Privacy Policy
This privacy policy describes how your personal data is collected, used and shared when you visit https://wals.pro/, make a purchase there, or use wals.pro AI at ai.wals.pro. The controller is Wals Professional Services GmbH. This is a convenience translation; the German version is the binding one.
Scope
The sections “Personal data we collect” through “Do not track” and “Data retention” describe the website and online shop at wals.pro. For the wals.pro AI application (ai.wals.pro, auth.ai.wals.pro and mcp.ai.wals.pro), the sections whose heading starts with “wals.pro AI” apply. The remaining sections apply to both.
For data from your weclapp system that wals.pro AI processes on your behalf, we act as a processor; the data processing agreement at https://ai.wals.pro/dpa applies. For your account, billing, the security of the service and support, we act as a controller.
Personal data we collect
When you visit the website, we automatically collect certain information about your device, including information about your web browser, IP address, time zone and some of the cookies installed on your device. As you browse the website, we collect information about the individual web pages or products you view, which websites or search terms referred you to the website, and information about how you interact with the website. We refer to this automatically collected information as “device information”.
We collect device information using the following technologies:
- “Cookies” are data files placed on your device or computer that often include an anonymous unique identifier. For more information about cookies and how to disable them, visit http://www.allaboutcookies.org.
- “Log files” track actions occurring on the website and collect data including your IP address, browser type, internet service provider, referring / exit pages and date / time stamps.
- “Web beacons”, “tags” and “pixels” are electronic files used to record information about how you browse the website.
This description applies to wals.pro. The application at ai.wals.pro uses none of these analytics technologies; what applies there is described in the section “wals.pro AI: Visits and abuse protection”.
When you make or attempt to make a purchase through the website, we also collect certain information from you, including your name, billing address, shipping address, payment information (including credit card numbers), email address and phone number. We refer to this information as “order information”.
When we talk about “personal data” in this privacy policy, we mean device information and order information as well as the data described in the sections on wals.pro AI.
How do we use your personal data?
We use the order information we collect generally to fulfil any orders placed through the website (including processing your payment information, arranging shipping and providing you with invoices and / or order confirmations). In addition, we use this order information to analyse how our customers browse and interact with the website and to assess the success of our marketing and advertising campaigns.
We use the device information we collect to screen for potential risk and fraud (in particular your IP address) and, more generally, to improve and optimise our website (for example by generating analytics about how our customers browse and interact with the website, and to assess the success of our marketing and advertising campaigns).
Sharing your personal data
We share your personal data with third parties to help us use your personal data as described above. For example, we use Shopify to power our online shop. You can read more about how Shopify uses your personal data here: https://www.shopify.com/legal/privacy
On wals.pro we also use Google Analytics to help us understand how our customers use the website. You can read more about how Google uses your personal data here: https://policies.google.com/privacy. You can opt out of Google Analytics here: https://tools.google.com/dlpage/gaoptout. The application at ai.wals.pro does not use Google Analytics.
Finally, we may also share your personal data to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.
Who receives data in wals.pro AI is described in the section “wals.pro AI: Recipients and processing locations”.
Behavioural advertising and “Do not track”
As described above, on wals.pro we use your personal data to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work
You can opt out of targeted advertising:
Please note that we do not alter our website’s data collection and use practices when we see a Do Not Track signal from your browser.
The application at ai.wals.pro has no advertising and no tracking.
wals.pro AI: Visits and abuse protection
wals.pro AI connects your AI assistant (for example Claude or ChatGPT) to your weclapp system. Your AI assistant is not part of our service. What your AI provider does with the content you enter in the chat, or that our tools return to the assistant, is governed by your own contract with that provider. We do not operate a language model of our own and do not use your data to train AI models.
No analytics, no tracking. The application at ai.wals.pro uses no analytics, marketing or tracking tools, including no Google Analytics, and therefore shows no cookie banner. We derive usage statistics exclusively from our own logs of executed actions, not from tools in the browser.
