Privacy Policy

Last updated: April 23, 2026

Introduction

Welcome to Wally, a housing matchmaking service operated by Nvoye B.V., registered in The Hague, Netherlands. Your privacy is important to us, and this Privacy Policy outlines how we collect, use, and protect your personal information when you interact with Wally via WhatsApp or our website.

Data Collection

Wally collects personal data directly from users through WhatsApp conversations and related interactions, including but not limited to:

• Phone numbers (provided through WhatsApp)
• Names
• Housing preferences (budget, location, move-in dates, duration)
• Professional information (e.g., employer or organization, when voluntarily shared)
• Lifestyle preferences relevant to housemate matching
• Listing details for rooms or properties being offered
• Payment information (processed by our payment provider, Mollie)
• Any other information you choose to provide during interactions

By interacting with Wally on WhatsApp, you consent to receiving service-related messages including match notifications, follow-ups, and updates about your listing or search. You may opt out at any time by messaging "STOP" to Wally.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, or religious beliefs. However, if you choose to share this information during your interactions, it may be collected as part of our service.

Legal Basis for Processing

Wally processes your personal data under the following legal bases as defined by the GDPR:

Consent (Article 6(1)(a) GDPR)

• Sharing contact information with matches after mutual opt-in
• Receiving marketing or promotional communications

Contract Performance (Article 6(1)(b) GDPR)

• Processing necessary to provide matching and introduction services
• Maintaining user profiles for service delivery
• Processing payments for successful matches

Legitimate Interests (Article 6(1)(f) GDPR)

• Service improvement and analytics
• Platform security and abuse prevention
• Customer support

Legal Obligation (Article 6(1)(c) GDPR)

• Compliance with applicable Dutch and EU laws and regulations

Data Usage

The personal data collected is used to:

• Match housing seekers with compatible rooms and housemates
• Match room listers with verified, compatible seekers
• Facilitate introductions between matched users via WhatsApp
• Process service fee payments through Mollie (iDEAL and other Dutch payment methods)
• Follow up on matches to ensure successful outcomes
• Improve our matching algorithms and service quality
• Send service-related communications about your matches and listings

Third-Party Services

Wally uses the following third-party services for data processing and service delivery. Each is bound by a data processing agreement (DPA) or equivalent contractual safeguards in line with GDPR requirements.

• WhatsApp / Meta (Ireland — EU): Our primary communication channel. Messages are subject to WhatsApp's end-to-end encryption and Meta's privacy policy.
• Supabase (EU region): Cloud database and backend infrastructure for storing user profiles, listings, and match data. Data is hosted in EU-based infrastructure with encryption at rest.
• Anthropic (United States): We use Anthropic's Claude API to help Wally understand your messages, extract housing preferences, and power the conversational intake experience. See "AI-Powered Matching and Conversations" below for specifics. Transfers to the United States are covered by Standard Contractual Clauses (SCCs) under GDPR Article 46. Anthropic's privacy policy.
• Vapi (United States): When you choose the optional voice-intake call, Vapi orchestrates the real-time voice conversation (speech-to-text, voice synthesis, orchestration). Transfers covered by Standard Contractual Clauses. Only used if you explicitly select voice intake. Vapi's privacy policy.
• Mollie (Netherlands — EU): Payment processing for service fees. Mollie is regulated by De Nederlandsche Bank. Payment data is processed according to Mollie's privacy policy.

AI-Powered Matching and Conversations

Wally uses large language models (LLMs) to hold its conversations with you — both on the text intake and on optional voice calls — and to extract structured housing preferences from what you share. Because this is a new form of data processing that many users want to understand clearly, we've written it out explicitly:

