Privacy Policy

Last updated: 3 November 2026

This Privacy Policy explains how OAW Solutions Limited (“Vallamo”, “we”, “us”) collects, uses and protects personal information when you visit our website, create an account, or use the Vallamo service (the “Service”). Depending on where you are, your data is protected by the UK GDPR and Data Protection Act 2018, the EU GDPR (for people in the EU and EEA), and the Swiss FADP (for people in Switzerland). If you are in the United States, see section 14.

1. Who we are

OAW Solutions Limited is registered in England and Wales (company number 17266481) and is registered with the Information Commissioner’s Office (ICO registration number ZC260258). For anything to do with your data, contact support@vallamo.com. Our representatives for the EU and elsewhere are listed in section 13.

2. Our two roles

It matters which of two situations applies to you:

• When you are our customer (a business that signs up for Vallamo), we are the data controller for your account and our dealings with you.
• When a customer’s own visitor talks to the assistant (on a website, WhatsApp, Instagram or the telephone), that business is the controller of the conversation, and Vallamo is a data processor acting on its behalf under our customer terms and a Data Processing Agreement.

This policy mainly covers the first situation. If you chatted with, or phoned, an assistant on another business’s channel or number, that business’s privacy policy governs your data and you should contact them; we will pass your request on to them where appropriate.

3. Information we collect

• Account & contact data: name, business name, email address, phone number, and login credentials.
• Configuration data: the knowledge bank, settings, branding and integrations you set up.
• Conversation data: messages exchanged with the assistant, and any details a customer chooses to provide, such as name, contact details or a booking request.
• Telephone call data: where a business uses Vallamo’s phone assistant, the number a caller rings from (unless it is withheld), what is said on the call (converted from speech to text as the call happens, and kept as a written record of the conversation), the date, time, length and outcome of the call, a short summary of the call written by AI, and any details a caller gives, such as a name, a number to call back, a booking request or a message for the business. We do not record or keep the audio of calls. A business may also give us the names and telephone numbers of its own staff so that the assistant can put a caller through to them.
• Booking & deposit data: appointment details and, where deposits are taken, limited payment information handled by our payment provider (we do not store full card numbers).
• Calendar data: where a business connects Google Calendar (or another calendar/booking system), we access it to check real-time availability (which times are free or busy), create a calendar event when the assistant makes a booking, and read recent event changes on the connected calendar – including if an appointment is moved, cancelled or declined directly in Google Calendar – so the booking stays in sync. We only access the specific calendar a business connects, and only for these booking purposes.
• Connected integrations, generally: Vallamo can connect to calendar and booking systems (including Google Calendar, Outlook, Microsoft Bookings, Cal.com, Calendly, Acuity, Cliniko, Fresha, Pabau, Phorest, Treatwell, Boulevard, Mindbody and Square), payment collection (Stripe), messaging channels (WhatsApp and Instagram, via Meta), and marketing/CRM tools (including Zapier, HubSpot, Mailchimp, Klaviyo and ActiveCampaign). We only access any of these on a business's behalf, and only exchange the data needed for that integration to work, if the business has explicitly connected it in their Vallamo account; nothing is accessed by default.
• Facebook and Instagram platform data specifically: where a business connects a WhatsApp Business number or an Instagram professional account through Meta, we receive and store the identifiers for that Page, WhatsApp Business Account and/or Instagram account, an access token issued by Meta that lets us send and receive messages on the business's behalf, and the specific permissions granted at connection. We use this only to deliver messages between the business and its own customers on that channel, exactly as described in section 2. We do not access a business's or an end user's wider Facebook or Instagram profile, friends list, posts or any other platform data beyond what the connected messaging permissions provide.
• Usage & technical data: log data, device and browser information, and analytics about how the Service is used.
• Communications: messages you send us, such as demo requests or support enquiries. If you phone Vallamo’s own number, or try the voice demo on our website, we keep the number you ring from (unless it is withheld), a short written summary of the call and anything you tell us, such as your name, a number to call back or a question, so that we can respond and follow up. We do not record or keep the audio. We rely on our legitimate interest in answering enquiries from people interested in our Service.
• Enquiries from our adverts and lead forms: if you fill in a Vallamo lead form (for example on Facebook or Instagram, through Meta lead ads), we receive what you enter, such as your name, telephone number, email address, business name and your answer to our question, together with the date, the form and the wording of the consent box you ticked. If you tick that box, you agree that Vallamo (OAW Solutions Ltd) may call and text you about your enquiry, including with an AI voice assistant. We then call the number you gave from Vallamo’s own number, with up to two attempts, and may text you. The call is answered by our AI assistant, who says at the start that it is an AI. We keep a written record of the call, a short AI-written summary and anything you tell us, so that we can follow up; we do not record or keep the audio. We rely on your consent for these calls and texts, and on our legitimate interest in running our own sales and enquiry handling and keeping records of it. You can withdraw your consent at any time by saying so on the call or by replying STOP to a text; we then stop contacting you.

