Privacy Notice
MACHINEPULSE PTE. LTD.
Effective Date: 2 October 2026
Summary
Personal Data may be processed to provide Karpo, operate group interactions, provide location dependent features, process Social Media features, maintain safety and security, display advertisements, measure performance, and improve the Services (including developing and improving models where described in this Notice).
Social Media features may process (i) information provided through the Services and (ii) publicly available information retrieved from public sources when the feature is enabled.
Requests to exercise privacy rights can be submitted by email to legal@machinepulse.ai, and verification may be required.
Details for European users are set out in the European Users Notice (Section 15).
For the Agentic Assistance Feature, the processing of Identity Document Information and Payment Authorization Data is further described in Sections 3.10 to 3.12, 5.12, and 10.6; such information is not used to train any model.
1. Scope
1.1 This Notice applies to Personal Data processed in connection with Karpo and related consumer services, applications, websites, and features (collectively, the "Services").
1.2 This Notice does not apply to third party services not controlled by MachinePulse, even if linked or referenced in the Services.
1.3 The Services may involve automated processing to generate Outputs, detect abuse or fraud, and improve reliability and safety.
1.4 Agentic Assistance Feature data processing. The provisions of this Notice relating to the Agentic Assistance Feature apply only after the User enables that feature. Where the User has not enabled it, Karpo does not process their Identity Document Information or Payment Authorization Data by reason of that feature.
2. Definitions
2.1 Personal Data means information relating to an identified or identifiable individual.
2.2 Content means messages, prompts, inputs, conversation history, attachments, links, Social Media Information, and other materials submitted to the Services, and related metadata.
2.3 Outputs means responses, recommendations, summaries, location based outputs, or other results generated by the Services based on Content.
2.4 Precise Location Data means location information that can identify an individual's precise geographic position.
2.5 Social Media Information means information about social media accounts, profiles, posts, comments, interactions, or links provided through the Services.
2.6 Public Social Media Data means information retrieved from publicly accessible sources (for example, public profile information and public posts) when Social Media features are enabled. "Public" refers to accessibility on the source service at the time of retrieval and does not imply ownership or licensing.
2.7 Group interaction means a multi participant conversation context where Content from multiple participants may be visible in the same thread.
2.8 Third Party Services means third party websites, applications, content, products, or services not owned or controlled by MachinePulse.
2.9 Identity Document Information means elements of a government-issued identity document necessary to complete a booking or reservation, including without limitation document images, date of birth, document number, document validity period, issuing country, and nationality.
2.10 Payment Authorization Data means the payment instrument type and identifier, authorization tokens, transaction amounts and times, and similar information necessary to complete payment for a transaction, excluding the full payment card number and payment password.
2.11 Travel Partner means a third party that provides transportation, accommodation, dining, entertainment, ticketing, or other travel-related or local products and services, including without limitation airlines, rail operators, hotels, restaurants, event and venue operators, ticket sellers, travel agencies, online travel platforms, and other ticketing or goods and service providers.
2.12 Travel Compliance Requirements means government or carrier requirements applicable to a booking or to transportation, such as aviation passenger security screening, no-fly and sanctions list screening, and destination entry and visa requirements.
2.13 Agentic Assistance Feature means the feature of the Services described in the Terms of Use that a User enables thereunder, under which MachinePulse, as a limited agent and on the User's instruction, searches, compares, and provides information and, on the basis of the User's express consent and confirmation, provides technical services in connection with the User's booking or reservation of products or services with third-party Travel Partners, including without limitation transportation tickets, accommodation, dining, ticketing, and other goods or services.
3. Personal Data processed
Depending on how the Services are used, Personal Data processed may include:
3.1 Account, identity, and authentication data
Phone number or account identifiers, name, email address, gender, contact address, verification codes and timestamps, authentication status, account settings and preferences where supported.
3.2 Content and communications data
Message text, conversation history, attachments, links, Content metadata (timestamps, routing identifiers, thread identifiers), customer support communications, and diagnostic information provided during troubleshooting.
