1
What this covers
This notice explains what WALO collects, why, how long it is kept and what you can do about it. It applies to the web app, the installed app and the WhatsApp number attached to your workspace.
Two roles matter throughout. For your account and billing data, Service Pricer LLC is the controller — we decide why and how it is processed. For the job records, receipts, photos and contacts you put into your workspace, you are the controller and we are the processor acting on your instructions.
2
What is collected
Account data. Name, work email, company name, workspace role, and a hashed password if you did not use Google.
Workspace content. Jobs, addresses, budgets, line items, receipts and their images, job photos, contractor and investor contacts, tenant details on properties you keep, and notes you write.
Messaging data. Messages to and from your workspace WhatsApp number, including attachments, and the phone numbers involved.
Connected services. If you connect Google, the OAuth tokens and only the scoped data you approve — receipt emails in the inbox you nominate, files in the folder we create, calendar entries we add.
Technical data. IP address, browser and device type, timestamps, pages viewed, and security event logs.
Billing data. Plan, invoices and payment status. Card numbers never reach our servers — Stripe holds those.
3
Why it is processed, and the legal basis
Under the UK GDPR and the EU General Data Protection Regulation every purpose needs a lawful basis. Ours are set out plainly below.
To run the service. Performance of the contract with you (GDPR Art. 6(1)(b)).
To keep it secure and prevent abuse. Our legitimate interests in protecting the platform and its users (Art. 6(1)(f)).
To meet tax, accounting and legal duties. Legal obligation (Art. 6(1)(c)).
To read a nominated inbox or write to your Drive. Your explicit consent, given at the Google consent screen and revocable at any time (Art. 6(1)(a)).
To message your crew. Your instruction as controller, on the consent you obtained from them.
4
Google data and Limited Use
When you connect Google we ask for the narrowest scopes that make the feature work, and nothing more. You see the exact list on Google's own consent screen before anything is granted.
Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer that data to others except as necessary to provide the feature you asked for, and never for advertising, credit assessment or model training. Revoke access any time from your Google account security settings and the connection stops working immediately.
5
Who else touches the data
We use a small set of subprocessors, each under a written data-processing agreement with confidentiality and security terms at least as protective as this notice. Where data leaves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, backed by a transfer risk assessment.
Cloud hosting and storage. Application servers, database and encrypted file storage in US regions.
Stripe. Payments and invoicing. PCI DSS Level 1 service provider.
Meta Platforms. WhatsApp Business Platform message delivery.
Google. Sign-in, and the Gmail, Drive and Calendar scopes you approve.
Cloudflare. Edge delivery, DDoS mitigation and Turnstile bot defence.
We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. There is nothing to opt out of because it does not happen.
6
Your rights in the United States
Twenty US states now have comprehensive consumer privacy laws on the books, with Indiana, Kentucky and Rhode Island taking effect on 1 January 2026. There is still no comprehensive federal statute, so the practical answer is to grant the same core rights to everyone rather than gate them by ZIP code.
Whatever state you are in, you can ask us to confirm what we hold, give you a copy in a portable format, correct it, delete it, or stop selling or sharing it — and we will not treat you worse for asking. Where a state gives extra rights, such as California's right to limit the use of sensitive personal information or the right to know about automated decision-making, those apply on top.
Universal opt-out. We honour the Global Privacy Control browser signal as an opt-out request, as a growing number of states now require.
Authorised agents. An agent may submit a request on your behalf with proof of authority.
Appeals. If we refuse a request you may appeal, and several state statutes require us to answer that appeal in writing within a set window. We will also tell you how to complain to your attorney general.
California breach claims. California is currently the only state giving individuals a private right of action for certain data breaches, under Civ. Code § 1798.150.
7
Your rights in Europe and the UK
If the GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects. WALO makes no such decisions about you.
Where processing rests on consent you may withdraw it at any time without affecting the lawfulness of what came before. You may also complain to your supervisory authority — the Information Commissioner's Office in the UK, or the authority in your member state.
8
How long things are kept
Workspace content. For as long as the account is open, then thirty days after termination, then deleted from live systems.
Encrypted backups. Rolling window, fully aged out within sixty days of deletion.
Invoices and tax records. Seven years, because tax law requires it.
Security logs. Twelve months, then deleted.
Support email. Twenty-four months from the last message in the thread.
9
Children, cookies and changes
The service is not directed to children and we do not knowingly collect data from anyone under eighteen. If you believe a child's data reached us, write to us and it will be removed.
We use strictly necessary cookies for session and security, and first-party analytics that do not follow you across other sites. There are no third-party advertising trackers on our pages.
If this notice changes materially we will email account owners and post the new version with a fresh date at least thirty days before it takes effect.