Health-related information. Because some businesses using Vallamo provide health or wellness services (such as clinics, medspas, dental or physiotherapy practices), a conversation, including a phone call, may sometimes include information about a person’s health, treatments or appointments. This is “special category data” and is treated with extra care (see section 5).

4. How and why we use it, and our lawful bases

We use personal data to provide and operate the Service, set up and support your account, process bookings, deposits and hand-offs to your team, keep the Service secure, improve and troubleshoot it, communicate with you, and meet our legal obligations. We also create anonymised, aggregated statistics (for example benchmarking data on response times, conversion rates or booking volumes) to improve the Service and offer businesses comparative insights; we do this in a way designed to prevent any individual or business being identified, using cohort sizes and a documented de-identification process, and further limits apply to health-related data (see section 5). Our lawful bases under UK and EU GDPR are typically performance of a contract, legitimate interests (running, securing and improving our business in ways you would reasonably expect, including creating the aggregated statistics described above), consent (for certain cookies and marketing), and legal obligation.

5. Special category (health) data

Where the assistant handles health-related information, we do so almost always as a processor on a business customer’s behalf. That business is responsible for having a valid Article 9 condition for this data, normally the individual’s explicit consent, and for telling its customers how their data is used. We process such data only on the customer’s documented instructions and apply additional safeguards: tighter access controls, encryption, and data isolation per business. Vallamo does not use identifiable health-related conversation content for its own purposes and does not use it to train third-party AI models. Health-related content may only be included in the anonymised, aggregated statistics described in section 4 where it has first been de-identified using our documented methodology and aggregated across a large enough group of businesses and people that no individual or business can reasonably be identified.

The consent step in the chat. A business that handles health information can switch on a consent step in Vallamo. Where it has, the chat on that business’s website, and its WhatsApp and Instagram messages, first ask you to agree before the assistant handles anything you write. The request shows what your information is used for, that it may include health information, which business is responsible for it, a link to that business’s privacy notice, and how to withdraw your consent. Until you agree, what you write is not read, is not sent to the AI model and is not saved as a conversation. On WhatsApp and Instagram, the text of your first message is held, encrypted and unread, until you answer: it is released to be answered if you agree, and deleted if you decline, or if you do not answer, within two days. WhatsApp and Instagram are run by Meta, which handles messages on those services under its own terms.

You can withdraw your consent at any time, using the withdraw link in the website chat or by sending WITHDRAW on WhatsApp or Instagram. We then stop processing and delete the conversation. A booking you made stays with the business, which can delete it if you ask. We keep a record of each choice (agreed, declined or withdrawn) as evidence for the business: the wording and privacy notice link you were shown, the time and the channel, and a one-way reference to your browser or account rather than your name or contact details. The business can download this record, and it is kept for that business’s chosen retention period. The consent step is the business’s choice. Where a business has not switched it on, that business is responsible for obtaining your explicit consent in another way.

Phone calls. The consent step described above is part of the website chat, WhatsApp and Instagram. It is not used on phone calls. A business whose callers may share health information by phone remains responsible for telling them how their data is used and for having a valid Article 9 condition. The phone assistant does not give medical advice. If a caller describes an emergency, it tells them to call the emergency services (999 in the UK) and, where it can, passes the call to the business’s team.

6. AI processing and AI transparency

The assistant generates replies using a third-party large language model provider, currently Anthropic (Claude). Conversation content is sent to that provider to produce a response. We work only with providers offering appropriate security and data-protection terms, under contracts that prevent your data being used to train their models. A current list of our sub-processors is in section 7.

In line with the EU AI Act, on website chat, WhatsApp and Instagram the assistant tells people they are interacting with an AI at the start of a conversation, and a person can ask to be passed to your team at any time. The assistant answers only from the knowledge bank a business has approved, and says so when it is unsure rather than guessing.

Phone calls. On a phone call the assistant listens through a speech-to-text provider, writes its reply using the language model provider above, and speaks it through a text-to-speech provider. The assistant does not open every call with an announcement, but it says plainly that it is an AI assistant whenever a caller asks, a business can have its own greeting say so, and a caller can ask to be put through to the business’s team. The business is responsible for telling its callers, in its own privacy notice and where appropriate in its greeting, that calls are answered by an AI assistant. Written summaries of calls are produced by the same language model provider. Speech recognition is not perfect, so the assistant asks callers to confirm things such as names and telephone numbers.

