Privacy policy

Last updated: October 25, 2026

This policy explains how alvumo collects and uses personal data when you visit alvumo.com, contact us, or use the alvumo platform: software that lets businesses run AI agents that talk to their customers through messaging apps and social networks, such as WhatsApp.

Who is responsible for your data

alvumo is the trade name of Juan C. Yamacho H., a self-employed professional registered in Spain. For any question about this policy or your data, write to contact@alvumo.com.

Our two roles

• Controller. For data about people who visit this website, contact us, or hold an account on the platform, alvumo decides how the data is used.
• Processor. When a business uses alvumo to talk to its own customers, for example a travel agency that answers WhatsApp messages, that business is the controller of those conversations. alvumo processes them on its behalf, following its instructions and under a data processing agreement. If you are a customer of one of those businesses, contact the business to exercise your rights. If you contact us instead, we will forward your request to it.

Data we collect

• Inquiries. Your name, email address and the content of your message when you contact us.
• Platform accounts. Name, email address, company name, sign-in data, account settings and, for paid plans, billing details.
• Connected accounts. When a business connects a WhatsApp Business account, a Facebook Page, an Instagram account or another channel, we receive the identifiers and access tokens needed to operate it, such as the WhatsApp Business Account ID, phone number ID and display name, and the content the business sends or receives through it.
• Conversations. For people who message a business through a connected channel: phone number or platform user ID, profile name, message content (text, images, audio and documents), timestamps and delivery status, plus the replies written by the business's team or generated by its AI agents.
• Business content. Documents, instructions and settings that a business provides to configure its agents.
• Technical data. IP address, browser type and request logs, used to run and secure the service.

The alvumo.com website does not use analytics or advertising cookies or trackers. The platform uses only the cookies needed to keep you signed in.

How we use data and on what legal basis

• To provide the platform: connecting channels, sending and receiving messages and running AI agents. Basis: performance of a contract (Art. 6(1)(b) GDPR).
• To answer your inquiries and prepare proposals. Basis: steps you ask for before a contract (Art. 6(1)(b)) or our legitimate interest in replying (Art. 6(1)(f)).
• To keep the service secure, prevent abuse and fix errors. Basis: legitimate interest (Art. 6(1)(f)).
• To meet invoicing, tax and accounting obligations. Basis: legal obligation (Art. 6(1)(c)).
• To process conversations on behalf of business customers. Basis: their instructions, under Art. 28 GDPR. Each business is responsible for having a legal basis to talk to its customers and for informing them.

We do not sell personal data, use it for advertising, or use it to build profiles for any other purpose.

AI agents

Messages handled by an AI agent are sent to third-party AI model providers to generate replies. We use these providers under terms that do not allow them to train their models on that data, and we do not train models of our own on customer data.

Each business decides what its agents can do, such as answering questions or preparing a quote, and must tell its customers when they are talking to an AI agent. Agents do not make decisions with legal or similarly significant effects on people.

Data from Meta and other platforms

When a business connects WhatsApp, Messenger, Instagram or another platform, we use the data received through that platform's API only to provide alvumo's features to that business. We follow the Meta Platform Terms and the policies of each platform: we do not sell, license or buy platform data, we do not use it for advertising or to build user profiles, and we delete it when the business disconnects the account, when a user asks us to, or when we no longer need it.

Who we share data with

We share data only with the following recipients, and only as far as each one needs:

• Meta (WhatsApp Business Platform, Messenger and Instagram) and the other platforms a business connects, to send and receive its messages.
• Cloud hosting and infrastructure providers, such as Cloudflare.
• AI model providers, to generate agent replies.
• Email and payment providers.
• Public authorities, when the law requires it.

Our service providers act on our instructions under contracts that require them to protect the data. We will send you the current list on request.

International transfers

Some providers are located outside the European Economic Area, mainly in the United States. In those cases we rely on an adequacy decision, such as the EU-U.S. Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses.

How long we keep data

• Inquiries: up to one year after the last contact, unless they lead to a contract.
• Account data: while the account is active, and deleted within 30 days after it is closed.
• Conversations and connected accounts: for as long as the business decides, and deleted within 30 days after the business deletes them, disconnects the channel or ends its contract.
• Billing records: for the period required by Spanish tax and commercial law, up to six years.
• Technical logs: up to 90 days.

Security

We protect data with technical and organisational measures that include encryption in transit, access controls, and encrypted storage of the access tokens for connected accounts.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, or to receive it in a portable format. Where processing relies on your consent, you can withdraw it at any time. Write tocontact@alvumo.com and we will reply within one month.

You can also file a complaint with the Spanish Data Protection Agency (www.aepd.es).

How to request deletion of your data

• Business customers. Email contact@alvumo.com from your account's address. When you disconnect a channel from the platform, we stop accessing it and delete its access tokens.
• People who messaged a business through alvumo, for example on WhatsApp. Ask the business, or email contact@alvumo.com with the subject “Data deletion request”, the phone number or account you used and the name of the business. We will notify the business, delete your data within 30 days unless the law requires us to keep it, and confirm by email.

Children

alvumo is a service for businesses and is not directed at children. We do not knowingly collect data from children under 14. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will update this page when our practices change and update the date at the top. If a change is significant, we will notify business customers by email before it takes effect.