Privacy Policy
This Privacy Policy explains what personal data Palva processes, why we process it, who we share it with, how long we keep it, and how people can exercise their rights. It applies to Palva’s business software, website, APIs, support channels and integrations, including our integration with the WhatsApp Business Platform and other Meta products. It is written for our business customers and their staff, website visitors, and people who message a business that uses Palva.
Palva is operated by AEnterprise L.L.C-FZ, a company licensed in the Meydan Free Zone, Dubai, United Arab Emirates, with its registered address at Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Privacy questions and requests can be sent to privacy@palva.io.
1. What Palva does
Palva helps businesses answer enquiries, manage conversations, capture leads and book appointments. A business (our “customer”) connects its own communication channels, such as its WhatsApp Business number, and decides who it communicates with and how it uses Palva.
Meta, WhatsApp and other third-party services operate under their own terms and privacy policies. This policy does not replace a customer’s own privacy notice or those third-party policies.
2. Who is responsible for your data
| Data | Palva’s role | What this means |
|---|---|---|
| Customer accounts, staff users, billing, sales, support, our website and service security | Controller | Palva decides how this data is used to run our business, meet legal obligations and secure the service. |
| Contacts, conversations, messages, voice notes, photos, leads, appointments and other content a customer processes through Palva | Processor (service provider) | The customer decides why and how this data is processed. Palva processes it on the customer’s behalf and under its instructions. |
| Data needed to prevent abuse, protect the service, comply with law or deal with legal claims | Controller, for that limited purpose | Palva may make limited independent decisions where necessary for security, compliance or legal protection. |
If you messaged a business that uses Palva, that business is responsible for your conversation and is usually the best first contact for privacy requests. You can also contact Palva directly — see Data Deletion and section 12.
3. Personal data we process
3.1 Customer and staff account data
- Names, business contact details, organisation, role and account permissions of customer staff.
- Sign-in and security information. Staff sign in with Google; we receive their name, email address and profile picture from Google. We never ask for passwords or access tokens through support channels.
- Contracts, orders, invoices, payment status, onboarding information, preferences and support communications.
3.2 Meta and WhatsApp integration data
- Business identifiers such as the Meta business portfolio ID, WhatsApp Business Account ID, business phone number and phone number ID.
- Permissions, connection status, webhook events, message templates, business profile information, and the access credentials needed to operate the connection.
- Information Meta provides about message delivery, read status, errors, quality and policy enforcement.
3.3 Conversation and customer content
- Contact details of people who message a customer: name, WhatsApp profile name, phone number and WhatsApp user identifiers.
- Message content and metadata: text, voice notes, images and other attachments, timestamps, delivery and read status, and conversation history.
- Lead, enquiry and appointment information, such as the products or services someone asks about, preferred times, bookings, notes, tags, staff assignments and outcomes.
- AI-related records: the context given to our AI provider, generated replies and decisions, transcripts of voice notes, descriptions of images, and the review and hand-over records needed to run and audit the AI features a customer enables.
3.4 Usage, device and security data
- IP address, browser and device type, operating system, access times and pages or features used.
- Application, API, webhook, audit, performance, diagnostic and security logs, including records of which staff member viewed or acted on a conversation.
- Cookies: we use only essential cookies needed to sign staff in and keep their session secure. We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner.
4. Sensitive information
People who message a business may share sensitive information — for example about their health — in text, voice notes or photos. The business is the controller of that information and is responsible for having a lawful basis to collect and use it. Palva processes it only on the business’s behalf, to help the business respond to the person.
- Palva’s AI assistant is not designed to give professional advice, such as medical, legal or financial advice. Palva hands conversations to the business’s staff when needed.
- Access to conversations is limited to authorised staff of the business concerned and logged.
- We do not use sensitive information for marketing, profiling or any purpose other than providing the service to the business.
Palva is not designed for payment card numbers, bank details or government identification numbers, and customers should not ask people to send them through Palva.
5. How we use personal data
| Purpose | Examples of data | Usual legal basis where GDPR applies |
|---|---|---|
| Provide and operate Palva | Account data, integrations, conversations, usage data | Contract; customer instructions where Palva is a processor |
| Connect and manage messaging channels | Meta and WhatsApp identifiers, templates, webhooks, messages, delivery events | Contract; legitimate interests; customer instructions |
| Run AI features the customer enables | Conversation context, voice notes, images, AI inputs and outputs | Customer instructions (the customer is responsible for the legal basis, including any explicit consent needed for sensitive data) |
| Secure, troubleshoot and improve the service | Logs, device data, errors, abuse signals, aggregate statistics | Legitimate interests; legal obligations |
| Manage our business relationship | Contact, order, billing and support records | Contract; legitimate interests; legal obligations |
| Comply with law and protect our rights | Relevant account, audit and transaction records | Legal obligations; legitimate interests; legal claims |
| Send product news to business contacts | Business contact details and preferences | Consent where required; otherwise legitimate interests, with opt-out |
Our legitimate interests are running and securing a business service, responding to customers, preventing fraud and misuse, improving reliability and protecting our legal rights. We do not rely on them where your rights override them.
6. Data from Meta and WhatsApp
When a customer connects a WhatsApp Business number or other Meta asset, Palva processes the identifiers, permissions, templates, messages, media, delivery events and profile data needed to provide the integration. We use data received from Meta only to provide the connected service to that customer, keep it secure, support the customer and comply with law and Meta’s terms and policies.
- We do not sell Meta Platform Data, share it with data brokers, or use it for advertising.
- We request only the permissions needed for features Palva actually provides, and limit access to authorised personnel and service providers.
