This Privacy Policy explains how Cmpnion collects, uses, shares, and protects personal data in connection with our website and our AI-powered guest-messaging service.
In this Privacy Policy, "Cmpnion," "we," "our," and "us" mean PT Cmpanion Innovation Labs a company incorporated in Indonesia with registered address at District 8, Treasury Tower Lt. 6 Unit F, Jl. Jend. Sudirman Kav. 52-53, SCBD Lot 28 RT. 005 RW. 003, Senayan, Kebayoran Baru, Jakarta Selatan, and its affiliates involved in the relevant processing activity.
Cmpnion provides an AI front-desk assistant that operates over WhatsApp. Guests of a participating property (hotel, guesthouse, or villa) scan a QR code and chat naturally to request services such as room service, housekeeping, laundry, spa bookings, and general information. Cmpnion confirms requests, notifies the property's staff, and — where applicable — helps process payment for paid requests.
Please read this Privacy Policy together with any privacy notice provided to you by the property you are staying with, and, where relevant, the Cookie Policy and Terms of Service.
1. Our two roles: controller and processor
The law distinguishes between a "controller" (who decides why and how personal data is processed) and a "processor" (who processes data on a controller's behalf and instructions). Cmpnion acts in different roles depending on how you interact with us.
Cmpnion acts as a controller when:
- you visit or interact with our website (cmpnion.com);
- you submit a demo request or otherwise contact us as a prospective or current business customer; or
- We manage our own business operations, security, and communications.
Cmpnion acts as a processor when:
- We handle guest conversation and service-request data through the WhatsApp assistant on behalf of a participating property. In that case, the property is the controller of your personal data and determines the purposes of the processing. If you are a guest and wish to exercise your rights over that data, you may contact us and we will assist, but requests may need to be directed to, or confirmed with, the property.
This Privacy Policy describes our practices in both roles. Where a property provides its own privacy notice that conflicts with this document in respect of guest data, the property's notice governs the property's role as controller.
2. The personal data we collect
We collect the following categories of personal data, depending on how you interact with us.
2.1 Business and prospect data (Cmpnion as controller)
When you request a demo or engage with us as a property owner, operator, or staff member, we collect:
- Identification and contact details — property name, contact person's name, business email address, and any phone number you provide;
- Property information — country, property type, and number of rooms;
- Any additional information you choose to share in the message field or during onboarding and support;
- Account and dashboard data — login credentials, role, and activity logs for staff who use the Cmpnion dashboard.
2.2 Guest data (Cmpnion as processor for the property)
When you use the WhatsApp assistant as a guest, we process, on behalf of the property:
- WhatsApp identifiers — your WhatsApp phone number, display name, and profile information made available through WhatsApp;
- Conversation content — the messages you send and receive, including free-text you provide;
- Service-request details — the services you request (e.g., room service and in-room dining, housekeeping, laundry, spa and massage, extra bed, information requests), your room number, associated timestamps, and request status;
- Preferences and information you volunteer — for example dietary preferences, allergies, or special requests you include in a message. Please share only what is necessary; avoid sending sensitive information you do not want processed;
- Transaction and payment status — the items ordered, amounts, and whether a paid request has been completed, is pending, or has been charged.
2.3 Payment data
For paid requests, payment is processed by a third-party payment provider. We receive transaction details such as amount, currency, and payment status. We do not store full payment-card numbers; card and similar sensitive payment credentials are handled by the payment provider under its own terms.
2.4 Technical and usage data
When you use our website or dashboard, we automatically collect technical data such as IP address, device and browser type, approximate location derived from IP, pages viewed, and interactions. Some of this is collected through cookies and similar technologies, as described in our Cookie Policy.
3. How and why we use personal data, and our legal bases
| Purpose | Description | Legal basis |
|---|---|---|
| Providing the assistant service | Receiving guest messages, understanding requests, generating responses, confirming orders, and notifying property staff. | Performance of a contract (with the property); the property's instructions; and, where required, your consent as a guest. |
| Processing payments | Facilitating payment for paid requests and calculating commissions owed. | Performance of a contract; compliance with a legal obligation (e.g., tax and accounting). |
| AI-assisted responses | Using artificial intelligence to interpret messages and generate helpful replies (see Section 5). | Performance of a contract; legitimate interests in operating and improving the service; consent where required. |
| Improving and securing the service | Monitoring performance, debugging, preventing fraud and abuse, and improving quality. Where feasible we use aggregated or de-identified data for this. | Legitimate interests in maintaining a secure, reliable service. |
| Business communications | Responding to demo requests, onboarding customers, and providing support. | Performance of a contract or steps taken at your request prior to a contract; legitimate interests. |
| Marketing | Sending relevant updates and materials to business contacts. You can opt out at any time. | Consent, or legitimate interests in promoting our services, subject to your right to object. |
| Legal and compliance | Complying with applicable laws, responding to lawful requests, and establishing or defending legal claims. | Compliance with a legal obligation; legitimate interests. |
Where we rely on consent (including under Indonesia's Personal Data Protection Law), you may withdraw it at any time; withdrawal does not affect processing carried out before withdrawal.