What is stored in the browser. ai.wals.pro itself sets no cookies. In your browser’s storage we keep only what is needed to operate the service: your sign-in session (Firebase Authentication), your language and appearance choice, the last selected workspace and short-lived intermediate state, such as an open payment process or dismissed setup hints. These entries do not leave your browser for analytics purposes.
Abuse protection (Google reCAPTCHA Enterprise). On sign-in, registration and “forgot password” we use Google reCAPTCHA Enterprise to check whether a human is filling in the form. Google processes your IP address as well as browser, device and interaction characteristics and may use cookies or comparable browser data for this. We receive only the risk score, not the raw data.
Server logs. When our servers are called, the IP address, browser identifier, requested address, time and status are logged for technical reasons. We use this to defend against attacks and to troubleshoot, and we delete these logs after 30 days.
wals.pro AI: Registration, account and workspace
Registration. We process your email address, first and last name, company, VAT ID, address and language. We review every registration before a workspace is activated. We delete open applications after 90 days; after approval or rejection we keep only the status and time of the application for 400 days.
Acceptance of the legal documents. During registration you accept the general terms and conditions, acknowledge this privacy policy and conclude the data processing agreement on behalf of your company. Invited team members accept the terms and acknowledge this privacy policy when they set their password. As evidence we store the document, its version, the time, the accepting person and the company for as long as the workspace or the user account exists.
Account and sign-in. For your account we process your email address, name, role and membership of your workspace. Sign-in runs through Firebase Authentication (Google); we never see your password. Links for setting or resetting a password are valid once. Invitations are valid for 72 hours.
weclapp connection. We store the API key of your weclapp system encrypted in Google Secret Manager. Which data we can read and change in your weclapp is determined by the permissions of the weclapp user the API key belongs to.
Connection of your AI assistant. Your AI assistant signs in to our service via OAuth. For this we store the technical identifier of the assistant, the workspace and person the connection is authorised for, when consent was given and when it was last used, and whether it has been revoked. We store access tokens only as a checksum, never in plain text.
wals.pro AI: Tool inputs and outputs
What we receive. Our server sees only your assistant’s tool calls and their results, not your chat history. A tool call contains what the assistant passes for the task, for example search terms, filters, record numbers or the fields of a new quotation.
What we return. The matching data from your weclapp, such as customers, contacts, quotations, orders, invoices, articles, stock levels, tickets, tasks, comments, time records, settings or documents. This may include personal data of your business partners and employees. This data goes to your AI assistant and therefore to your AI provider.
What we keep of it:
| Tools | Input | Output | What stays with us |
|---|---|---|---|
| Reading (for example search, retrieve, aggregate, download documents) | Data type, search term, filter, record number | Records, aggregations, comments and documents from your weclapp | No content. Lookup data for at most 30 minutes in memory. Log without content. |
| Preview of a change | Planned change, for example the fields of a quotation, a comment text, a stock booking | Validated preview and a single-use approval token | An approval record with a checksum of the change, valid for 15 minutes. We do not store the content of the change. |
| Execution of a confirmed change | Approval token and unchanged preview, only after your confirmation in the chat | Short result report, for example the new document number | A change record with status, target and document numbers, without the changed content, so that no change is executed twice. |
| Feedback to support | The report text you confirmed | Redacted preview | The confirmed report for 180 days. |
Every change in your weclapp first appears as a preview and is executed only after you have confirmed it.
wals.pro AI: Logs, support, emails and billing
Logs. For every executed action we log who executed which action when and with which result, without free text or ERP content. We keep these logs for 400 days.
Support and feedback. If you report a problem or a request through the AI assistant, we store the text you confirmed for 180 days and create a ticket from it in our helpdesk. Credentials, further email addresses, IBANs, tax, card and phone numbers are removed automatically beforehand. The redaction does not detect names and postal addresses automatically; the preview shows exactly what will be sent, and nothing is sent without your explicit confirmation.
Emails. We send emails that are necessary for the service: registration confirmation, invitations, password links, notices about trial, subscription, payment and quotas, and important service notices.
