Privacy Policy

1. Who we are and our role

WALLIOO (“we”, “us”) provides software that applies an organization’s policies to its use of AI. When we provide the service to a customer organization, that organization is the data controller and WALLIOO acts as its data processor, under a data processing agreement. For the data collected through this website, WALLIOO is the controller.

2. What each component processes

• Browser Guard analyzes the text employees write to AI tools in their browser and replaces personal data with codes before anything is sent; the AI provider only receives the codes. The original message is not stored by WALLIOO. To let the person read the answers with the real values, the codes and their values are kept on the device, encrypted with a key that only WALLIOO Control can release for that device, and deleted after 90 days without use. Where the customer enables company tools for AI agents, the values a person typed in a conversation are sent, encrypted in transit, to WALLIOO Control and kept in memory only, for up to two hours, so that the tool can receive the real value; they are never written to disk or logged, and each use is recorded without the values. Where the customer enables it, documents attached through the WALLIOO panel are processed in memory by the document service and are not stored; and, if usage insights are enabled, the already-anonymized text of a message is classified and only its category is kept.
• Gateway processes requests and responses between AI agents or applications and the systems they call, in transit, to apply the customer’s policies. Payloads are not stored by default.
• Control stores account data for administrators (name, email, role) and usage and decision metadata: which AI or tool was used, by which user or agent, which rule applied and the outcome.
• Professional services: our team accesses the customer’s environment only as needed to deliver the agreed services, under the customer’s instructions and confidentiality obligations.

3. What we never store

WALLIOO does not store the content of prompts or AI responses, the values that were masked, or the content of documents processed by the document service.

4. Retention

Usage metadata and security events are kept for the period configured by the customer — 90 days by default for security events — and deleted at the end of the contract, unless the customer requests an export first.

5. Hosting and location

Each customer’s environment is isolated. It is hosted by WALLIOO on a leading cloud provider in the region agreed with the customer, or deployed in the customer’s own infrastructure. We use a limited number of subprocessors, listed in the data processing agreement, and we do not sell or share personal data with third parties.

6. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, encryption of secrets at rest, role-based access, session expiry and least-privilege access for agents and integrations. See our Security page for details.

7. This website

When you contact us through the form, we use your name, email, company, role and message only to answer you and follow up on your request, on the basis of your request and our legitimate interest. This site does not use advertising or tracking cookies; it only remembers your language choice in your browser.

8. Your rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection. If WALLIOO processes your data on behalf of your employer, please contact your organization’s administrator first; we will assist them. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Changes and contact

We may update this policy as the service evolves; the date at the top shows the latest version. WALLIOO — Madrid, Spain. Contact us →