• What gets sent to the LLM provider (Anthropic): the content of your conversation during an active intake session — the questions Wally asks and your replies — together with the structured preferences already collected in your current session. Your stored profile, other users' data, and anything outside the current intake context is not sent.
• No model training on your data. Anthropic's Commercial Terms state that Inputs and Outputs from API usage are not used to train Anthropic's models by default. Wally accesses Anthropic via the commercial API, so nothing you say to Wally is used to train future AI models. This is the key distinction between using the Claude.ai consumer product (which has different terms) and using the API (which is what we do).
• Retention at the LLM provider. Per Anthropic's policy, API Inputs and Outputs are retained for up to 30 days to support operations and abuse monitoring, then deleted. Wally itself does not keep a copy of the raw LLM exchange beyond what's needed to render your profile and conversation history.
• International data transfer. Anthropic and Vapi are US-based. These transfers are covered by Standard Contractual Clauses (SCCs) adopted by the European Commission under GDPR Article 46, providing contractual guarantees equivalent to EU-level protection.
• Automated processing. Wally uses an LLM to understand your messages and suggest matches, but all matches are suggestions — you choose whom to connect with. No contractual or legal decision about you is made solely by AI. You retain the right under GDPR Article 22 to request human review of any automated decision.
• Your consent. At the start of every intake conversation, Wally sends a short notice describing what it will ask and save. Continuing the conversation is your consent for this processing; you can type CANCEL or DELETE at any point to stop and wipe your data.

If you'd prefer not to have your messages processed by an LLM, the simplest path is to not use Wally — there are traditional housing-search channels that don't involve conversational AI. If you'd like to use Wally but have specific questions about the AI processing, email privacy@nvoye.com and we'll respond within one month.

Data Sharing

Your data may be shared with third parties in the following circumstances:

• When introducing you to a match: Your name, phone number, and relevant context (profession, timeline, reason for moving) will only be shared with another user after both parties have explicitly opted in to connect with each other
• Payment processing: Necessary payment information is shared with Mollie to process service fee transactions
• Legal requirements: When required by Dutch or EU law, regulation, or legal process

We do not sell your personal data to third parties. We do not use your data for advertising or retargeting purposes.

Data Retention

We retain personal data for the following periods:

• Active profiles and match data: Retained while you are actively using the service and for 12 months after your last interaction
• Communication records: Retained for up to 2 years for service improvement and dispute resolution
• Payment records: Retained for 7 years as required by Dutch tax law
• Listing data: Removed within 30 days after a listing is marked as filled or withdrawn

Data Deletion and Anonymization

To delete or anonymize your data, please contact us at privacy@nvoye.com or message Wally on WhatsApp with the word "DELETE." We will process your request within 30 days and confirm deletion.

Security Measures

We implement appropriate technical and organizational measures to protect your data:

• All data is stored in EU-based Supabase infrastructure with encryption at rest
• WhatsApp communications benefit from end-to-end encryption
• Access to user data is strictly limited to essential personnel at Nvoye B.V.
• Payment data is handled exclusively by Mollie and never stored on our servers
• Regular review of security practices and access controls

Data Breaches

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will:

• Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours
• Notify affected users without undue delay
• Provide information about the nature of the breach, likely consequences, and measures taken to address it

Your Data Protection Rights

Under GDPR, you have the following rights:

• Right of Access (Article 15): Request information about what personal data we process and obtain a copy
• Right of Rectification (Article 16): Request correction of inaccurate personal data
• Right of Erasure (Article 17): Request deletion of your personal data in certain circumstances
• Right to Restrict Processing (Article 18): Request that we limit how we use your personal data
• Right to Data Portability (Article 20): Request your personal data in a structured, machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision-Making (Article 22): Rights regarding automated matching decisions

To exercise any of your rights, please contact us at privacy@nvoye.com. We will respond within one month of receiving a valid request.

Consent Withdrawal

You may withdraw your consent at any time by:

• Service messages: Message "STOP" to Wally on WhatsApp
• Profile and matching: Contact privacy@nvoye.com to remove your profile
• Full data deletion: Request account deletion via privacy@nvoye.com

Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

International Data Transfers

Your data is primarily processed within the European Economic Area (EEA). Where data is processed by WhatsApp/Meta, transfers outside the EEA are governed by Meta's data processing agreements and standard contractual clauses as approved by the European Commission.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to users via WhatsApp message at least 30 days before they take effect. Continued use of the service after changes constitutes acceptance of the revised policy.

Contact Information

Nvoye B.V.
The Hague, Netherlands
KVK: 97190497

General privacy inquiries: privacy@nvoye.com
General support: support@nvoye.com

You also have the right to lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens