Privacy policy

1. Who We Are

AllVia-AI is a website and digital marketing agency operating in the United Kingdom. We build websites and manage paid advertising (Meta, Google and TikTok Ads) for UK service businesses.

For the purposes of UK GDPR, AllVia-AI is the data controller responsible for your personal data collected through this website and our services.

Contact: hello@allvia-ai.com

2. What Data We Collect

We collect personal data in the following ways:

2.1 Data you provide directly

• Your name and contact details (email address, phone number)
• Your business name and industry
• Information you include in enquiry or contact forms
• Information you share during calls or onboarding sessions
• Payment and billing information (processed securely through our payment partners, we do not store card data ourselves)

2.2 Data collected automatically

• Basic website analytics, pages visited, time on site, referral source (collected without identifying you personally)
• Your IP address and browser type for security and performance purposes
• Cookie preferences and session data

2.3 Data collected through ad campaign management

Where we manage Meta, Google or TikTok advertising on your behalf, we access performance and audience data through your ad accounts (or accounts we set up for you) in order to run and report on campaigns. This is covered in your service agreement, and the advertising platform itself remains the data controller for how it processes end-user data on its network.

3. Why We Collect Your Data (Legal Basis)

We process your personal data on the following legal grounds under UK GDPR:

• Contract performance, to deliver the services you have signed up for, including your website build, ad campaign setup, and onboarding support
• Legitimate interests, to respond to your enquiries, improve our services, and communicate relevant updates about your account
• Legal obligation, to comply with UK law including financial record-keeping requirements
• Consent, for any marketing communications, where we will always ask for your permission first and make it easy to withdraw

4. How We Use Your Data

We use the personal data we collect to:

• Respond to your enquiries and book calls
• Set up, configure and manage your ad campaigns
• Build and maintain your website
• Send you service-related communications, onboarding information, updates, invoices
• Improve our services and website based on how they are used
• Comply with legal and financial obligations
• Send marketing communications, only with your explicit consent

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Who We Share Your Data With

We do not sell, rent or trade your personal data to any third party. We share data only with trusted service providers who help us operate our business, and only to the extent necessary:

• Netlify, our website hosting platform, which receives form submission data
• Cloudflare Turnstile, used to protect enquiry forms from spam and abuse. Cloudflare processes browser and connection information for verification; we send the verification token to Cloudflare before accepting a form submission. See Cloudflare’s privacy policy.
• Resend, used to send enquiry notifications and confirmation emails, including the contact details provided in your enquiry.
• Cal.com, our booking calendar, which stores appointment information
• Meta, Google and TikTok, the advertising platforms we use to run and manage your ad campaigns
• Zapier, our automation platform, used for lead capture notifications
• Notion, our CRM, used to manage client records

All third party providers are required to handle your data securely and in accordance with applicable data protection law. We select providers who meet appropriate standards of data protection.

We may also disclose your data if required to do so by law or by a court, regulator or law enforcement authority.

6. How Long We Keep Your Data

• Enquiry and contact form data, retained for 12 months from the date of enquiry, then deleted unless you become a client
• Client account data, retained for the duration of your contract plus 6 years for legal and financial compliance purposes
• Ad campaign and performance data, retained for the duration of your contract plus 12 months unless longer retention is agreed
• Marketing consent records, retained until you withdraw consent, plus a reasonable period thereafter
• Website analytics data, retained in aggregated, anonymised form for up to 24 months

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access, you can request a copy of the personal data we hold about you
• Right to rectification, you can ask us to correct inaccurate or incomplete data
• Right to erasure, you can ask us to delete your personal data in certain circumstances
• Right to restrict processing, you can ask us to limit how we use your data in certain circumstances
• Right to data portability, you can request your data in a structured, machine-readable format
• Right to object, you can object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent, where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at hello@allvia-ai.com. We will respond within 30 days. There is no charge for making a request.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

This version of the website does not include analytics scripts, advertising pixels or a cookie preference tool. Forms submit the details you enter to our enquiry service. Hosting and third-party services may process technical request information. If analytics or advertising tracking is added, this policy and any required consent controls must be updated before it is enabled.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. Our website is hosted on enterprise infrastructure with SSL encryption, DDoS protection, and no database or admin panel that could be breached.

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately at hello@allvia-ai.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top of this page. If changes are significant, we will notify active clients directly. Continued use of our services after an update constitutes acceptance of the revised policy.