Ralio raises $2.5M in Europe's largest agentic payments round
Get early access Partner with us

Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Ralio (“we”, “us”, or “our”) collects, uses, and protects personal data when you visit ralio.co or use the Ralio platform (the “Service”). Ralio is an agentic payment gateway: you connect AI agents that make business payments on your behalf. The Service includes the Ralio Console web application (console.ralio.co), our REST API and official SDKs, and connectors that link Ralio to third-party AI assistants, such as our MCP Server (mcp.ralio.co).

1. Who We Are

The Service is provided by RALIO LTD, a company registered in England and Wales under company number 16546335, whose registered office is at Second Home Spitalfields, 68–80 Hanbury Street, London E1 5JL, United Kingdom.

RALIO LTD is the controller of the personal data described in this policy that relates to visitors to our website, people who contact us, and the people who hold accounts on the Service. Where we process personal data contained in payment instructions, invoices, or beneficiary records on behalf of a business customer, we act as that customer’s processor and handle the data under our agreement with them; the customer is the controller of that data.

2. Information We Collect

We collect information to operate the Service and to execute the payment activity you and your agents initiate. This includes:

  • Account Information: Name, email address, and organisation details.
  • Financial and Payment Data: Bank account details, balances, beneficiaries, invoices, transaction history, mandates, and spend limits that are processed when your agents act on your behalf.
  • Agent Conversation Data: Messages you exchange with a Ralio agent, including messages sent through a connected AI assistant such as the MCP Server, are stored on our servers, keyed by conversation identifier. Actions your agent takes (tool calls) are logged for auditing.
  • Enquiries: If you use the contact form on ralio.co, we collect your name, company, email address, and message. With each submission we also record your IP address, your approximate location derived from it (city, region, and country), your time zone, your network provider, your browser’s user agent and language, and how you reached the contact page (the page address, the referring website, and any campaign tags in the link). To check that a submission comes from a person rather than an automated program, the contact form uses Cloudflare Turnstile. Turnstile collects technical information from your browser and device, such as your IP address, browser type, and how your browser connects, and tells us only whether the check passed. We do not receive this information ourselves.
  • Technical Information: IP address, device identifiers, browser type, and server logs.

3. How We Use Information and Our Lawful Bases

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) we must have a lawful basis for each use of personal data. We rely on the following:

  • To provide the Service: operating your account, executing and recording the payment instructions you and your agents authorise, and maintaining audit logs of agent activity so you can review what your agents have done. Lawful basis: performance of our contract with you or your organisation.
  • To keep financial and transaction records that we are required by law to hold. Lawful basis: compliance with a legal obligation.
  • To secure the Service: detecting and preventing fraud, abuse, and unauthorised access, and keeping server and security logs. Lawful basis: our legitimate interests in protecting the Service, our customers, and the payment systems we connect to.
  • To support customers and send critical service updates. Lawful basis: performance of our contract, or our legitimate interests where you are not the contracting party.
  • To respond to enquiries sent through our contact form and to follow up on them, to filter out spam and abuse of the form, including by using Cloudflare Turnstile, and to understand which channels bring us enquiries. Lawful basis: our legitimate interests in responding to business enquiries and developing business relationships.
  • To improve the Service by analysing aggregate usage trends. Our website analytics are cookieless and give us aggregate statistics only. Lawful basis: our legitimate interests in developing our product.

Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object at any time (see Your Rights). We do not sell your personal data to third parties.

4. AI Processing and Agent Activity

Ralio agents use Artificial Intelligence to act on your instructions.

  • Purpose-Limited Processing: Your data is processed by AI models solely to carry out the tasks you ask your agents to perform.
  • Training Opt-Out: By default, Ralio does not use your data to train AI models. We will not do so without your explicit, opt-in consent.
  • Human Approval: Payments that require confirmation are gated behind human approval. You remain responsible for reviewing and approving the movement of money initiated through your agents.

