Login Demo

Privacy

How we achieve GDPR compliance.

Automated customer communication means personal data, and often special categories — health details in a claim, for instance. That isn't small print, so here it is spelled out.

Art. 28Processing on your behalfWe act as your processor. Before you go live we sign a data processing agreement setting out purpose, scope and instruction.
Art. 5Purpose limitation and minimisationWe collect what the process needs, not what would be technically possible. You define which fields an agent extracts.
Art. 32Technical measuresEncryption in transit, encrypted storage, role-based access, logged access. The full measures come as an annex to the agreement.
Art. 22No automation without a humanNo agent makes a decision with significant effect on its own. That is exactly why handover to a human is built into the product and cannot be switched off.
Art. 15–20Data subject rightsAccess, rectification, erasure and portability can be executed per contact — including the associated chat history.
Art. 6A lawful basis in the channelWhatsApp communication needs a solid basis. We set up opt-in and notices so they are documented and demonstrable.
Art. 30Evidence on demandYour own record of processing activities needs categories, recipients, processing locations and deletion periods. Ours are not buried in an email but written out in the DPA and its annexes, including the full list of sub-processors.
Art. 33If something does go wrongIf we become aware of a personal data breach, we notify you without undue delay and with the information required by Art. 33(3) — so your 72-hour deadline towards the supervisory authority is not spent hunting for facts.

Concrete questions

Where is data processed?

The alkaio platform runs on STRATO AG servers in German data centres, with Cloudflare as the upstream content delivery network. WhatsApp is connected through Meta Platforms Ireland's official WhatsApp Business Platform (Cloud API); content is stored there only temporarily and, with local storage enabled, within the EU or Germany.

Is my customer data used to train AI models?

No. We use language models from OpenAI, Anthropic and Google as processors. They process content strictly on instruction to deliver the service, not to train their own models. Transfers to the US are covered by safeguards under Art. 44 et seq. GDPR.

How long are chat histories kept?

According to a retention concept we agree with you. Server logs are deleted after 14 days at the latest; the Cloud API stores content only temporarily, usually for no more than 30 days.

What happens in a data breach?

We notify you of any reportable incident without delay, with the detail you need for your own notification under Art. 33.

Can customers object to processing?

Yes. An objection is recorded on the contact and no further automated messages go out from that point.

Do I get documentation for my own records?

Yes: the processing agreement with technical measures, a description of the processing activity for your record of processing, and, where needed, input for your impact assessment.

This page describes our implementation. It is not legal advice — responsibility for the deployment in your own business stays with you.

See it on a real thread.

Message alkaio on WhatsApp — no form, no signup. Or book a 30-minute demo and we'll walk through your process.

Message on WhatsAppBook a demo