Privacy Policy

1. Introduction

This policy is issued by AALA IT SOLUTIONS LLC, trading as AALA IT Solutions. It covers this website and the software services we operate, including systems we run on behalf of business clients.

We only ask for personal information when we genuinely need it to provide a service. We collect it by fair and lawful means, with your knowledge, and we tell you why we are collecting it and how it will be used.

2. What data we collect

Enquiry and account information

Name, work email, company name and anything you choose to tell us in an enquiry form or by email. Where you become a client, the account details needed to provide the service.

Usage data

Pages visited, time spent, traffic source, browser and device information, and interaction data. Collected only where you have accepted analytics cookies.

WhatsApp Business Platform Data

Where a client connects their own WhatsApp Business account to software we operate, we receive and process:

• Message content sent to or from that client's WhatsApp Business account
• The phone number of the person messaging the client
• Their WhatsApp display name and profile information
• Message timestamps and delivery status

For this data the client is the controller and we are the processor. We act only on that client's documented instructions. We are not the controller of their customers' data and we do not decide the purposes for which it is used.

3. How we use data

• To respond to enquiries and provide the services a client has asked for
• To operate, maintain and secure the software we run
• To understand how this website is used, where analytics consent has been given
• To meet legal and regulatory obligations

We do not sell personal data. We do not use client data or Platform Data for advertising.

4. Storage and security

Data is stored on secure servers. We implement:

• Encryption of sensitive data fields
• TLS encryption for data in transit
• Role-based access controls limiting employee access
• Automated backups with disaster recovery procedures

While we maintain industry-standard security, no system is completely secure and we cannot guarantee absolute protection against all threats.

5. Sharing and third parties

We do not sell your data. We share information with the following categories:

Service providers

• Meta Platforms, through the WhatsApp Business Platform, which is how messages are sent and received
• Google Analytics and Microsoft Clarity, website analytics only, and only with consent
• LinkedIn, advertising measurement only, and only with consent

Providers that vary by engagement

We build and operate software for different clients on different infrastructure. Cloud hosting, file storage, payment processing and, where AI features are enabled, the provider that performs inference, are chosen per engagement rather than being the same for every client.

For any system we operate on a client's behalf, the specific providers that process data for that system are identified in the agreement covering that engagement. Clients are told who processes their data before any of it is processed, and are notified of changes.

WhatsApp Business Platform Data

Information we obtain from the WhatsApp Business Platform is accessed and processed only on behalf of the client whose business account it belongs to, and is disclosed only to that client or on that client's instruction. We do not use it for any other purpose, we do not use it for advertising, and we do not use it to train or improve models for any other customer.

Automated replies

Our software includes an optional assistant that can reply to messages automatically on a client's behalf. It is off unless the client turns it on, the client controls its behaviour, and the client can switch it off at any time. Where it is enabled, message content is processed in order to generate a reply.

Legal requirements

• Law enforcement, with valid legal process
• Government agencies as required by law
• Court orders and regulatory bodies

Business transfers

In the case of a merger, acquisition or asset sale, data may be transferred as part of that transaction. We will notify affected parties if this occurs.

6. Retention and deletion

We keep data only for as long as needed to provide the service it relates to, or as required by law.

• Account data is deleted within 30 days of the end of a client relationship
• WhatsApp conversation data is deleted within 30 days of the end of a client relationship
• Enquiry form submissions are kept only as long as the conversation is live

Deletion may be requested at any time, except where we are legally required to retain data.

7. Your rights

General rights

• Access the personal data we hold about you
• Correct data that is inaccurate
• Request deletion of your data
• Restrict or object to how we process it
• Receive a copy of your data in a portable format

California residents

Under the California Consumer Privacy Act you additionally have the right to:

• Know what data is collected
• Delete personal information
• Opt out of the sale of personal information, though we do not sell data
• Non-discrimination for exercising these rights

Where we are the processor

Where we process data on behalf of a business client, requests from that client's own customers should be directed to the client, who is the controller. We will support the client in responding.

How to exercise your rights

Email [email protected] with proof of identity. We respond within 30 days.

8. Cookies

Essential cookies

Necessary for the site to function, including security and remembering your cookie choice. These do not require consent.

Analytics cookies

Loaded only after you accept. Nothing analytics-related runs on this site before you make a choice. With consent we load Google Analytics, Microsoft Clarity and the LinkedIn Insight Tag, as described in section 5.

Withdrawing consent

• Clear your browser cookies, which resets your choice and shows the banner again
• Block cookies in your browser settings, which may affect site functionality
• Use a privacy extension or Do Not Track
• Opt out directly through Google Analytics Opt-out

9. Children

This website and our services are not intended for anyone under 18. We do not knowingly collect data from children, and if we discover such data we will delete it. Parents or guardians who suspect data has been collected from a minor should contact us.

10. International data transfers

Your data may be transferred to and processed in countries other than your country of residence, which may have different data protection laws. Where we transfer personal data internationally we implement appropriate safeguards, such as Standard Contractual Clauses.

11. Do Not Track and Global Privacy Control

No analytics load on this site until you accept them. If you decline, or make no choice, Google Analytics, Microsoft Clarity and the LinkedIn Insight Tag are never loaded.

Some browsers and extensions send a Global Privacy Control (GPC) or Do Not Track (DNT) signal indicating that you do not want to be tracked. We honour both. When your browser sends GPC or DNT we do not load Google Analytics, Microsoft Clarity or the LinkedIn Insight Tag, and we do not show you a cookie banner, because the signal has already answered it.

This applies regardless of any earlier choice. If you previously accepted analytics and later enable GPC, the signal takes precedence and nothing loads.

12. Changes to this policy

We may update this policy from time to time. Changes take effect when posted here, and the date at the top of this page reflects the most recent revision. Continued use of this website after a change is taken as acceptance of the revised policy.

13. Governing law

AALA IT SOLUTIONS LLC is registered in Texas, United States. This policy and any dispute arising from it are governed by the laws of the State of Texas, without regard to conflict of law provisions.

We handle personal data in line with the principles of the General Data Protection Regulation, including lawful basis, data minimisation, purpose limitation and the rights set out in section 7, regardless of where the person is located.

Where we process data on behalf of a client, the agreement covering that engagement may specify additional or different obligations, and that agreement prevails for that data.

14. Contact

Questions about this policy or how we handle personal data can be directed to AALA IT SOLUTIONS LLC using the details in the footer of this site.