Privacy policy

<h1>Privacy Policy</h1>

<p><strong>Version 1.4.0</strong></p>

<p><strong>Effective date: 9 June 2026</strong></p>

<h2>1. Introduction</h2>

<p>AllSet Digital Ltd ("we", "our", or "us") provides AllSet, a multi-channel platform that helps businesses manage bookings, payments, and customer conversations within messaging channels. This Privacy Policy explains how we collect, use, and protect personal information.</p>

<p>It applies to everyone who uses AllSet, however they obtained it, whether by direct purchase, through a partner, or via an affiliate or discount. It applies to users in the United Kingdom, the European Economic Area (EEA), the United States, and elsewhere.</p>

<h2>2. Definitions and Our Role</h2>

<ul>
  <li><strong>Tenant:</strong> a business or individual that uses AllSet to operate within messaging channels.</li>
  <li><strong>Customer:</strong> an individual who communicates with a Tenant through AllSet.</li>
</ul>

<p>When we process a Customer's personal data to deliver the service a Tenant has set up, the Tenant is the data controller and we act as a processor on their instructions, governed by a Data Processing Agreement. When we process personal data for our own purposes, such as operating, securing, and improving our services, we act as a controller.</p>

<h2>3. Channels</h2>

<p>AllSet operates across the messaging channels a Tenant connects, such as WhatsApp Business, Instagram, Facebook Messenger, TikTok, and SMS and voice services via providers including Twilio. We comply with the terms and policies of each channel. When you use a third-party platform to reach a Tenant, that platform's own privacy policy and terms also apply.</p>

<h2>4. Information We Collect</h2>

<p>What we collect depends on the channel used. We collect only what is needed to provide our services.</p>

<ul>
  <li><strong>Information you provide:</strong> profile information made available by the channel (such as name, phone number, or messaging handle), booking and payment details, and the content of your communications.</li>
  <li><strong>Information collected automatically:</strong> channel metadata, usage and device data, technical data including IP address, and approximate location where enabled.</li>
</ul>

<p>For US state privacy laws, the categories of personal information we collect are: identifiers; customer and transaction records; internet and network activity; geolocation; and inferences. We collect these to provide, secure, and improve the service, and we do not collect them in order to sell them or share them for targeted advertising.</p>

<h2>5. How We Use Your Information</h2>

<p>We use personal information to:</p>

<ul>
  <li>Provide and manage bookings, payments, and transactions</li>
  <li>Enable Tenants to communicate with their Customers, including follow-ups and outreach a Tenant directs</li>
  <li>Provide customer support and maintain and secure our systems</li>
  <li>Improve and develop our services (using anonymised data, as described in Sections 6 and 8)</li>
  <li>Send service and marketing communications, with an opt-out option</li>
  <li>Comply with legal obligations and prevent fraud</li>
</ul>

<h2>6. AI and Model Training</h2>

<p>We do not use identifiable personal data to train AI or machine-learning models by default. We use anonymised data, which carries no personally identifiable information, for training and product development. If we decide to use identifiable information for training, it will be opt-in, and we will ask the relevant Tenants and Customers first.</p>

<h2>7. Legal Basis for Processing (UK and EEA)</h2>

<p>Where the UK GDPR or EU GDPR applies, we rely on the following legal bases: performance of a contract, compliance with legal obligations, our legitimate interests in operating and improving the service, and consent where required. You may withdraw consent at any time.</p>

<h2>8. Data Retention</h2>

<p>We retain conversational data for a target period of up to 90 days, to provide and support the service and maintain our systems. We then delete it or remove all personally identifiable information from it. We aim to remove personally identifiable information within a target period that currently does not exceed 120 days, using reasonable efforts; in limited cases, such as backups or legal or security matters, this may take longer, and we complete it as soon as reasonably practicable. Anonymised data is no longer personal data and may be retained and used as we see fit. We may also retain information for longer where required by law or to protect our legitimate interests.</p>

<h2>9. Data Sharing and Disclosure</h2>

<p>We may share personal information with: the relevant Tenant or Customer; service providers and processors who help us deliver the service (such as hosting, payment, and messaging providers); the platforms that operate the channels; partners and affiliates, limited to data needed for billing and administration; group companies; a buyer or successor in a merger or acquisition; and legal authorities where required by law.</p>

<p>We do not sell personal information, and we do not share it for cross-context behavioural (targeted) advertising, as defined under US state privacy laws.</p>

<h2>10. Data Security</h2>

<p>We use appropriate technical and organisational measures to protect personal information, including encryption in transit and at rest, access controls, and secure storage. No method of transmission or storage is completely secure.</p>

<h2>11. Your Rights</h2>

<p><strong>UK and EEA.</strong> You have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, to withdraw consent, and to lodge a complaint with a supervisory authority.</p>

<p><strong>United States.</strong> Residents of states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Utah, and Texas) have the right to access, delete, and correct their personal information, to data portability, to opt out of any sale or sharing, and to non-discrimination for exercising these rights. As noted above, we do not sell or share personal information for targeted advertising.</p>

<p>To exercise your rights, contact privacy@allset.chat. Where a Tenant is the controller of the relevant data, we will direct or assist with your request. We may need to verify your identity, and you may use an authorised agent.</p>

<h2>12. International Data Transfers</h2>

<p>We are based in the United Kingdom, and our infrastructure is located in the United Kingdom and the EEA. If you use AllSet from outside this region, your personal information will be transferred there. Where we transfer personal information across borders, we use appropriate safeguards, such as adequacy decisions, standard contractual clauses, and the UK International Data Transfer Addendum.</p>

<h2>13. Cookies</h2>

<p>Our website may use cookies and similar technologies for functionality, security, and analytics, and not for targeted advertising. Where required, we will seek your consent before placing non-essential cookies.</p>

<h2>14. Children's Privacy</h2>

<p>AllSet is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact privacy@allset.chat and we will delete it.</p>

<h2>15. Changes to this Policy</h2>

<p>We may update this policy from time to time. We will notify users of significant changes and update the version and effective date above.</p>

<h2>16. Contact and Complaints</h2>

<p>For privacy enquiries, contact:</p>

<p><strong>AllSet Digital Ltd</strong>, 40&ndash;41 Great Castle St, London W1W 8LU, United Kingdom (company number 16034768), privacy@allset.chat.</p>

<p>UK users may complain to the Information Commissioner's Office (www.ico.org.uk, 0303 123 1113). EEA users may complain to their local data protection authority. US users may contact their state Attorney General. We ask that you contact us first so we can try to resolve the matter.</p>

<hr>

<p><em>Last modified: 9 June 2026</em></p>