Privacy Policy

We collect two categories of data:

• Client business data: contact name, email address, WhatsApp number, business address, service list, pricing, opening hours, and business FAQs.
• Client customer data: name, WhatsApp number or messaging channel, conversation history, bookings, and service requests. This data is processed on behalf of the client business as data controller, and Arcana acts as processor.

Data is used strictly to provide staff-automation services: answering customer messages, creating and syncing bookings, sending follow-ups, issuing invoices, and updating the client business's CRM and calendar.

We do not sell data, share it for third-party marketing, or use it to train AI models shared with other businesses.

To provide the service, we use the following processors:

• Meta Platforms (WhatsApp Business API, Instagram, Messenger) — for message delivery and receipt.
• Google (Google Calendar) — for booking calendar sync.
• AI model providers (OpenAI, Anthropic, or equivalent) — for natural-language processing of incoming messages and reply generation.
• Infrastructure providers (DigitalOcean or equivalent) — for hosting and encrypted data storage.

Data is encrypted in transit (TLS 1.2+) and at rest. Conversation data is stored for the duration of the client business's active subscription. When the subscription ends, the data is exported back to the client business and deleted from our systems within 30 days, unless law requires longer retention.

As a data subject under UU PDP, you have the right to:

• Receive information about the data we process about you.
• Access, update, or correct your data.
• Withdraw consent and request deletion of your data.
• Restrict or object to certain processing.
• Receive a copy of your data in a machine-readable format (data portability).

To exercise the rights above, contact us by email at bigcheese@indomustrading.com. We will respond within 30 days as required by UU PDP.

In the event of a data breach with material impact, we will notify affected client businesses and the relevant authorities within 3 × 24 hours, as required by UU PDP.

This policy may be updated from time to time. The latest version will be published on this page with the updated effective date.