Calls we make to people who ask us to. When you submit one of our lead forms and agree to be called, the call is placed by Vallamo’s own AI assistant. It starts by saying that it is Vallamo’s AI assistant, and you can ask at any time to speak to a person or to stop being called. It uses the same speech-to-text, language model and text-to-speech providers described above, and a team member may be put through to you or call you back.

7. Sharing your information and our sub-processors

We do not sell personal data. We share it only with service providers who help us run Vallamo, under written data-processing contracts; with booking and other systems you choose to connect; with professional advisers; and with authorities where the law requires. We may also share data in a business sale or reorganisation, subject to this policy. Our current sub-processors are:

• Google Calendar (Google Ireland Limited / Google LLC) – where a business connects its calendar, we read and write booking data as described in section 3. Calendar data is used only to power that business's own appointment booking and is not shared with any other third party, and Vallamo's use of Google user data is limited to providing and improving this booking feature, in line with the Google API Services User Data Policy, including its Limited Use requirements.
• Other calendar and booking systems – Outlook / Microsoft 365, Microsoft Bookings, Cal.com, Calendly, Acuity Scheduling, Square Appointments, Cliniko, Pabau, Phorest, Treatwell, Boulevard and Mindbody, each only where a business explicitly connects that system. As with Google Calendar, we exchange only the booking data needed to check availability and create, move or cancel appointments – never a business's full records in that system – and this data is used solely to power that business's own appointments, not shared onward.
• Anthropic (United States) – AI language model that generates replies. It also writes the call summaries and the assistant’s replies on phone calls.
• Voyage AI (United States) – turns the text of a business’s approved knowledge bank into numerical form (embeddings) so the assistant can find the right answer. It receives knowledge-bank content, and the text of a question where needed to find a match.
• Sentry (United States) – error and performance monitoring of our applications. A report about a fault can contain limited technical information about the request that failed.
• LiveKit (United States) – real-time routing and processing of phone calls to the assistant, where a business uses the phone assistant.
• Deepgram (United States) – speech recognition (speech to text) for phone calls, where a business uses the phone assistant.
• ElevenLabs (United States) – speech synthesis (text to speech) for the assistant’s spoken replies on phone calls.
• Railway (United States) – application hosting and the chat widget.
• Vercel (United States) – hosting of the customer dashboard.
• Meta Platforms (United States / Ireland) – WhatsApp and/or Instagram messaging, and only if a business connects one or both of those channels. Meta also provides the lead forms on Facebook and Instagram through which people can ask us to contact them; we receive the details they submit. Conversation data on a connected channel flows through Meta's platform to reach us; we don't share it back with Meta beyond what that platform needs to deliver the message.
• Stripe (United States) – taking payment for your Vallamo subscription and any one-off fees (your card details are entered with Stripe and are not held by us; we keep the billing details Stripe returns, such as the plan, amount, dates and the last four digits of the card), and collecting deposits, but only where a business uses our built-in payment integration rather than connecting its own Stripe (or other) account. Deposit and payment data is shared with Stripe only for that business's own bookings.
• Twilio (United States) – appointment confirmations and reminders sent by SMS and, where a business uses the phone assistant, telephone numbers and the connection of calls. Twilio also places and connects the calls and texts that Vallamo itself sends to people who have asked us to contact them through a lead form. Where these are sent through your own booking system instead, that provider is your processor, not ours.
• Google Workspace (Google Ireland Limited / Google LLC) – our email infrastructure.
• SendGrid (Twilio Inc, United States) – sending transactional emails, such as booking confirmations, on your behalf.
• Fasthosts (United Kingdom) – hosting of our marketing website.
• Google (United States) – web fonts on our marketing website (your IP is shared to deliver the font).
• LaunchBuff – hosts the “Featured on” badge image shown in the footer of our homepage (your IP is shared to deliver the image).
• Google Analytics (Google Ireland Limited / Google LLC) – usage analytics on our marketing website, only if you accept analytics cookies.
• Meta Platforms (Ireland / United States) – the Meta pixel on our marketing website, only if you accept advertising cookies. It receives the pages you view, your IP address and browser details so that we can measure our advertising and show our ads to people who have visited our website.

We keep this list current and tell business customers before we add or change a sub-processor, as set out in our Data Processing Agreement.

8. International transfers

Several of the providers above are in the United States, so some personal data is transferred outside the UK and EEA. We protect those transfers with a lawful mechanism in every case: reliance on the provider’s certification under the EU-US Data Privacy Framework and its UK Extension where it holds one, and otherwise the Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by a transfer risk assessment. You can ask us for details of the safeguard used for a particular provider.

9. How long we keep it

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. For conversation data handled on a customer’s behalf, the retention period is set by that customer. Account data is kept for the life of the account and a reasonable period afterwards to meet legal and accounting obligations.

