Privacy policy

Two roles

For people who use a client’s website or phone line (visitors and callers), the client decides why and how their data is used; WAFL processes it on the client’s behalf as a processor. Questions about that data are best sent to the business itself, and we will help them answer.

For our own clients’ account details (name, email, billing), WAFL is the controller.

What we collect

Visitors and callers: what they write or say to the assistant, any details they choose to give (such as name, phone, email and what they need), the page they were on, and call recordings’ transcripts.

Website analytics: pages viewed, time on page, the referring website and campaign tags, screen width, and random visit identifiers kept in the browser. We use no cookies for this and do not store IP addresses.

Clients: account email, business details and settings, and usage for billing.

How we use it

To run the service for the client: answering visitors, recording leads, handovers and calls, CRM and follow-ups, analytics and the client’s agents.

To keep the service secure and working, including rate limits and abuse prevention.

We do not sell personal data, use it for advertising, or use one client’s data to serve another client.

AI

Replies are written by an AI model (see AI disclosure). Visitors are told they are speaking with an AI assistant. Our AI providers process conversation text to produce replies and do not use it to train their models under our agreements with them.

Sharing

We use the providers listed on our sub-processors page to run the service. Clients may also connect their own systems (for example HubSpot, Pipedrive or a webhook), in which case data is sent there on the client’s instruction.

Where data is stored

Data is stored with our database provider in the United States. Transfers from the UK and EU rely on the standard contractual clauses or the provider’s certification under the applicable data transfer framework. An EU data location is available for clients that need it.

How long we keep it

Conversations, leads and CRM records are kept while the client’s account is active, unless the client deletes them sooner. When an account is closed, its data is deleted within 30 days, except where we must keep billing records by law.

Your rights

You can ask for access to, correction of or deletion of your personal data, or object to its use. If your data came through a business’s website or phone line, contact that business, or email info@waflgroup.com and we will pass on and support your request. You can also complain to your data protection authority.

Security

Data is encrypted in transit and at rest, access is limited to people who need it, accounts use emailed one-time codes rather than passwords, and each client can only see its own data.

Contact

WAFL Group · info@waflgroup.com