Privacy Policy

1. Who we are and our role

WALLIOO (“we”, “us”) provides software that applies an organization’s policies to its use of AI. When we provide the service to a customer organization, that organization is the data controller and WALLIOO acts as its data processor, under a data processing agreement. For the data collected through this website, WALLIOO is the controller.

2. What each component processes

• Browser Guard analyzes the text employees write to AI tools in their browser and replaces personal data with codes before anything is sent; the AI provider only receives the codes. The original message is not stored by WALLIOO. To let the person read the answers with the real values, the codes and their values are kept on the device, encrypted with a key that only WALLIOO Control can release for that device, and deleted after 90 days without use. Where the customer enables company tools for AI agents, the values a person typed in a conversation are sent, encrypted in transit, to WALLIOO Control and kept in memory only, for up to two hours, so that the tool can receive the real value; they are never written to disk or logged, and each use is recorded without the values. Where the customer enables it, documents attached through the WALLIOO panel are processed in memory by the document service and are not stored; and, if usage insights are enabled, the already-anonymized text of a message is classified and only its category is kept.
• Gateway processes requests and responses between AI agents or applications and the systems they call, in transit, to apply the customer’s policies. Payloads are not stored by default.
• Control stores account data for administrators (name, email, role) and usage and decision metadata: which AI or tool was used, by which user or agent, which rule applied and the outcome.
• Professional services: our team accesses the customer’s environment only as needed to deliver the agreed services, under the customer’s instructions and confidentiality obligations.

3. WALLIOO Free (the free browser extension)

WALLIOO Free is a free extension for Chrome and Microsoft Edge that a person installs from the browser’s store for their own use. It has no account and is not managed by an organization. This section describes it; the rest of this policy covers the products for organizations and this website.

• What you type stays on your computer. Personal data is detected by a model that runs inside your browser and is replaced with codes before your message is sent to the AI service. Your messages, the values that were hidden and the files you restore are never sent to WALLIOO. The AI service you use (for example OpenAI, Google, Anthropic or Microsoft) receives the message with codes, under its own terms and privacy policy.
• History on your computer. So that past chats show your real values, the codes and their values are stored in your browser, encrypted, for the period you choose in the settings (7, 30 or 90 days). You can delete them at any time with “Delete history now”; removing the extension deletes them too. Your settings are stored in your browser as well.
• Model download. The first time, and when a new version is published, the extension downloads the detection model from models.wallioo.com. Each time the model starts it checks for a new version. These requests carry no identifier and none of your content; the content delivery network that serves the files (our subprocessor) sees your IP address and standard request details, as any web server does, and keeps them in its logs for a short time for security and operation.
• Problem reports, only if you send one. “Report a problem” sends what you write, the category you pick, your email if you give it, and — if you leave the box ticked — the technical details shown on screen (extension version, AI service, browser version, detection mode and browser language). We use it only to fix problems and, if you gave your email, to answer you; it is sent by email through our email provider and deleted within 30 days. Please do not include personal data in the description.
• No tracking. WALLIOO Free has no analytics, no advertising and no account. We do not sell, rent or share data, and we do not use it to build profiles or for any purpose other than the extension’s single purpose: protecting what you send to AI services. Our use of information received through the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
• Who is responsible. For WALLIOO Free, WALLIOO is the controller only for problem reports and the model download requests; everything else stays on your computer under your control.

4. What we never store

WALLIOO does not store the content of prompts or AI responses, the values that were masked, or the content of documents processed by the document service.

5. Retention

Usage metadata and security events are kept for the period configured by the customer — 90 days by default for security events — and deleted at the end of the contract, unless the customer requests an export first.

6. Hosting and location

Each customer’s environment is isolated. It is hosted by WALLIOO on a leading cloud provider in the region agreed with the customer, or deployed in the customer’s own infrastructure. We use a limited number of subprocessors, listed in the data processing agreement, and we do not sell or share personal data with third parties.

7. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, encryption of secrets at rest, role-based access, session expiry and least-privilege access for agents and integrations. See our Security page for details.

8. This website

When you contact us through the form, we use your name, email, company, role and message only to answer you and follow up on your request, on the basis of your request and our legitimate interest. This site does not use advertising or tracking cookies; it only remembers your language choice in your browser.

9. Your rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection. If WALLIOO processes your data on behalf of your employer, please contact your organization’s administrator first; we will assist them. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

10. Changes and contact

We may update this policy as the service evolves; the date at the top shows the latest version. WALLIOO — Madrid, Spain. Contact us →