3.3 Group interaction data
Messages and attachments exchanged in a group interaction where the Services are present, and limited participant related data and group metadata to the extent made available and necessary to operate group functionality and maintain safety and security.
3.4 Location data
(a) Precise Location Data when enabled and used, such as coordinates or a location pin and related timestamps; and
(b) approximate location inferred from IP address where needed for security, fraud prevention, and regional compliance.
3.5 Device, network, advertising, and log data
IP address and network attributes, device type, operating system, browser version, language, time zone, crash logs, performance metrics, security logs, and, where applicable, advertising identifiers and SDK or cookie identifiers used for measurement and ad delivery.
3.6 Social media data
(a) Social Media Information provided through the Services; and
(b) Public Social Media Data retrieved from publicly accessible sources when Social Media features are enabled.
3.7 Inferences and derived data
Preference signals, feature usage patterns, safety signals for fraud and abuse prevention, and content classification labels for moderation, safety, and quality assurance.
3.8 Payment and billing data (where applicable)
Subscription status, billing address, billing history, invoices/receipts, the payment instrument type and identifier that may be processed, payment authorization tokens, transaction amounts and times, and limited payment-related data necessary for billing and accounting. Payment card details are typically processed by payment processors, and MachinePulse does not receive, read, or store them in full unless necessary and permitted by law.
3.9 AI call data. Where the AI voice calling feature is used, the User's own voice is not captured or processed; the feature operates on the User's text-based booking instruction. Called-party processing may include: call audio of the called party (where the User has enabled recording, the called party has not refused, and recording is permitted under applicable law), transcripts, call metadata (timestamp, duration, hashed merchant number, outcome), and audit logs of AI disclosure and consent.
3.10 Identity Document Information. To complete a booking or reservation for which the relevant Travel Partner requires Identity Document Information, including without limitation a flight, train, or accommodation booking, the Identity Document Information of travelers (including without limitation document images, date of birth, document number, document validity period, issuing country, and nationality) may be processed. This information is necessary to submit the booking to the Travel Partner; MachinePulse does not retain the original documents after that submission is completed, except where required by law or necessary to handle a dispute.
3.11 Travel preference and itinerary data. Where the User enables the feature, loyalty program or frequent flyer numbers, seat, room type, table, or other booking preferences, dining, dietary, and accessibility needs voluntarily provided by the User, itinerary and reservation history, and delivery information for Travel Credentials may be processed. MachinePulse processes such information only to the extent the User voluntarily provides it and it is necessary for that booking.
3.12 Travel compliance screening data. To satisfy Travel Compliance Requirements, traveler name, date of birth, gender, document elements, and a government-issued redress number may be processed and transmitted to carriers or competent authorities; screening against sanctions and no-fly lists may be performed and screening results recorded.
4. Sources of Personal Data
Personal Data may be obtained from:
4.1 the individual providing Content or creating an account;
4.2 devices, browsers, and apps used to access the Services;
4.3 Third Party Services connected or enabled through the Services, including calendar, email, messaging, health, or smart-home applications authorized by the User (data accessed is limited to what is necessary to operate the requested feature; the User may revoke authorization through device or in-app settings; the third party acts as an independent controller for data held in its own systems; subject to those services' terms);
4.4 publicly accessible sources when Social Media features are enabled and retrieval of Public Social Media Data is requested; and
4.5 MachinePulse's service providers acting on its instruction, where they return operational data to MachinePulse as part of service delivery — including call outcomes, call records, and task completion information returned by the AI calling service.
5. Purposes of processing
Personal Data may be processed for the following purposes:
5.1 Provide and operate the Services
Receive, process, and respond to Content, generate Outputs, maintain functionality and continuity, and provide user requested features.
5.2 Safety, security, and integrity
Prevent, detect, and respond to abuse, fraud, and security incidents, enforce service limits and acceptable use rules, and maintain audit and security logs.
5.3 Location dependent functionality
Provide location based features and Outputs, including maps or nearby results where offered, and enable location sharing features where enabled.
5.4 Social Media functionality
Process Social Media Information and retrieve Public Social Media Data when the feature is enabled, for example to summarize, extract context, generate recommendations, or support requested personalization.
