Last updated 26 October 2026
Privacy policy.
How we handle personal data on this site, in the client portal and in the voice deployments we operate. Plain language, with the legal detail where it matters.
Aldaria · Singapore
In one line: we collect what we need to answer you, run the portal and operate the service. We do not sell personal data, and we do not use advertising trackers on this site.
Who we are
Aldaria is a company registered in Singapore. For the purposes of Singapore PDPA and applicable data protection law, Aldaria is the organisation responsible for the personal data described in this policy.
For privacy questions, use the privacy contact form. For security matters, use the security contact form.
Scope
This policy covers this website, the client portal, our sales and support communications, and the personal data we handle as a controller. It does not cover the call data we process on behalf of a client. For that data, Aldaria acts as a processor and the client is the controller; the client's privacy notice and our data processing agreement apply.
Where we act as a controller, we handle personal data in accordance with Singapore PDPA and applicable data protection law. Where another privacy law applies, we handle it in accordance with that law. If a client contract sets a stricter rule, the stricter rule applies to that client's data.
What we collect
We collect personal data in four ways:
- Contact and ticket data. When you submit the contact form or write to us, we collect your name, email address, company (if you provide it), the subject of your enquiry, the message, the consent record and the ticket reference.
- Portal account data. When access is provisioned, we store your name, email address, organisation, a salted password hash and session records. We never store the password itself.
- Technical logs. The server records the request path, status, timestamp, a coarse client address and a user agent for security and operations. We do not use these logs for advertising.
- Service data. If you are a client, the deployment record describes the call data we process on your behalf, including recordings, transcripts, summaries and tool payloads where enabled.
We do not ask for special category data through this website. Please do not send identity documents, health data or payment details through the contact form.
How we use it
We use personal data to answer enquiries, provide the portal, operate and secure the service, meet legal and contractual obligations, and improve the service in an aggregated or instructed way. We do not sell personal data, and we do not share it with advertising networks.
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
Call data
For client deployments, Aldaria processes call audio, transcripts, summaries, metadata, consent records and tool payloads under the client's written instructions. The client determines the purpose, the retention period and the categories of data. We do not use client call data to train a shared model unless the client instructs us in writing.
Recording is disabled by default unless the flow and the contract enable it. Where recording is enabled, the agent discloses it at the start of the call. PII redaction can run before storage. Access to call data is limited to the personnel who need it to operate or support the deployment, under role-based access and audit logging.
Sharing
We share personal data only where necessary:
- Within the Aldaria group (Singapore · Panama · Hong Kong · China) for ownership, operations and support, with access limited to the purpose.
- Service providers that host, secure, support or operate the service, under written terms and confidentiality obligations.
- Professional advisers such as auditors, lawyers and insurers, where required.
- Authorities where we are legally required to disclose, or where disclosure is necessary to protect rights, safety or the service.
We do not sell personal data. A current list of subprocessors is available to clients under the data processing agreement and on request through the privacy contact form.
International transfers
Aldaria operates in Singapore · Panama · Hong Kong · China. Personal data may be processed in these jurisdictions or in the region selected for a deployment. Where data is transferred across borders, we use contractual and organisational safeguards, and we honour the residency and transfer terms in the client contract. For client call data, the deployment record names the regions and the transfer mechanism.
Retention
We keep personal data only as long as needed for the purpose for which it was collected, or as required by law. Our typical periods are below; a client contract may set a different period for call data.
| Data | Typical period |
|---|---|
| Contact and ticket data | 24 months after the ticket is opened |
| Portal account and sessions | Account active + 12 months; sessions expire |
| Server and security logs | 90 days, unless investigating an incident |
| Consent records | As required by the applicable law and contract |
| Client call data | Per the client contract and deployment record |
Security
We use encryption in transit and at rest, role-based access, least privilege, MFA for administrative access, logging and incident response. The portal session cookie is HttpOnly and SameSite=Lax; passwords are stored as salted scrypt hashes. We test the site and the portal for security issues and review access when roles change.
No system is perfectly secure. If you believe you have found a vulnerability, use the disclosure process. If a personal data breach occurs, we will assess it and notify the relevant authorities and affected individuals where required.
Cookies and tracking
This site uses no advertising, analytics or third-party tracking cookies. We do not embed social pixels or third-party fonts; the typefaces are self-hosted. The only cookie we set is the client portal session cookie, which is strictly necessary to keep you signed in.
| Cookie | Purpose | Duration |
|---|---|---|
| aldaria_session | Authenticates the client portal session; HttpOnly, SameSite=Lax, Secure on HTTPS | Session, up to 12 hours (7 days with “keep me signed in”) |
Because this cookie is strictly necessary, we do not show a consent banner. If we introduce a non-essential cookie, we will update this policy and ask for consent before setting it.
Your rights
Under Singapore PDPA and applicable data protection law, and where another privacy law applies, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a portable copy. You may also withdraw consent where processing is based on consent.
To exercise a right, use the privacy contact form with enough information for us to verify your identity. We aim to respond within 30 days or the period required by law. If you are a client's customer and your request concerns call data, we will refer the request to the client as the controller, unless the law requires otherwise.
If you are not satisfied with our response, you can contact Personal Data Protection Commission (PDPC), Singapore or another supervisory authority where applicable.
Children
This site and the client portal are not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.
Changes and contact
We may update this policy to reflect a change in our practice or the law. The version and date at the top of this page show the current policy. If a change is material, we will make it prominent on this page or contact affected clients directly.
Questions, requests and complaints: use the privacy contact form. Public contact details, when supplied, are shown on the contact page.
Aldaria
Singapore
Privacy contact form · Trust & security