Updated 5 October 2026
This agreement is concluded between the business that uses Ally-agent (the "Controller") and the operator of the service named in the legal notice (the "Processor"). It forms part of the service agreement and applies from the moment the Controller starts using the service, for as long as the service is used.
The Controller decides why and how its customers' personal data is processed and remains responsible for the lawful basis of that processing. The Processor processes the data only on the Controller's behalf, as described here.
The Processor provides an AI assistant with a customer base and calendar. On the Controller's behalf it answers enquiries in messengers, on the website and, where enabled, by phone; makes, moves and cancels bookings; sends reminders, review requests and the messages the Controller composes; keeps the customer base; and shows the Controller the analytics computed from its own data.
The processing lasts for the term of the service agreement and ends with the deletion or return of the data as described below.
Data subjects: the Controller's customers and the people who contact it; the Controller's own staff who use the service (accounts, roles, working hours).
Data: name, phone number, messenger identifiers and handles, language; the content of messages and calls, including transcripts and, where the Controller switches it on, call recordings; bookings (service, time, staff member, price, status); the notes and tags the Controller adds; consent and opt-out marks; the technical records needed to deliver messages.
The service is not intended for special categories of data. Where the Controller is a healthcare provider, the mere fact of a booking may reveal health-related information; the Controller remains responsible for the legal basis of such processing and instructs the Processor accordingly.
The Processor processes personal data only on the Controller's documented instructions: this agreement, the settings the Controller makes in the service (channels, knowledge base, policies, team rights) and any written instruction. If the Processor considers an instruction to infringe data protection law, it informs the Controller without delay.
Everyone acting under the Processor's authority with access to personal data is bound by confidentiality.
Technical and organisational measures: data is stored and processed in the European Union (AWS, Frankfurt region); it is encrypted in transit and at rest; each business lives in its own isolated database schema, so no query of one business can reach another's data; access is by role, and the owner decides which members may see the customer base, the revenue and the export; exports and platform-side access to a business's data are written to an audit log; credentials and keys are kept in a managed secret store; the database is backed up automatically every day; on phone calls the assistant discloses that it is an AI and that the call may be recorded.
The Controller gives general authorisation for the following sub-processors: Amazon Web Services (hosting, database, backups, and the AI models served through Amazon Bedrock in the EU region); Meta — WhatsApp, Instagram and Messenger — and Telegram, each only when the Controller connects that channel; Twilio (telephony) and ElevenLabs (voice synthesis and call handling), only when the Controller enables phone calls.
The Processor informs the Controller of any intended addition or replacement at least 14 days in advance. The Controller may object on reasonable grounds; if no solution is found, the Controller may terminate the affected part of the service.
Hosting, the database and the AI models stay in the European Union. Messaging and voice providers may process data outside the European Economic Area under their own terms; where they do, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision. The Controller chooses which of those channels to connect.
A customer's personal data is kept for 12 months after the customer's last contact with the Controller — a booking, a message or a call — and is then anonymised automatically: name, phone number, messenger identifiers, notes and tags are removed, and the bookings remain as anonymous visit statistics.
On the Controller's request — or when a customer asks the Controller or the Processor directly — the Processor deletes a customer's personal data without undue delay and at the latest within 30 days, in the same way. The Controller can do this itself at any time from the customer's card. Every export of the customer base is logged with who, when and how many rows.
When the service agreement ends, the Controller may export its data for 30 days; the Processor then deletes the personal data and keeps only anonymised aggregates, unless Union or Member State law requires the data to be kept longer. Backup copies are overwritten in the ordinary rotation within days.
Taking into account the nature of the processing, the Processor assists the Controller in responding to requests to exercise data subject rights: access, rectification, erasure, restriction, portability (the customer base can be exported) and objection (a customer who replies with a stop word receives no further messages). Requests that reach the Processor directly are forwarded to the Controller without undue delay.
The Processor assists the Controller with the obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultation of a supervisory authority, taking into account the information available to it.
The Processor notifies the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information the Controller needs for its own notification, and cooperates in containing and investigating it.
The Processor makes available all information necessary to demonstrate compliance with this agreement and allows and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it: once in any 12-month period or after a personal data breach, with 30 days' notice, during business hours, under a confidentiality undertaking and at the Controller's expense.
This agreement lasts as long as the service agreement; the obligations on deletion and confidentiality survive its end. Liability follows the service agreement and Article 82 of the GDPR. The governing law and venue are those of the service agreement; in matters of personal data this agreement prevails.
Questions about this agreement go to the contact address given in the legal notice.