Privacy Policy

§ 01Who we are

Zatio provides an AI-powered WhatsApp assistant for businesses (“Operators”) to handle inbound sales enquiries, qualify leads, and manage bookings.

• Data controller for website visitors: Zatio (the operator named above)
• Data processor for WhatsApp end-user conversations: Zatio acts on behalf of each Operator, who is the data controller of their own customers’ data

§ 02Information we collect

From website visitors

• Contact details you submit via forms (name, email, company, phone)
• Technical data (IP address, browser type, referrer) for security and analytics
• If you ask for a test call and name your business, we look up that business’s public listing on Google Maps (Google Places API) to prepare the call. Google’s Privacy Policy applies to that lookup.
• Cookies — see our Cookie Policy

From WhatsApp end users (on behalf of Operators)

When you message a business that uses Zatio via WhatsApp, we process:

• Your phone number and public WhatsApp profile (name, profile photo)
• The content of messages you send and receive
• Metadata (timestamps, delivery and read receipts)

From callers who phone an Operator’s Zatio number

Some Operators let an AI assistant answer their phone line. The assistant says it is an AI at the start of every call. When you call one of these numbers, we process:

• Your phone number (unless you withhold it), the number you called, the time, length and language of the call
• A written transcript of what you and the assistant say
• Any details you choose to give (for example your name, email or a booking)

The audio is processed in real time by our providers: Twilio for the telephony, our voice bridge hosted on Fly.io (Frankfurt), Google Gemini for understanding and producing speech, Google Cloud Text-to-Speech for some spoken replies, and Anthropic to write a short summary for the Operator’s team after the call. The audio is not recorded. Only the transcript is stored, and it is kept for the same period as chat conversations (see Retention).

From Operators who connect WhatsApp through Meta

When an Operator connects their WhatsApp Business Account to Zatio with Meta’s Embedded Signup (Facebook Login for Business), Meta shares with us:

• The name and profile picture of the person who completes the connection
• The IDs of the business portfolio, WhatsApp Business Account and phone number they choose to share
• The phone number, display name, quality rating and message templates of that account
• An access token that lets Zatio act on that account, stored encrypted

We use this data only to register the number with our messaging provider (Twilio), send and receive messages for the Operator, manage their message templates and show the connection status in their dashboard. We only access the accounts the Operator selects. The Operator can remove Zatio’s access at any time from Meta’s Business Settings, and on request we delete the token and account data within 30 days (see Data deletion).

§ 03How we use your information

Website visitors

• Respond to your enquiries
• Send you requested information about Zatio
• Improve our services and website
• Comply with legal obligations
• If you press “Continue” on the sign-up form, we keep your email and business name for up to 30 days to help you finish signing up (we may email you once)

WhatsApp end users

• Respond to enquiries on behalf of the Operator
• Manage bookings, quotes and follow-ups
• Escalate complex cases to the Operator’s human team
• Generate AI-assisted replies

Calendar connections (Google Calendar and Outlook)

If an Operator connects Google Calendar or Outlook, Zatio only checks the busy times of that calendar to offer free slots, and creates in it the appointments the assistant books (with a video-call link when the Operator chooses video calls). We do not read the content of the Operator’s other events, we do not sell or share this data, and we do not use it for advertising or to train AI models. The access tokens are stored encrypted in the EU and are deleted when the Operator disconnects the calendar from Integrations.

Zatio’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Access to Outlook is through Microsoft Graph with the Calendars.ReadWrite permission, used only for the same purposes.

§ 04Lawful basis (UK GDPR / EU GDPR)

We process personal data under the following bases:

• Performance of a contract (Art. 6(1)(b)) — to deliver services you or the Operator requested
• Legitimate interests (Art. 6(1)(f)) — to operate and improve our service, provided your rights don’t override ours
• Consent (Art. 6(1)(a)) — for marketing communications, where required
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and regulatory requirements

§ 05Sub-processors

We use the following sub-processors to deliver our service:

A current list is available on request at privacy@zatio.io.

§ 06International transfers

Where data is transferred outside the UK / EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum.

Our database and application run in the EU (Stockholm). AI processing (Anthropic for text, Google for voice) may take place outside the EU under EU standard contractual clauses.

§ 07Retention

• Website enquiry data: kept while we are in contact with you about Zatio, and deleted on request within 30 days (privacy@zatio.io)
• Unfinished sign-ups (email and business name saved when you press “Continue”): 30 days
• WhatsApp, website chat and phone conversation data (messages, transcripts and leads): kept while the Operator’s account exists, and deleted on request within 30 days. A paused or cancelled account keeps its data until deletion is requested, so the Operator can still export it. Call audio is not recorded or stored
• Operational logs (webhook payloads and retry queues): the message content is scrubbed after 30 days; internal failure logs are deleted after 60 days
• Accounting records: as required by UK / Spanish tax law (typically 6 years)

§ 08Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access the personal data we hold about you
• Request rectification of inaccurate data
• Request erasure (“right to be forgotten”)
• Object to processing
• Request data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority (ICO in the UK, AEPD in Spain)

To exercise any of these rights, email privacy@zatio.io. We will respond within 30 days.

For WhatsApp conversations, you can also contact the Operator directly — they act as data controller for that data.

§ 09AI transparency

Zatio uses Anthropic Claude (a Large Language Model) to generate automated replies on WhatsApp and website chat. Phone calls answered by the AI assistant use Google Gemini for the spoken conversation, with the Operator’s information as its source. In line with the EU AI Act (Art. 50) and UK AI governance expectations:

• End users are clearly informed when they are interacting with an AI, including at the start of every phone call
• Sensitive or complex cases are escalated to human operators
• Messages are not used by our AI providers to train their models. Anthropic keeps API inputs and outputs for a limited period under its standard API retention policy

§ 10Security

We use industry-standard security measures including TLS encryption in transit, encryption at rest, role-based access controls, and regular security reviews. See our Security Page for details.

§ 11Requests from public authorities

If a court, police force or other public authority asks us for personal data, including data we receive from Meta when an Operator connects WhatsApp, we follow these rules:

• We check that the request is lawful. We only answer requests that come with a valid legal basis under Spanish and EU law, from an authority that has power to make them. We may take legal advice before answering.
• We challenge requests that are not. If a request is unlawful, too broad or unclear, we ask for it to be clarified or narrowed, and if needed we refuse it or challenge it through the available legal channels.
• We disclose the minimum. We only hand over the data the request strictly requires, and nothing else.
• We keep a record. We document every request: who made it, what was asked, the legal basis, our answer and our reasoning, and who in our team handled it.
• We tell the people affected, including the Operator when the request is about their customers, unless the law forbids it.

§ 12Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the latest version. Material changes will be communicated via the website.

§ 13Contact

Almor Ventures SL (CIF B27691799)
C/ San Isidre Llaurador 14, 03108 la Torre de les Maçanes (Torremanzanas), Alicante, Spain
legal@zatio.io.

Privacy questions: privacy@zatio.io
General enquiries: hello@zatio.io