This policy explains how Alfie (alfieanswers.com) collects, uses, and protects personal data. Alfie is operated by [PLACEHOLDER — legal entity, e.g. Peter Hutchinson trading as Alfie], registered in the United Kingdom. We are the data controller for personal data of our subscribers (local service businesses) and a data processor on behalf of those subscribers for personal data of their customers.
If you have questions about this policy, contact us at pete@onimo.co.uk.
Alfie has two categories of users, and your relationship with us depends on which one you are.
We rely on the following lawful bases under UK GDPR Article 6:
We use the following sub-processors to deliver the service. Each is bound by a data-processing agreement and (for transfers outside the UK) appropriate transfer safeguards such as Standard Contractual Clauses or the UK Addendum / Data Bridge.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic, PBC | Claude AI model that generates chatbot replies | United States |
| Meta Platforms (WhatsApp Business Cloud API) | Sending and receiving WhatsApp messages on behalf of subscribers | United States / Ireland |
| Resend, Inc. | Transactional email (magic links, lead notifications) | United States |
| Railway Corp. | Application hosting and storage of the SQLite database | United States |
| one.com | Domain registration and DNS | European Union (Denmark) |
We will update this list before adding any new sub-processor. If you require advance notification, contact us.
Under UK GDPR you have the right to: access your personal data, correct inaccuracies, request erasure, restrict or object to processing, and request data portability. To exercise any of these, email pete@onimo.co.uk. We will respond within one month.
End customers: if you contacted a window cleaner via their chatbot and want your data accessed, corrected, or erased, please contact the window cleaner directly — they control your data and we act on their instruction. If you cannot reach them, we will assist on their behalf.
You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
We host on Railway with TLS encryption in transit, an isolated production environment, and backups stored on a persistent volume. WhatsApp access tokens and Anthropic API keys are stored in encrypted environment variables and database fields. Magic-link tokens are single-use and expire in 15 minutes. We do not store subscriber passwords because we do not use them.
No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected users without undue delay.
The Alfie website uses a single first-party session cookie to keep subscribers logged in to the admin area. The chat widget embedded on subscribers' sites does not set tracking cookies; it uses a randomly generated conversation ID stored in the page's session storage to maintain message continuity, which is cleared when the visitor closes the tab.
Some of our sub-processors are based in the United States. We rely on the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or equivalent safeguards approved by the UK ICO, to ensure your data is protected when transferred outside the United Kingdom.
Alfie is a B2B service intended for use by businesses. We do not knowingly process personal data of children under 13. If you believe a child has provided us personal data, contact us and we will delete it.
We will post any material changes here and update the "last updated" date at the top. For significant changes affecting subscribers, we will also notify you by email.
Alfie — operated by [PLACEHOLDER legal entity], [PLACEHOLDER registered address], United Kingdom.
Email: pete@onimo.co.uk