- We delete Meta-sourced personal data when it is no longer needed, when a customer disconnects or withdraws permission, when a valid deletion request is made, or when Meta or the law requires it, subject to the limited exceptions in section 10.
- Anyone can ask us to delete their data by following the Data Deletion instructions.
7. AI features
Where a customer enables them, Palva uses AI to read incoming messages and suggest or send replies, propose and book appointments, transcribe voice notes, describe images, and decide when a conversation should be handed to staff. Palva checks AI decisions against the customer’s real schedule and rules before acting, and hands conversations to staff when it is unsure. The customer chooses which features to enable and remains responsible for how it uses them.
Our AI provider is Google (Gemini API). We use it on paid terms under which Google does not use our inputs or outputs to train or improve its models. Google may keep them for a limited period to detect abuse.
No training on your data. Palva does not use conversations, customer content or Meta Platform Data to train or fine-tune any AI model — ours or a provider’s. We may use aggregate or de-identified measurements that cannot reasonably identify anyone to monitor quality, reliability and security.
If we ever offer customer-specific model training, it will be a separate opt-in programme with its own terms and notices, will not apply retroactively or by default, and will exclude Meta Platform Data unless Meta’s terms and applicable law expressly allow it.
8. Who we share data with
- The customer that controls the relevant account, its authorised staff, and recipients the customer chooses.
- Meta and WhatsApp, and other channel providers a customer connects, to send and receive messages.
- Our subprocessors, listed below.
- Professional advisers, auditors and insurers under duties of confidentiality.
- Authorities or others where reasonably necessary to comply with law, protect safety, prevent fraud or abuse, enforce our agreements or deal with legal claims.
- A buyer, investor or successor in a merger, financing or sale of all or part of our business, subject to confidentiality and any notice the law requires.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Web application hosting | Germany (Frankfurt); USA for company administration |
| Supabase Inc. | Database hosting | Germany (Frankfurt) |
| Upstash Inc. | Rate limiting and abuse protection | Germany (Frankfurt) |
| Google LLC / Google Cloud | AI processing (Gemini API); staff sign-in | USA and other Google locations |
| Meta Platforms (WhatsApp) | Sending and receiving WhatsApp messages | Global |
If a customer connects another tool, such as a CRM or messaging platform, data is shared with it on that customer’s instructions. We will update this list before adding a subprocessor.
9. International transfers
AEnterprise L.L.C-FZ is established in the United Arab Emirates. Our application and database are hosted in the European Union (Germany). Some providers, including our AI provider, may process data in the United States or other countries. Where the law of the European Economic Area, the United Kingdom, Switzerland or the UAE requires safeguards for these transfers, we rely on an available lawful mechanism, such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, together with additional measures where appropriate.
10. How long we keep data
We keep personal data only as long as needed for the purposes above, the customer’s instructions, legal obligations, security and disputes.
| Data | Retention |
|---|---|
| Customer account and contract data | For the customer relationship and up to 5 years afterwards, unless the law requires longer. |
| Conversations and customer content | As set by the customer during the contract. Deleted within 30 days of a valid deletion request, or within 60 days after the customer’s account ends. |
| Meta and integration credentials and identifiers | Until the channel is disconnected; credentials are revoked promptly and remaining data deleted within 30 days. |
| Security, audit and diagnostic logs | Up to 12 months, unless needed longer to investigate an incident or comply with law. |
| Backups | Deleted data leaves backups through the normal backup cycle within 90 days. Backups are protected and only used for recovery. |
| Billing, tax and accounting records | As long as UAE tax and accounting law requires. |
We may keep a minimal record of a deletion request, opt-out, security event or legal hold to show we complied, and use it for nothing else.
11. Security
We use technical and organisational measures to protect personal data, including encryption in transit and at rest, role-based access controls, sign-in through Google accounts, logging of staff access to conversations, separation of each customer’s data, and rate limiting. No system is completely secure. Customers are responsible for securing their staff accounts and should report suspected misuse to support@palva.io.
12. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it, to withdraw consent, and to complain to a data protection authority. Business contacts can opt out of our product emails at any time.
To make a request, email privacy@palva.io or follow the Data Deletion instructions. You do not need a Palva account. Tell us your name, the phone number or email address involved, the business you contacted and the channel you used (for example WhatsApp). Please do not send passwords, codes or unnecessary sensitive details.
We may verify your identity before acting. Where Palva processes the data for a customer, we may pass your request to that customer and help it respond. Requests are free unless the law allows a reasonable fee for a manifestly unfounded or excessive request. We acknowledge requests within 10 business days and respond within 30 calendar days, or sooner where the law requires.
13. Automated decisions
Palva automates routine tasks such as replying to enquiries, offering appointment times and routing conversations. It does not make solely automated decisions that have legal or similarly significant effects on people. Anyone can ask to speak to a person at the business, and Palva hands conversations to staff when needed.
14. Children
Palva is a business service for organisations and their adult staff and is not directed to children. Customers are responsible for any notices or parental consent required when they communicate with minors.
15. Future features
This policy covers only features Palva actually offers. Before we launch voice calling, call recording, synthetic voice, AI avatars or generated advertising media, we will update this policy and our terms to cover the data involved, consent, retention, providers and deletion.
16. Changes to this policy
We may update this policy when the law, our providers or the service change. We will post the new version here with a new effective date and give additional notice where required.
17. Contact
AEnterprise L.L.C-FZ, trading as Palva
Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
Privacy and data requests: privacy@palva.io
Support: support@palva.io
We have not appointed a Data Protection Officer or a representative in the European Union or United Kingdom. If the law requires one, we will appoint them and list their details here. Until then, please contact privacy@palva.io.