Sub-processors
The organisations that receive personal data in order to deliver AIMcom, what each receives, and where they are.
Generated from this deployment's live configuration rather than maintained by hand, so it cannot drift from what the software actually does.
| Who | What for | What they receive | Where |
|---|---|---|---|
| Meta Platforms | Delivering and receiving WhatsApp messages and calls on the venue's business number. | Telephone number, message content, delivery receipts. | Outside India and Malaysia. |
| Google (Gemini API) | Understanding what a customer has asked for and phrasing the reply. | The text of the conversation, which may contain a name, a telephone number and the details of a booking. | Outside India and Malaysia. |
| Cloud hosting and managed database | Running the platform and storing its records. | All platform data, encrypted at rest. | Indian venues in an Indian region; Malaysian venues in Singapore or Malaysia. |
Transfers outside India and Malaysia
Where a row above says a recipient is outside the market, personal data crosses a border to reach it. For each such transfer we record which provider received it, from which market, for what purpose, and the legal basis and safeguard relied on. Venues can obtain that record for their own market.
Malaysian personal data leaving Malaysia is assessed against the comparable protection framework introduced by the Personal Data Protection (Amendment) Act 2024, which replaced the previous whitelist approach.
Speech is handled separately from text. Where a venue uses voice, speech recognition and synthesis can run on Aimatric infrastructure, so a caller's audio need not leave the market even when the resulting text does. Whether that is the case for a given venue depends on its deployment, and the venue can tell you.
Changes
Venues are notified before a new sub-processor begins handling their data, so that they can raise an objection under their agreement.