Privacy policy
In effect from 8 September 2026. Applies to https://aimcom.aimatric.com and to the AIMcom service.
The short version. If you contacted a venue and spoke to an automated assistant, that venue decides what is collected and why. Aimatric runs the software on its behalf. Your conversation is kept so the venue can answer for what was agreed, recordings and transcripts are deleted automatically, nothing is shared with any other venue, and you can ask for a copy or for erasure.
1. Who is responsible
Two organisations are involved and it matters which is which.
The venue you contacted decides what personal data is collected and for what purpose. Under the Indian Digital Personal Data Protection Act 2023 it is the Data Fiduciary; under the Malaysian Personal Data Protection Act 2010 as amended it is the data controller. Requests about your data are theirs to decide.
Quipu Software Solutions provides the AIMcom platform and processes personal data on the venue's instructions. It is a Data Processor, and does not use your data for its own purposes.
| Registered office, India | not set |
|---|---|
| Contact, Malaysia | not set |
| Privacy contact | info@quipu.in |
| Data Protection Officer | Anand , anand@aimatric.com |
The Malaysian Personal Data Protection (Amendment) Act 2024 requires both controllers and processors to appoint at least one Data Protection Officer who can be identified and contacted. That is the person named above.
2. What is collected
| What | Why |
|---|---|
| Your telephone number, WhatsApp identity, and an email address if you give one | To recognise you across conversations, to send your confirmation, and to reach you if the booking changes. |
| Your name, if you give one | So the venue knows who the booking is for. |
| What you asked for: date, time, party size, seating preference, occasion, accessibility needs | To make the booking. |
| A transcript of the conversation | So the venue can answer for what was agreed, and to improve the assistant's accuracy. |
| A recording, where the conversation was a call and you were told at the start | Quality and dispute resolution. You are told before it begins. |
| Which messages were sent to you and whether they were delivered and read | To avoid sending a reminder you have already acted on, and to stop if you opt out. |
| Your language and channel preference, and your consent and opt out record | To use the right language next time and to honour an opt out. |
What is deliberately not collected
- Payment card details. The platform is built so they never reach it. Payment, where a venue takes one, happens on the venue's own payment page.
- Voice biometrics. Nobody is identified by the sound of their voice. Biometric data is sensitive personal data under the amended Malaysian legislation, and the platform stays out of that entirely.
- Anything about you held by another venue. Profiles are kept separate per venue and nothing is inferred across them, even where the same telephone number contacts two venues.
Telephone numbers, payment card patterns and government identifiers are stripped out of transcripts and logs before they are written down.
3. The basis for processing, and your consent
Most processing is necessary to do what you asked: you contact a venue to make a booking, and the booking cannot be made without it.
Separately, a venue may only send you a WhatsApp message it started after you have agreed to it. That agreement is recorded with what you agreed to, when, on which channel, in which language, and the exact wording you were given. Where the agreement was spoken on a call, the recording of it is the evidence.
Recording a call requires a notice at the start of that call. You get one, in your language, before anything is recorded.
4. Who else receives it
Only those needed to deliver the service. The current list, with what each receives and where they are, is on the sub-processors page and is generated from the platform's live configuration rather than maintained by hand.
Some processing happens outside India and Malaysia. Delivering WhatsApp messages involves Meta. Understanding what you asked for and phrasing the reply currently involves a language model service that runs outside both markets, which means the text of your conversation leaves the country it was collected in.
We record the legal basis and the safeguard relied on for every such transfer, per market, and the venue you dealt with can tell you which applies to them. Malaysian personal data leaving Malaysia is assessed against the comparable protection framework introduced by the 2024 amendment.
Your information is never sold, never used to train a general purpose model, and never given to another venue.
5. How long it is kept
| What | Default |
|---|---|
| Call recordings | 90 days |
| Conversation transcripts | 365 days |
| Interaction records | 365 days |
| Booking records | 2555 days, or as the venue's own obligations require |
A venue may set shorter periods. Deletion is automatic: a scheduled job removes what is due, and a failure to delete is treated as an incident rather than a warning. It is not left to anyone to remember.
Counts and statistics survive longer, with every identifier removed at the point they are calculated, so a venue can still see last year's trend without holding last year's personal data.
6. Your rights
Under the Indian DPDP Act and the Malaysian PDPA you may ask for access to your data, correction of it, erasure of it, and a copy in a portable form.
How to ask. Contact the venue you dealt with. They decide, because the data is theirs. If it is easier, write to info@quipu.in and we will route it to them and help them answer within the period the law allows.
To stop being contacted, reply STOP to any message, or say so on a call. It takes effect immediately and across every channel: stopping messages also stops calls. You do not need to explain why, and it does not cancel a booking you already hold.
Erasure removes your profile, your conversations and your recordings. Two things survive it, and we would rather say so than surprise you. Records that the law requires to be kept unchanged, such as the log of who accessed what, are retained; and statistics that no longer identify anyone are retained.
7. How it is protected
Encrypted in transit and at rest. Each venue's data is isolated at the database level, not merely by the application remembering to filter. Aimatric staff do not have routine access to conversations or contact details; the access that exists is narrow, requires a stated reason, expires, and is recorded. The security page sets this out in more detail.
8. Children
The service is for making bookings with a business and is not directed at children. A booking may name a child, for example a high chair for a party, and that detail is treated like any other booking detail and deleted with it.
9. Complaints
Raise it with the venue first, or with anand@aimatric.com. You may also complain to the Data Protection Board of India, or to the Personal Data Protection Commissioner in Malaysia, depending on where you are.
10. Changes
Material changes are notified to venues, who will tell their customers. The effective date at the top of this page always reflects the current version.