Updated 15 October 2026
The operator of this site and the controller within the meaning of the GDPR. The operator's registered details are on the Legal notice page.
Your name, type of business, where you would like us to reach you and the contact for that channel — an email address, a phone or WhatsApp number, a Telegram username or number — and a free-text message. You fill in every field yourself; the form collects nothing beyond that.
If you choose WhatsApp or Telegram, the request is saved with us first, and then a chat with our manager opens in that messenger with the text of the request. You send it yourself; the messenger handles what is written there under its own terms.
The purpose is to answer the enquiry and arrange a pilot. The legal basis is your consent, given by a separate unticked box, together with pre-contractual steps taken at your request.
Enquiries are kept for 12 months and then deleted.
Data is stored in the European region eu-central-1 (Frankfurt, EU) on Amazon Web Services.
The demo section lets you talk to the assistant of one of five fictional businesses — a beauty salon, a barbershop, a dental clinic, a car workshop or a hotel. The businesses, the prices, the staff and the calendars are invented; you do not need to enter a real telephone number or email, and the note beside the input says so.
What you type lives only in the server's memory for the length of the conversation and is discarded after 30 minutes without a message. It is not an enquiry: nothing reaches a CRM, nobody will call you, and it is never treated as a lead.
We do keep the conversations themselves, so we can see how the demo is being broken and fix it. Before a line is stored, telephone numbers, email addresses, links and handles are stripped out automatically — they never reach the database at all, rather than being deleted later. Conversations are kept for 14 days and then deleted.
If a message is about health — symptoms, medicines, pregnancy — that turn is not stored at all: neither your text nor the reply. For the dental clinic not a word of the conversation is stored — only which tools the assistant used. To limit the number of messages, the server counts them by IP address and by a random identifier for this page view; both are kept only as an irreversible hash with a secret salt and deleted after two days, and the address itself is never stored.
The basis is our legitimate interest in keeping a public demonstration working and free of abuse.
Necessary and functional: the language you chose, the light or dark theme (only if you switched it yourself), your answer to the cookie banner, the business you picked in the demo (kept in the tab until it is closed), and a flag saying this browser has signed in to the app before. That flag holds the digit 1 — no token, no identifier, nothing about you — and affects only the wording of a button in the header and where it leads. It grants nothing: every access decision is made in the app.
Analytics: if you chose "accept", the live demo section counts five steps: that the section was seen, which business you picked in the switcher, that a conversation was started, that a booking was reached inside the demo, and that the enquiry form was opened or sent. These are our own counters, sent to our own server; they contain no text, no contact details and no IP address, and the visit identifier is generated in your browser for one page view and does not survive a reload. Each step records which of the fictional businesses was on screen. If you chose "necessary only", nothing is sent.
Advertising: if you chose "accept", the Google Ads tag is loaded (Google Ireland Limited, Ireland). It sets cookies — chiefly _gcl_au, kept for 90 days — and tells Google about the visit: the page address, your IP address, browser details and, if you arrived from an ad, the click identifier. This shows us which ads bring visitors and enquiries, and lets Google show our ads to people who have already been here. Google Tag Manager (the same company) is loaded with it: it is how we set which Google tags run on the site and which actions count as an enquiry. Tag Manager itself sets no cookies, and it too is loaded only after your consent. Google may transfer this data to the United States, relying on the EU–US Data Privacy Framework and standard contractual clauses. The legal basis is your consent (Art. 6(1)(a) GDPR). Until you answer the banner, or if you chose "necessary only", the tag is not loaded and not a single request goes to Google. How Google handles the data is described at policies.google.com/privacy.
Advertising on Facebook and Instagram: if you chose "accept", the Meta Pixel is loaded (Meta Platforms Ireland Limited, Ireland). It sets the cookies _fbp and, if you arrived from a Meta ad, _fbc — kept for 90 days — and tells Meta about the visit: the page address, your IP address, browser details, and that you sent an enquiry or pressed the trial button. This shows us which ads on Facebook and Instagram bring visitors and enquiries, and lets Meta show our ads to people who have already been here. We and Meta are jointly responsible for collecting this data and passing it to Meta (Meta's Controller Addendum); what Meta does with it afterwards is Meta's own processing. Meta may transfer the data to the United States, relying on the EU–US Data Privacy Framework and standard contractual clauses. The legal basis is your consent (Art. 6(1)(a) GDPR). Without your consent the pixel is not loaded and not a single request goes to Meta. How Meta handles the data is described at facebook.com/privacy/policy.
You can change your answer or withdraw consent at any time — with the "Cookies" link at the bottom of the home page or the "Cookie settings" button at the end of this policy. After withdrawal the Google tags and the Meta Pixel are no longer loaded, and their cookies on this site are deleted.
Access, rectification, erasure, restriction of processing, portability and objection. Write to the address above and we will answer within one month, as the GDPR requires.
You have the right to complain to a supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD, aepd.es); in Germany, the authority of the relevant federal state.
When a business uses Ally-agent we act as its processor and the business remains the controller. The relationship is governed by a data processing agreement.
Sub-processors: Amazon Web Services (hosting and model, EU region), the messaging platforms the business connects itself (Telegram, Meta, telephony), and the voice synthesis provider. The full list with regions is provided on request and as an annex to the DPA.
Legal basis: the contract with the business on whose behalf we process its customers' data. Retention: a customer's data is kept for 12 months after their last contact with the business (a booking, a message, a call) and then anonymised automatically — name, phone, messenger identifiers and notes are removed, while the bookings remain as anonymous visit statistics. A business's customer may ask for their data to be deleted at any time — through the business (which has a delete button on the customer's card) or by writing to us; it is done without delay and the visit statistics do not change. Every export of a customer base by a business is logged: who, when and how many rows.