5.5 Advertising, analytics, and measurement
Display advertisements, measure reach and performance, manage frequency, detect ad fraud, and improve measurement quality.
5.6 Improve and develop the Services
Debug, test, and improve reliability, safety, and user experience, and develop and improve models and systems, including by using Content and related data where permitted by law and subject to choices described in this Notice and applicable settings.
5.7 Compliance and legal obligations
Comply with applicable law and lawful requests, protect rights, safety, and security, and investigate and address disputes or claims.
5.8 AI voice calling. Call records received from the AI calling service (as described in Section 3.9) are processed to verify the booking outcome, provide a record of the call for the User and called parties, support dispute resolution, and maintain AI disclosure-consent compliance records. Called parties may submit access, correction, or deletion requests to legal@machinepulse.ai.
5.9 No model training by default. Call audio, transcripts, and called-party voice are not used by default to train any generative or voice-cloning model. De-identified aggregate statistics may be used to improve quality assurance and intent recognition. Broader training use will require separate opt-in consent.
5.10 Performance of the Agentic Assistance Feature
Process Booking Instructions, search for and compare products and services and provide information, transmit the User's confirmed requests to Travel Partners, complete payment authorizations, receive and deliver Travel Credentials, and handle cancellations, changes, refunds, and related disputes.
5.11 Travel compliance and legal obligations
Satisfy Travel Compliance Requirements, including submitting traveler information to carriers or competent authorities, conducting sanctions and no-fly list screening, and responding to valid requirements of law or competent authorities.
5.12 Identity Document Information and payment data are not used for model training
Identity Document Information, Payment Authorization Data, travel document images, and payment transaction details are not used to train, fine-tune, or improve any generative, voice-cloning, or other model, nor for targeted advertising or consumer profiling.
6. Location features
6.1 Core location requirement. Certain core features require location access. If location access is disabled, those core features may not operate or may be materially limited.
6.2 Foreground location. When the Services are used actively, location may be processed to provide requested functionality.
6.3 Background or continuous location. If background or continuous tracking is offered, it is enabled only when the relevant feature is activated and may be disabled through the Services and device settings.
7. Social Media features
7.1 Two inputs. Social Media features may process:
(a) Social Media Information provided through the Services; and
(b) Public Social Media Data retrieved from publicly accessible sources when the feature is enabled.
7.2 Third party platform practices. Social media platforms process data under their own policies. MachinePulse does not control those platform practices.
7.3 Non-user data. Public Social Media Data may include information about other individuals appearing in public posts. Processing is limited to what is necessary for the enabled feature and is not intended to create profiles for those individuals for unrelated purposes.
8. Advertising, cookies, SDKs, and measurement
8.1 The Services may display advertisements provided by MachinePulse and/or third party advertising partners.
8.2 Advertising and measurement may involve processing advertising identifiers, cookie identifiers, SDK event identifiers, IP address, and related event signals to deliver ads, measure performance and attribution, detect fraud, and manage frequency.
8.3 Where required by law, consent mechanisms are used for non-essential cookies, SDKs, or similar technologies. This includes the requirement under the ePrivacy Directive for storing or accessing information on a device, unless an exemption applies.
8.4 Where required by law, non-essential cookies/SDKs may be refused or withdrawn through the relevant mechanism; some measurement and personalization functions may be reduced as a result.
8.5 Affiliate and referral tracking. Some links to Third Party Services include affiliate or referral identifiers used to attribute referrals. In jurisdictions where this constitutes "Sharing" or "Cross-Context Behavioral Advertising" under California CCPA/CPRA, Colorado CPA, Connecticut CTDPA, or similar laws, a "Do Not Sell or Share My Personal Information" control is provided, and Global Privacy Control signals are honored.
9. Group interactions and non-interacting participants
9.1 No default account attribution. Group interaction content is processed in the group context by default and is not automatically stored under an individual account profile solely because a participant is present in the group interaction.
