when paid plans launch.

Processed on your behalf: the content of customer conversations you connect, including text, voice notes and document images, plus contact identifiers such as phone numbers.

From the website: anonymous visit signals (page, language, referrer and a random per-session id kept only until the tab closes) — no cookies, no cross-site tracking. If you consent to analytics cookies, Google Analytics data as described in our Cookie Policy.

To run the service: draft replies from your knowledge base, translate, transcribe voice, read document images, and deliver messages to your operators.

To operate your account, provide support, keep the service secure, and — with consent — measure website use.

We do not sell personal data, and we do not use your customers’ conversations to train shared AI models.

We use trusted providers strictly to run the service: OpenAI (AI generation), the messaging aggregator that connects your channels (SIA Wazzup, Latvia — within the EU), Meta / WhatsApp (message delivery), our database and hosting providers (Supabase, Fly.io), our email provider, and — when paid plans launch — a payment provider. With consent, Google Analytics for website statistics.

Each provider processes data only as needed for its function. We do not otherwise disclose personal data, except where required by law.

Some providers (for example the AI provider) operate outside the EU/UK. Where data leaves the EU/UK, it is transferred under appropriate safeguards such as the provider’s standard contractual clauses.

Conversations are kept while your account is active. A conversation with no new messages for 365 days is deleted in full. Attachments (document photos, voice notes, PDFs) are deleted 365 days after upload, or sooner if the workspace has set a shorter period; the message stays, marked as “file expired”. Raw provider webhook records, used for troubleshooting, are deleted after 30 days.

You can export your conversations at any time from the dashboard. On written request from an account administrator we delete workspace data within 30 days. Deleted data may remain in encrypted backups for up to 56 days, after which it is destroyed; during that period it is not accessible in the service and is used only for disaster recovery.

Data is encrypted in transit (TLS 1.2 or higher) and encrypted at rest at the storage layer by our infrastructure providers; backups are encrypted with AES-256. Access is restricted, and each business’s data is isolated from every other business by row-level security. Our staff can enter a workspace only through a time-limited support visit that is recorded and visible to you. We commit to safeguarding personal data and not passing it on beyond what the service requires.

Under EU and UK GDPR you can request access, correction, deletion, restriction, portability and objection. For your customers’ data, address requests to the business that controls it; we assist that business as processor.

To exercise rights regarding data we control, or to raise a concern, contact vaeltoai@gmail.com. You may also complain to your local data protection authority (in the UK, the ICO).