5. Data Sharing

We share information only under the following circumstances:

  • Service Providers: With trusted vendors who process data on our behalf under written contracts, including cloud hosting and infrastructure providers (Amazon Web Services, Cloudflare, Vercel), AI model providers (Anthropic, OpenAI), and the business tools we use to run the company and handle enquiries (Google Workspace, Slack, Attio). Cloudflare also provides privacy-focused website analytics. It uses the information Turnstile collects to improve its bot detection, as an independent controller under its own Turnstile Privacy Addendum.
  • Banking and Payment Providers: With the banking and payment-rail providers we use to execute payments. Executing a payment necessarily involves sharing the relevant transaction details (such as beneficiary and amount) with these providers.
  • Connected AI Assistants: When you connect Ralio to a third-party AI assistant platform (for example, by using the MCP Server), the content of your messages to and from your agent necessarily passes through that platform. That platform's own privacy policy governs its handling of your data.
  • Legal Compliance: When required by law, court order, or a regulator, or to protect the safety and integrity of our users.
  • Business Transfers: In the event of a merger or acquisition, where data remains subject to the same protections.

6. International Transfers

Some of our service providers, including our AI model providers, are based in the United States or process data outside the UK. When personal data is transferred outside the UK, we make sure it is protected by one of the safeguards recognised under UK data protection law: UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified), the International Data Transfer Agreement issued by the Information Commissioner’s Office, or the UK Addendum to the European Commission’s Standard Contractual Clauses. You can contact us for more information about the safeguard used for a particular transfer.

7. Data Retention

We keep personal data only for as long as we need it for the purposes above:

  • Account information: while your account is open, then deleted within 90 days of closure, except for specific records covered by a longer retention period below.
  • Customer due diligence (KYB) records: 5 years after the business relationship ends (Money Laundering Regulations 2017).
  • Payment instructions, transactions, mandates, beneficiary details and audit logs of payment actions: 5 years after the transaction or the business relationship ends, whichever is later (Money Laundering Regulations 2017).
  • Agent conversation data, including files you send in the chat: while your account is open, then deleted within 90 days of closure. Conversations linked to a payment, their attachments and related approval records are kept with that payment’s records for the same period.
  • Ralio’s own financial and accounting records, including invoices, expenses and business bank records: 6 years from the end of the financial year they relate to.
  • Contact form enquiries: up to 2 years after our last contact with you, unless you become a customer.
  • Server and security logs: up to 12 months, unless needed to investigate a security incident.
  • Database backups: retained on a rolling 14-day cycle. Deleted data may remain in these backups for up to 14 days.

Where we process personal data on behalf of a business customer, retention and deletion follow that customer’s documented instructions and the applicable data processing agreement, subject to applicable law. Specific records may be kept for longer where necessary to meet a legal obligation or preserve evidence for an audit, complaint, investigation or legal proceedings. We restrict their use and delete them when the preservation requirement ends and the applicable retention period has expired.

8. Data Security

We take appropriate technical and organisational measures to protect personal data, including financial and payment data, against unauthorised access, loss, or misuse. However, no system can be guaranteed to be completely secure.

9. Your Rights

Under UK data protection law you have the right to:

  • Access the personal data we hold about you and receive a copy of it.
  • Correct inaccurate or incomplete data.
  • Erase your data. Note that we may be required to retain certain transaction records to meet legal obligations.
  • Restrict how we use your data in certain circumstances.
  • Object to processing we carry out on the basis of legitimate interests.
  • Data portability: receive data you provided to us in a machine-readable format.
  • Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us using the details below. We will respond within one month. If we process your data as a processor for a business customer, we will pass your request to that customer.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to address your concern first.

10. Cookies

The Ralio Console uses strictly necessary cookies to keep you signed in and to keep the Service secure, including recognising devices you have signed in from before. It also stores your display preferences, such as theme and layout, in your browser. These do not require consent. ralio.co does not set cookies of its own. On the contact page, Cloudflare Turnstile may store a small amount of information in your browser, within Cloudflare’s own frame, to tell people apart from automated programs. This is strictly necessary to protect the form you are using, so it does not require consent. We collect usage information for analytics on ralio.co and in the Console. Our website analytics do not use cookies or store anything in your browser and give us aggregate statistics about page visits. We do not use advertising cookies or tracking for advertising on ralio.co or in the Console. Videos on ralio.co are embedded in YouTube’s privacy-enhanced mode, which does not set cookies until you play a video. If we introduce any non-essential cookies, we will ask for your consent before setting them.

11. Changes to This Policy

We may update this policy to reflect changes in technology or legislation. We will notify you of significant changes via email or a prominent notice in the Ralio Console.

12. Contact

If you have questions regarding this policy or wish to exercise your data rights, please contact our team or write to RALIO LTD, Second Home Spitalfields, 68–80 Hanbury Street, London E1 5JL, United Kingdom.