9.2 Non-interacting participants. We do not intend to process personal information for non-interacting participants. Where an individual is present in a group interaction but does not interact with the Services directly, the Services are designed to:
(a) avoid creating an account profile for that individual;
(b) avoid linking group messages to an account; and
(c) avoid writing group content into any long term memory feature for that individual.
Limited transient processing may still occur for message delivery, abuse prevention, and security.
9.3 Itinerary information in group interactions. Where a booking is initiated in a group interaction, itinerary details and traveler information may be visible to other participants in that conversation; the User should avoid submitting another person's document information or payment credentials in a group interaction.
10. Sharing
Personal Data may be shared with the following categories of recipients:
10.1 Service providers and processors providing hosting, storage, messaging integration, model inference infrastructure, analytics, customer support tooling, and security and fraud prevention. The names of, and the current list of, such recipients are published together on the Partner List Page (https://app.karpo.ai/partners) and are not fixed in the body of this Notice.
10.2 Advertising partners providing ad delivery, measurement, and fraud prevention services. The names of, and the current list of, such recipients are published together on the Partner List Page (https://app.karpo.ai/partners).
10.3 Affiliates where necessary to operate the Services, subject to appropriate safeguards.
10.4 Legal and safety disclosures to comply with law, lawful requests, and to protect rights, safety, and security.
10.5 Corporate transactions in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to applicable law and appropriate protections.
10.6 Booking and reservation partners. Where the User initiates a booking, reservation, or purchase through a third-party travel, activity, ticketing, restaurant, or local-services platform, the Personal Data necessary to fulfill the request (including Identity Document Information provided in accordance with law) is transferred to that platform, which acts as an independent controller under its own privacy policy. The categories and names of certain Travel Partners, and links to their respective privacy policies, are published and updated from time to time by Karpo on the Partner List Page (https://app.karpo.ai/partners); additions to and removals from the list are governed by what is published on that page, do not constitute an amendment to this Notice, and do not require separate confirmation by the User on each occasion. For a Travel Partner not published on the Partner List Page, MachinePulse will, before the User's booking, provide its product change and refund rules, privacy policy, and similar information (if any), and will provide the User's Personal Data after the User confirms.
10.7 Mobile information and SMS opt-in data. Notwithstanding Section 10.2 and Section 16, mobile phone numbers, SMS / one-time verification codes, and SMS consent or opt-in records collected for account verification, authentication, or transactional messaging are not shared, sold, rented, or otherwise disclosed to any third parties or affiliates for their own marketing or promotional purposes. Limited disclosure to telecommunications carriers, our SMS service providers, and other vendors acting on our behalf is permitted solely to the extent necessary to deliver the messages the User has requested or to comply with applicable law.
10.8 Payment service providers. To complete payment authorization, charging, refunds, and chargeback handling, information necessary for the transaction may be transmitted to licensed payment service providers. The full payment card number and payment password are held by those service providers.
10.9 Carriers, accommodation, dining, and venue providers. For ticketing, booking or reservation confirmation, and fulfillment, traveler name, document elements, contact details, and itinerary or reservation information may be transmitted to airlines, rail operators, hotels, restaurants, event and venue operators, ticket sellers, and their authorized agents.
10.10 Competent authorities. Under law or a valid requirement of a competent authority, personal information may be disclosed to transportation security, customs, immigration, or other authorities for travel compliance, security screening, or the performance of legal obligations.
11. Data retention
11.1 Personal Data is retained only as long as necessary for the purposes described in this Notice, including providing the Services, maintaining safety and security, advertising measurement and fraud prevention, complying with legal obligations, and resolving disputes.
11.2 Retention periods vary by data type and purpose. Security logs and fraud prevention records may be retained longer to investigate and prevent repeat abuse. Advertising and measurement data may be retained as necessary for reporting and fraud prevention, subject to applicable law and partner requirements.
11.3 Where deletion is requested, certain records may be retained where legally required or necessary for fraud prevention, security investigations, or legal claims.
11.4 AI call data is retained only as long as necessary for the feature, task verification, dispute handling, and applicable recordkeeping. Retention may be extended where required for an active dispute, regulatory inquiry, or legal claim.
