LAST UPDATED 5 NOVEMBER 2026
Privacy notice
This notice explains how OAW Solutions Limited, which provides Lorelo by Vallamo ("we", "us"), handles personal information. It is written for two groups: businesses that use the service, and the people who phone or message those businesses.
1. Who we are
Lorelo by Vallamo is provided by OAW Solutions Limited, registered in England and Wales (company number 17266481) and registered with the Information Commissioner's Office (registration number ZC260258). For anything about your data, contact support@vallamo.com.
This notice applies under the UK GDPR and Data Protection Act 2018, and, for people in the EU, EEA and Switzerland, under the EU GDPR and Swiss FADP.
2. Our two roles
When you are our customer (a business that signs up), we are the controller of your account, billing and support information. This notice covers that.
When someone phones or messages a customer's business, that business is the controller of the conversation and we are its processor, acting only on its instructions under our terms and data processing agreement. If you called or messaged a business that uses Lorelo by Vallamo, that business's own privacy notice governs your data and you should contact it first. We will pass requests on and help the business answer them.
3. What we collect
| Who | What | Where it comes from |
|---|---|---|
| Business customers | Name, business name, email, phone number; a password (stored only as a one-way hash); plan and billing status (card details are entered with Stripe and never reach us); the opening hours, services, prices and answers you give us | You |
| Callers | The number they ring from (unless withheld); a written transcript of the call made as it happens; date, time, length and outcome; a short AI-written summary; anything they say, such as a name, callback number or booking request. We do not record or keep call audio. | The call |
| People who message a connected WhatsApp or Instagram account | Their message content, their identifier on that channel (for example a phone number or username), and delivery status | The messaging platform |
| Customers whose bookings are made | Name, mobile number, the service and time booked, written into the business's connected Google Calendar | The call or message |
| Connected accounts | Google Calendar: free/busy times and the events we create, for the one calendar chosen. Instagram and WhatsApp: the account identifiers and an access token issued by Meta. Tokens are stored encrypted and never sent to your browser | The business, through the platform's own sign-in |
| Everyone using the dashboard | A sign-in token, logs of requests (time, address, result), device and browser details, and error reports needed to run and secure the service | The device |
4. Why we use it, and our legal bases
| Purpose | Legal basis |
|---|---|
| Provide the service to businesses: set up accounts, answer calls and messages, make bookings, pass matters to the team, bill | Contract |
| Send service emails: sign-up confirmation, receipts, security and account notices | Contract and legitimate interests |
| Keep the service secure, prevent abuse and fraud, fix faults, measure and control costs | Legitimate interests |
| Answer support requests and demonstrate compliance | Legitimate interests |
| Meet tax, accounting and legal obligations | Legal obligation |
| Process callers' and message senders' data for a business that uses the service | The business's own legal basis; we act as its processor |
5. AI and automated handling
Calls are answered by an AI assistant that listens through a speech-to-text provider, writes its reply with a language model, and speaks it through a text-to-speech provider. Text replies on WhatsApp and Instagram are written by a language model. The assistant says it is an AI whenever asked, and callers can ask for the business's team. It answers only from the details the business provides, and asks callers to confirm names and numbers because speech recognition is imperfect.
It confirms a booking only after the caller has clearly agreed and the calendar has recorded it. It does not cancel, move or transfer bookings and does not send text messages; those requests, and anything uncertain, go to the business's staff as a follow-up. It does not make decisions that have legal or similarly significant effects on anyone. Businesses should tell their own callers that calls are answered by an AI assistant.
6. Who we share it with
Only with the service providers listed on our sub-processors page (hosting, database, AI, voice, telephone, email, payments and the platforms a business chooses to connect), with advisers under confidentiality, and with authorities where the law requires. Google Calendar data is used only to provide the booking feature and follows the Google API Services User Data Policy, including its Limited Use requirements. Meta platform data is used only to send and receive that business's messages. If our business is sold or reorganised, personal data may transfer to the new owner under this notice.
7. Transfers outside the UK and EEA
Several providers are in the United States. We rely on the provider's certification under the UK-US data bridge or EU-US Data Privacy Framework where it has one, and otherwise on the UK International Data Transfer Addendum and EU Standard Contractual Clauses, supported by a transfer risk assessment. Ask us which safeguard applies to a provider.
8. How long we keep it
| Data | Kept for |
|---|---|
| Call transcripts, summaries and caller numbers | The period the business sets: 90 days unless it chooses another, never more than two years. Then removed. A message left for the team is kept until marked done, then for the same period |
| Call audio | Not recorded or kept |
| Message content and sender identifiers | The same business-set period |
| Call minutes and message counts used for billing | Kept as counts that do not identify anyone |
| Google and Meta connections | Only while connected. Disconnecting deletes the stored tokens straight away; removing access in your Google or Meta settings also stops them working |
| Account and billing records | For the life of the account, then up to six years for tax and accounting law |
| Closed accounts | Closure has a 7-day change-of-mind period and stops billing at once. After that your data is erased once final billing is settled, after offering you a download. Copies held by providers are removed on their own schedules and backups age out within about 35 days |
| Security and error logs | Up to 90 days |
9. Security
Encryption in transit; encryption of stored Google and Meta credentials; separation of each business's data at database level; signed, time-limited access between our systems; request limits; logs of important events that exclude passwords, tokens and message text. No system is perfectly secure. If a breach affects personal data we will tell affected businesses without undue delay and notify the ICO where required.
10. Your rights
You can ask to see, correct or delete your data, restrict or object to its use, receive it in a portable form, and withdraw consent where we rely on it. Email support@vallamo.com. We verify identity and reply within one month (extendable by two months for complex requests, which we will explain). We do not charge unless a request is clearly unfounded or excessive.
Business owners can download their data and close their account from their dashboard settings. If your request concerns a call or message with another business, we will pass it to that business, which decides it.
Facebook or Instagram data: remove our access in your Meta settings (this stops it immediately), or ask the business to disconnect the channel, or email us and we will delete our copy. Meta can also send us a deletion request, which we process automatically.
You can complain to the ICO (ico.org.uk), or to your local supervisory authority in the EEA or Switzerland. We would like the chance to put things right first.
11. Cookies
Our website sets no cookies. The sign-in app uses only the browser storage it needs to keep you signed in. See the cookie notice.
12. EU, UK and Swiss representatives; US residents
We are established in the UK. Because we also offer the service to people in the EU and Switzerland, our representatives are reachable at eu.representative@vallamo.com (EU, The Hague) and ch.representative@vallamo.com (Switzerland, Lugano). US residents may have rights under state privacy laws to know, access, correct and delete their data, and to opt out of sale or sharing; we do not sell or share personal data. Use support@vallamo.com.
13. Children
The service is for businesses and is not directed at children. We do not knowingly collect children's data through our own website or dashboard.
14. Changes and contact
We will post changes here with a new date and tell customers about material ones. Questions: support@vallamo.com, OAW Solutions Limited. This notice should be read with our terms.