4. WhatsApp and Meta
The Cmpnion assistant operates over the WhatsApp Business Platform, which is provided by Meta Platforms, Inc. and its affiliates. When you message the assistant, your interaction is also subject to WhatsApp's and Meta's own terms and privacy practices, which we do not control. We encourage you to review WhatsApp's Privacy Policy (https://www.whatsapp.com/legal/privacy-policy). Messages sent through the WhatsApp Business Platform are processed to deliver the service and may not have the same end-to-end encryption characteristics as ordinary personal WhatsApp chats.
5. Artificial intelligence and automated processing
Cmpnion uses artificial intelligence, including large language models, to interpret guest messages and generate responses. We may rely on third-party AI providers acting as our sub-processors to deliver this functionality.
We design the service so that meaningful decisions and fulfillment involve the property's staff — for example, staff are notified of requests and deliver or confirm them. We do not use AI to make decisions that produce legal effects or similarly significant effects about you based solely on automated processing. Where any such processing were to occur, you have the right to request human review, express your point of view, and contest the outcome. We take reasonable measures to prevent the service from generating inaccurate or inappropriate responses, but AI-generated content may occasionally contain errors; important information should be confirmed with the property.
6. How we share personal data
We do not sell your personal data. We share personal data only in the following circumstances:
- With the participating property — guest conversation and service-request data is made available to the property acting as controller, so its staff can fulfil requests.
- With sub-processors and service providers who process data on our behalf under contract and appropriate safeguards. These include, by category:
- cloud hosting and infrastructure providers;
- the WhatsApp Business Platform / Meta;
- AI and language-model providers;
- payment processing providers;
- analytics and monitoring providers;
- communication, messaging, and customer-support tools;
- and providers of legal, accounting, and audit services.
- For legal reasons — where we are required to disclose data by law, regulation, or a valid request from a public authority, or to establish, exercise, or defend legal claims.
- In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
A current list of key sub-processors is available on request at hello@cmpnion.com.
7. How we protect your data
We maintain technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. These include encryption of data in transit, access controls and authentication for the dashboard, role-based permissions, activity logging, and ongoing review of our providers' security practices. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your information and to notify affected parties and authorities of significant incidents where required by law.
8. Your rights
Your rights depend on the laws that apply to you. Regardless of jurisdiction, you may contact us at hello@cmpnion.com to make a request. If you are a guest, some requests may need to be handled by, or confirmed with, the property acting as controller. We may need to verify your identity before acting on a request, and some rights may be limited where we must retain data for legal reasons.
Under the Indonesian Personal Data Protection Law (Law No. 27 of 2022), you have the right to: obtain information about and access your personal data; request correction of inaccurate or incomplete data; request erasure or destruction of your data; withdraw consent; object to processing, including automated decision-making that significantly affects you; obtain and, where feasible, port your data; restrict processing; and seek compensation for a violation of the law. You may also lodge a complaint with the relevant Indonesian supervisory authority.
9. Children's privacy
The Cmpnion service is intended to be used by adults. It is not directed at children, and we do not knowingly collect personal data from children without appropriate consent from a parent, guardian, or the responsible adult under whose booking they are staying. If you believe a child has provided personal data to us without appropriate authorisation, please contact us so we can take appropriate action.
10. Cookies and similar technologies
Our website uses cookies and similar technologies to operate the site, remember your preferences, measure performance, and understand how the site is used. You can manage your preferences as described in our Cookie Policy.
11. Third-party links and services
Our website and messages may reference or link to third-party websites and services (including WhatsApp and payment providers) that we do not control. This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy notices.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on our website with a revised "Last updated" date and, where appropriate, notify you through other means. The English-language version of this Privacy Policy governs and prevails over any translation in the event of inconsistency.
13. Contact us
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:
- Email: hello@cmpnion.com
- Entity: PT Cmpanion Innovation Labs
- Address: District 8, Treasury Tower Lt. 6 Unit F, Jl. Jend. Sudirman Kav. 52-53, SCBD Lot 28 RT. 005 RW. 003, Senayan, Kebayoran Baru, Jakarta Selatan
If you are a guest of a participating property, you may also contact that property directly regarding its handling of your personal data.