In short
- We only process the data needed to run IoAlly for you and to invoice you.
- We don’t sell data, show ads, or train AI on your content.
- Only technical cookies: no banner, no tracking.
- Visitors’ conversations are deleted automatically after 12 months.
The summary helps you find your way; the full text below is what applies.
Who this is for
This notice explains how IoAlly processes the data of people who sign up to the service ("customers") and of visitors to www.ioally.com. Conversations with visitors to customers’ websites are processed on behalf of the customers: see section 2.8. Conversations with our own assistant on www.ioally.com are ours: see section 2.9.
2.1 Controller
Valerio Tocci, sole proprietorship, Italian VAT number 18201181007, Via Camillo Serafini 15, 00164 Rome, Italy. For any privacy request: support@ioally.com.
2.2 What data we process and why
| Data | Why | Legal basis |
|---|---|---|
| Sign-in email, sign-in codes and sessions | Creating your account and signing you in | Performance of the contract |
| Assistant data: website, pages read, answers you write (even without a website), settings, notification email | Providing the service | Performance of the contract |
| Billing data: business name, address, VAT number, last digits of the card, payment history | Collecting the subscription and issuing invoices | Contract and legal (tax) obligations |
| Usage counts (conversations per day) | Applying plan limits and showing you statistics | Performance of the contract |
| Service emails: notifications, alerts, Monday email, confirmation that the assistant is online | Keeping you informed about the service | Performance of the contract (you can turn notifications off in Settings) |
| A single help email, a few days after signing up, if the assistant is not online yet | Helping you finish the setup | Legitimate interest |
| Installation requests ("You do it"): website platform, notes you write to us, collaborator access you grant us | Installing the assistant on your website | Performance of the contract |
| Technical data: IP address, browser, error logs, anti-abuse counters, automatic alerts to our administrators when something breaks | Security and operation of the service | Legitimate interest |
| Messages sent to support@ioally.com | Answering your requests | Performance of the contract or legitimate interest |
| Conversations with the Ally assistant on www.ioally.com and contact details you leave there (section 2.9) | Answering your questions about IoAlly and getting back to you if you ask | Pre-contractual steps at your request; legitimate interest for general questions |
We don’t sell data or use it for advertising. We don’t use your content or conversations to train artificial intelligence models.
2.3 Providers processing data on our behalf
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the app and website, routing requests to the AI | USA and EU |
| Neon Inc. | Database | USA |
| OpenAI (or Microsoft Azure as a fallback), through Vercel | Generating the assistant’s answers | USA |
| Alibaba Cloud, through Vercel | Checking conversations: recognising when a visitor leaves a request and extracting its details for the customer | Outside the EU |
| Resend Inc. | Sending emails | USA |
| Stripe Payments Europe Ltd. | Payments and card data (we never see it) | EU and USA |
| Cloudflare Inc. | Domain and incoming email management | USA and EU |
| GitHub Inc. (Microsoft) | Nightly database backups, encrypted (AES-256) and kept for 30 days | USA |
Requests to the artificial intelligence go through Vercel with the zero data retention option: AI providers use the texts only to generate the answer, do not keep them and do not use them to train their models (OpenAI may hold them briefly only for safety checks against abuse).
2.4 Transfers outside the European Union
Some providers process data in the United States or in other countries outside the European Union. Transfers rely on the EU-US Data Privacy Framework, for providers that have joined it, or on the standard contractual clauses approved by the European Commission.
2.5 How long we keep data
- Account and assistant data, including installation requests: while the account is active; deleted within 30 days of closing it
- Encrypted database backups: 30 days, then deleted automatically (so a closed account’s data may stay in backups for up to 30 more days)
- Billing data: 10 years, as required by tax law
- Sign-in codes: 15 minutes; sign-in sessions: 30 days
- Technical logs and anti-abuse counters: at most 30 days
- Conversations with the assistant on www.ioally.com and contact details left there: 12 months from the last message, then deleted automatically
2.6 Your rights
You can ask at any time to access, correct or delete your data, restrict its processing, object to processing based on legitimate interest, and receive it in a readable format (portability). Write to support@ioally.com: we reply within 30 days. You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
2.8 Visitors to our customers’ websites
When you write to the assistant on the website of a business that uses IoAlly, or through its link or QR code, your messages and the contact details you leave go to that business, which is the controller. IoAlly processes them only on its behalf, as processor. To exercise your rights, contact the business; if you write to us, we will forward your request.
Answers are generated by an artificial intelligence system. Conversations, and questions left unanswered, are deleted automatically after 12 months, or earlier if the business closes its IoAlly account.
2.9 The Ally assistant on www.ioally.com
On our website you can ask Ally, our artificial intelligence assistant, questions about IoAlly. For these conversations we are the controller (section 2.1), not a customer.
We process the messages you write and, if you leave them, your name and contact details, to answer you and get back to you. They reach us by email and in our private area. Please don’t write data that isn’t needed, such as health or bank details.
Answers are generated by an artificial intelligence system and may contain mistakes: for prices and conditions, the website pages and the Terms apply. We use the same providers listed in section 2.3, with zero data retention on AI requests. Conversations are deleted automatically 12 months after the last message. Section 2.6 explains your rights.
2.10 Changes
We may update this notice. The date at the top shows the latest version; customers will be notified of important changes by email.
A question about this document?
A real person answers, within two working days.