11.5 Identity Document Information and payment data. Identity Document Information is retained only as long as necessary to complete a single submission and is not retained long term in a retrievable form; retention of payment data is determined by the policies of the payment service provider and applicable law. This is subject to retention where necessary to handle chargebacks, disputes, audits, or legal obligations.
12. Controls and requests
12.1 Social Media Information control. A product control may be provided to manage Social Media features, including disabling retrieval and processing of Public Social Media Data associated with the enabled feature, and limiting retention of Social Media Information for subsequent use where supported.
12.2 Requests. Requests to exercise privacy rights may be submitted to legal@machinepulse.ai. Verification may be required.
12.3 Advertising related choices. Where applicable law requires opt out choices for certain advertising activities, mechanisms may be provided through the Services, through device settings, or via other reasonable means.
12.4 Model improvement controls. Where supported, controls may be provided to limit use of Content for service improvement, including model improvement. Requests to object to or restrict such processing may be submitted to legal@machinepulse.ai. Where an opt-out, restriction, or objection applies, MachinePulse will stop using the relevant Content for that purpose, subject to legally required exceptions (for example, security and fraud prevention).
12.5 AI call controls. Within privacy and security settings, the User may (a) view, download, or delete AI call records (audio, transcripts, metadata); (b) globally disable recording; and (c) exercise rights of access, rectification, deletion, and portability where granted by law.
12.6 Disabling the Agentic Assistance Feature and stored information. As of the current version of the Services, a User who wishes to disable the Agentic Assistance Feature and delete the personal information stored by it may do so by deleting their account. Deletion does not affect the archived records of orders formed before deletion, nor retention necessary to handle disputes or to perform legal obligations.
13. International transfers
13.1 MachinePulse operates globally and Personal Data may be processed in Singapore and other countries.
13.2 Where European data transfer rules apply, appropriate safeguards are used, such as Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable, together with supplementary technical and organizational measures where appropriate.
13.3 Transfers in the context of the Agentic Assistance Feature. The Travel Partners involved in a booking may be located outside the User's country or may process data globally in their own systems. The Personal Data necessary to complete the booking (including Identity Document Information) will be transferred to those partners; where European data transfer rules apply, the safeguards described in Section 13.2 are used.
14. Security
14.1 MachinePulse maintains technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure.
15. European Users Notice (EEA, UK)
| Processing activity | Typical Personal Data | Data subjects | Lawful basis and GDPR article reference |
|---|---|---|---|
| A. Core service delivery, including location dependent core features used during active use | Content, account identifiers, location during active use, basic delivery logs | Users | Performance of a contract, Art. 6(1)(b) |
| B. Account creation and authentication | phone number or account identifier, verification codes, timestamps, account settings | Users | Performance of a contract, Art. 6(1)(b) |
| C. Group interactions | group messages and attachments, limited participant and group metadata, routing and security signals | Users and non interacting participants | Users: Art. 6(1)(b). Non interacting participants: limited transient processing for delivery and security under legitimate interests, Art. 6(1)(f) |
| D. Public Social Media Data retrieval after feature enablement | handles, profile links, public profile information, public posts and related metadata | Users, and other individuals appearing in public posts | User requested feature delivery: Art. 6(1)(b) where objectively necessary for the enabled feature. Optional ongoing retrieval or enrichment: Art. 6(1)(a) consent. For other individuals in public posts: limited processing under Art. 6(1)(f) with transparency under Art. 14 where applicable |
| E. Social Media Information provided through the Services | Social Media Information, screenshots, copied text, links | Users | Performance of a contract, Art. 6(1)(b) |
| F. Background or continuous location tracking, if offered | Precise Location Data, timestamps, related feature events | Users | Consent, Art. 6(1)(a), withdrawal under Art. 7(3) |
| G. Advertising delivery, frequency capping, measurement, anti fraud | advertising identifiers, cookie or SDK identifiers, IP address, event signals | Users | Legitimate interests, Art. 6(1)(f) for contextual ads and fraud prevention. Consent, Art. 6(1)(a) where required for non essential tracking, including under ePrivacy Art. 5(3) |