Billing. Paid plans are billed through the payment provider Mollie. You enter payment details directly with Mollie. We store only the payment and subscription events and delete them 90 days after completion. We keep invoices for the statutory retention periods.
wals.pro AI: Recipients and processing locations
| Recipient | Purpose | Location |
|---|---|---|
| Google Cloud EMEA Limited (Google Cloud and Firebase) | Hosting of the application, database, sign-in, secret storage, logs, reCAPTCHA Enterprise | Data centre in Belgium (europe-west1), database in a European multi-region. Google may also process data in the USA; the EU standard contractual clauses and Google’s certification under the EU-US Data Privacy Framework apply. |
| SMTP2GO (Sand Dune Mail Ltd.) | Sending the service emails | New Zealand (adequacy decision of the EU Commission) |
| Mollie B.V. | Payment processing for paid plans | Netherlands |
| Your AI provider | Receives the tool results through your AI assistant. It is not our service provider but your contractual partner. | According to your contract with the provider |
| Your weclapp system | Reading and changing data on your behalf | According to your contract with weclapp |
We do not sell personal data.
wals.pro AI: Retention at a glance
| Data | Period |
|---|---|
| Content from your weclapp | Only for the respective request; lookup data for at most 30 minutes in memory |
| Approval records for changes | 15 minutes |
| Server logs (IP address, browser identifier, address, time) | 30 days |
| Log of executed actions | 400 days |
| Open registration applications | 90 days; afterwards status and time for 400 days |
| Invitations | 72 hours |
| Support reports from the chat | 180 days |
| Payment and subscription events | 90 days after completion |
| Account, workspace, weclapp connection, evidence of acceptance of the legal documents, change records | For as long as the user account or the workspace exists |
wals.pro AI: What you control yourself
- Permissions in weclapp: give the weclapp user the API key belongs to only the permissions your team really needs.
- Permissions in the workspace: administrators decide who may read and which changes are allowed.
- Confirmation of every change: without your confirmation of the preview, nothing is written to your weclapp and nothing is sent to support.
- Connections: you or an administrator of your workspace can revoke an AI assistant’s connection at any time.
- Deletion: if you want your account or your workspace deleted, write to support@wals.pro.
Legal bases
Orders in the shop as well as account, sign-in, data processing for your requests, service emails and billing in wals.pro AI: performance of a contract (Art. 6(1)(b) GDPR).
Abuse protection, logs, support and the improvement of our website: legitimate interest in secure and functioning operations (Art. 6(1)(f) GDPR).
Retention of invoices: legal obligation (Art. 6(1)(c) GDPR).
Storage in the browser at ai.wals.pro is strictly necessary for the service you requested (Section 165(3) of the Austrian Telecommunications Act 2021).
Your rights
If you are a European resident, you have the right to access the personal data we hold about you and to ask that your personal data be corrected, updated or deleted. You can also request restriction of processing and portability of your data, and object to processing based on our legitimate interest. If you would like to exercise these rights, please contact us using the contact information below.
If you are a European resident, we also note that we process your information in order to fulfil contracts we might have with you (for example if you place an order through the website), or otherwise to pursue our legitimate business interests listed above. Please also note that when you visit the online shop your data will be transferred outside of Europe, including to Canada and the United States.
If your request concerns data that a company processes from its weclapp system through wals.pro AI, please contact that company; we support it in answering.
You can also lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde: https://www.dsb.gv.at
Data retention
When you place an order through the website, we will keep your order information for our records unless and until you ask us to delete this information. The periods for wals.pro AI are listed in the section “wals.pro AI: Retention at a glance”.
Minors
The website and wals.pro AI are not intended for individuals under the age of 18.
Changes
We may update this privacy policy from time to time, for example to reflect changes to our practices or for other operational, legal or regulatory reasons. You will find the current version date at the top of this page.
Contact us
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email or by post using the details provided below:
Wals Professional Services GmbH, Hadikgasse 64, A-1140 Vienna, Austria