Facebook and Instagram platform data. The access token and connection identifiers described in section 3 are held only for as long as a business keeps that WhatsApp or Instagram channel connected. Disconnecting the channel from inside Vallamo deletes the stored token and connection identifiers immediately. Removing Vallamo's access from your own Facebook or Instagram settings revokes that authorisation with Meta straight away too; to make sure our own records are cleared as well, also disconnect the channel in Vallamo or email us (see below). Message content exchanged on a connected channel follows the same customer-set retention as other conversation data, described above.

Phone calls. We do not record or keep call audio. The written record of a call, its details and its summary are kept for the period the business sets (90 days unless the business chooses another, and never more than two years). After that, the caller’s number, the text of the call and the summary are removed. A message left for a business’s team is kept until the business marks it done and then for the same period. We keep only counts of call minutes, which do not identify you, for billing. A business can delete a call record at any time, and you can ask the business to do so.

Enquiries from lead forms. We keep the details from a lead form, the record of your consent and the written record and summary of any call or text with you for as long as we are in contact with you about Vallamo and for a reasonable period afterwards, then delete or anonymise them. If you ask us to stop contacting you, we keep your telephone number on a do-not-contact list so that we do not contact you again. You can ask us to delete your enquiry details at any time (see section 11).

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, isolation of each business’s data, access controls, and audit logging of changes. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

11. Your rights and how to use them

Subject to UK, EU and Swiss data protection law, you have the right to access your data; to have it corrected or erased; to restrict or object to processing; to data portability; to withdraw consent where we rely on it; and not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect (the assistant does not make such decisions, see section 15). To exercise any of these, email support@vallamo.com. We will verify your identity, respond within one month (extendable by two further months for complex requests, which we will tell you about), and we will not charge unless a request is manifestly unfounded or excessive.

If the request concerns a conversation on another business’s channel, we act as processor and will pass your request to that business and assist them in answering it. You can also complain to the ICO (ico.org.uk) in the UK, or to your local supervisory authority in the EEA or Switzerland, though we would welcome the chance to put things right first.

How to request deletion of your data. To ask us to delete personal data we hold about you, email support@vallamo.com with enough detail for us to find your data (for example, the business you contacted, and your name, email, phone number or the conversation in question). We will verify the request, confirm what we're deleting, and complete it within one month as described above. A business owner can delete their own Vallamo account and all its data at any time from Settings in the dashboard, and can look up and erase an individual customer's conversation, booking and lead records from the same place.

Facebook or Instagram data specifically. Removing Vallamo's access from your Facebook or Instagram app settings revokes that connection with Meta immediately. To make sure Vallamo's own copy of the connection details is deleted too, either ask the business you were messaging to disconnect the channel in their Vallamo dashboard (which deletes the stored access token immediately), or email support@vallamo.com and we will delete it, handled under the rights process above.

12. Cookies and similar technologies

Our website and dashboard use cookies and similar technologies. Some are strictly necessary (for example to keep you logged in or to run the chat); these do not require consent. Any analytics or marketing technologies are only set with your consent, which you give or refuse through our cookie banner and can change at any time. With your consent we use Google Analytics (to understand how our marketing website is used) and the Meta pixel (to measure our advertising and show our ads to people who have visited our website). Our lawful basis is your consent, which you can withdraw at any time through the Cookie settings link in the footer of every page. Our pages also load the Playfair Display typeface from Google Fonts, which shares your IP address with Google to deliver the font. Full details, including the specific cookies we use, are in our Cookie Policy.

13. EU, UK and Swiss users: our representatives

We are established in the United Kingdom, so for UK data protection law we act through our UK office above. Because we offer the Service to people in the EU and EEA without being established there, we have appointed an EU representative under Article 27 EU GDPR. The representative for the EU can be contacted at: eu.representative@vallamo.com and is located in The Hague, Netherlands. The representative for Switzerland can be contacted at: ch.representative@vallamo.com and is located in Lugano, Switzerland.

14. United States users

If you are in the US, additional rights may apply under laws such as the California Consumer Privacy Act (as amended by the CPRA) and similar state laws: to know, access, correct and delete your data, to opt out of “sale” or “sharing” (we do not sell personal data), and to non-discrimination for exercising these rights. Some states (including Washington and Nevada) also regulate consumer health data more broadly than federal law; where those apply, we and our business customers obtain the consents and provide the notices they require. To exercise US rights, contact support@vallamo.com.

15. Automated decision-making

The assistant holds conversations, answers questions and arranges bookings, but it does not make decisions that produce legal or similarly significant effects about a person without human involvement. Sensitive or significant matters are routed to your team.

16. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect children’s data through our own website.

17. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “last updated” date; significant changes will be communicated where appropriate.

18. Contact

Questions about this policy or your personal data? Email support@vallamo.com.