| H. Security, fraud prevention, abuse detection, enforcement of Terms | security logs, device and network data, risk signals, content classification labels | Users and non interacting participants (limited) | Legitimate interests, Art. 6(1)(f), and legal obligation, Art. 6(1)(c) where applicable |
| I. Customer support and dispute handling | support tickets, emails, chat transcripts, diagnostic info | Users | Performance of a contract, Art. 6(1)(b), and or legitimate interests, Art. 6(1)(f) |
| J. Service improvement, including model evaluation and training where used | Content, Outputs, feedback, aggregated usage metrics | Users | Legitimate interests, Art. 6(1)(f), and or consent, Art. 6(1)(a) where required for specific uses. Right to object applies when relying on legitimate interests |
| K. Legal compliance and lawful requests | account data, logs, content as necessary | Users and others where relevant | Legal obligation, Art. 6(1)(c), and or legitimate interests, Art. 6(1)(f) |
| L. AI voice calling | User's name and contact number; task context; call records returned by the AI calling service (audio where permitted, transcripts, call metadata, disclosure logs) | Users; called parties (merchant staff) | Performance of a contract, Art. 6(1)(b), for executing the booking on the User's instruction. Legitimate interests, Art. 6(1)(f), for call records and disclosure-consent logs relating to called parties. |
| M. Performance of the Agentic Assistance Feature | Traveler name, date of birth, document elements, contact details, itinerary information, Travel Credentials | Users and travelers designated by them | Performance of a contract, Art. 6(1)(b). Explicit consent under Art. 9(2)(a) where the User voluntarily provides health information such as dietary or accessibility needs |
| N. Payment processing and transaction records | Payment instrument type and identifier, authorization tokens, transaction amounts and times, billing address, refund information | Users | Performance of a contract, Art. 6(1)(b); retention of accounting and tax records under Art. 6(1)(c) |
| O. Travel compliance screening | Traveler name, date of birth, gender, document elements, government-issued redress number, screening results | Users and travelers designated by them | Legal obligation, Art. 6(1)(c); processing necessary for security purposes under Art. 6(1)(f) |
16. U.S. Users Notice
16.1 Where U.S. state privacy laws apply (including California and certain other states), disclosures of identifiers and online activity data to advertising and measurement partners for ad delivery, attribution, and fraud prevention may be treated as a "sale" or "sharing" of personal information and/or "targeted advertising" under applicable statutory definitions.
16.2 Where required, requests to opt out of sale/sharing/targeted advertising, and requests to access, delete, or correct personal information, may be submitted to legal@machinepulse.ai, and verification may be required.
16.3 Where applicable and required by law, browser or device based universal opt out signals may be honored, and exercising opt out rights may affect availability of advertising supported features and certain personalization.
16.4 Sensitive personal information. Where the Agentic Assistance Feature is used, Karpo uses sensitive personal information such as Identity Document Information (for example, passport number or driver's license number), precise location, and account login credentials only to the extent necessary to provide the Agentic Assistance Feature, and does not use it to infer characteristics about a consumer or for targeted advertising. The User has the right to limit the use and disclosure of such sensitive personal information, exercisable through the means described in Section 12.6.
16.5 Statutory notice regarding aviation passenger data. Under the U.S. Transportation Security Administration's Secure Flight requirements, carriers must submit the traveler's name, date of birth, gender, and redress number before or after ticketing; that data is provided by the carrier to the Transportation Security Administration and is subject to the federal privacy notice.
17. Children
17.1 The Services are intended for individuals who are at least 18 years old. MachinePulse does not knowingly collect Personal Data from individuals under 18. Where such data is identified, it will be deleted without undue delay, except where retention is required for security, fraud prevention, or legal claims. Parents or legal guardians may contact legal@machinepulse.ai; verification may be requested.
18. Changes
18.1 MachinePulse may update this Notice from time to time. The Effective Date will be revised accordingly. Material changes will be notified through in-Service notice or other appropriate means.
19. Contact
Privacy questions, requests, or complaints: legal@machinepulse.ai