Privacy notice

This notice explains what happens to personal data when you use Talk to MAIA at talk.maia-8.click. It is given under Article 13 of the General Data Protection Regulation, Regulation (EU) 2016/679, as applied in Malta by the Data Protection Act, Chapter 586 of the Laws of Malta.

It is shown to you before you enter your phone number, and it applies from that moment. Nothing on this page asks you to agree to anything; it tells you what happens if you go on.

Who is responsible

The controller is MAIA Brain P Ltd, a private limited liability company registered in Malta, with its registered office at 2, Spinola Road, St Julians STJ 349, Malta.

You can reach us about anything in this notice by email at info@maiabrain.com or by telephone on +356 2010 2020.

The notice at www.maiabrain.com/privacy covers our website and our email. This page covers Talk to MAIA, which does collect personal data, and says exactly what.

What we collect

Your mobile number. You give it to sign in. We check its country code against the countries we can text, text a six-digit code to it, and you type the code back to show the number is yours.
The network address you connect from. Every connection carries it. We use it to limit how many codes and how many questions one address can ask for.
Your conversation. The questions you ask and the answers MAIA gives.
What MAIA notes about you. If you mention your company, your sector, your role, the problem you have or anything else about yourself, MAIA may note it. The model decides what to note and how to word it; there is no fixed list and no length limit. The notes are used to write the answer in hand and to recompose the page on the left for you, and they are shown to you in the chat and at the top of that page.

We do not ask for your name. Please do not tell MAIA anything about your health, beliefs or other sensitive matters, or personal details about other people. Nothing in the service detects or removes them: anything you type is sent to OpenAI with the rest of the conversation, and it may end up in what MAIA notes about you.

Who else is involved

Three processors act on our instructions. What each receives is set out here.

Twilio: Receives your mobile number and the text message we send to it, which contains your code.; Why to deliver the code to your phone.; How long Twilio keeps a record of each message sent through our account, including the number and the text, under its own retention rules. We have not set up automatic deletion of those records.
OpenAI: Receives everything the service sends to the model to compose answers and the page: your questions and the recent conversation, what MAIA has noted about you, material from our knowledge base and from MAIA's own website, and MAIA's own drafts, including drafts that our checks refused, sent back with the reasons so that the model can correct them. Each answer and each page can take several such rounds, and each round sends the material again. It does not receive your phone number or your network address.; Why an OpenAI model writes MAIA's answers from what the knowledge base returns, and writes the page on the left from what you have told MAIA.; How long under OpenAI's standard terms for its API, it may keep what it receives for up to thirty days to detect abuse, and it does not use it to train its models. We have not arranged a shorter period.
Amazon Web Services: Receives everything listed above. The service runs on an AWS server in Frankfurt (region eu-central-1). Everything the service itself holds, including its log, is on that server.; Why hosting.; How long as set out under the next heading.

We do not sell personal data, we do not share it for advertising, and nothing from this service goes anywhere other than the three processors above, except to a public authority entitled to it.

How long we keep things

The service has no database. Apart from the log described below, it writes nothing about you to disk. What it holds, it holds in the memory of the running process:

Your code exists in plain form only for the moment it takes to send it to Twilio and, when you type it back, to check it; Twilio's copy is described above. After that we keep only a keyed digest of it, with your number and your network address, until the code is used, or until an attempt is made after five wrong ones or after the code has expired. Codes expire after five minutes. A code that is never used stays in memory, useless, until the service restarts.
Your number and your network address are also kept as the keys of counters: one limits how many codes a number or an address can receive in a day, another how many questions an address can ask in an hour. These counters stay in memory until the service restarts, which happens whenever we update it and on no fixed schedule.
Your verified number is held in full with your connection until it closes, and is sent back to your browser once, when you sign in; the page shows it with the last four digits hidden.
Your conversation is held on the server for as long as your page stays connected, and only its last six questions with their answers; those are what is sent to OpenAI as context for your next question. The server keeps no copy of the full transcript; the one on your screen is held by your browser tab, not stored on your device. What MAIA noted about you is held for the same connection. When you close the page or the connection drops, they are gone, and we cannot recover them.

To check and lay out the page written for you, the service passes what MAIA noted about you, and the page itself, to a reasoning process on the same server. That process answers and does not store what it is sent.

The service keeps a log of technical events on the server: the network address and path of each request, and errors. It does not write your conversation to that log. It does not write your phone number either, with one exception: when Twilio refuses to send a code, the refusal is logged with Twilio's reason and the number cut to its first six characters, both where the number appears on its own and inside Twilio's message, so that we can tell which country the refusal concerned. This log is kept for thirty days.

Before we set that period, the same log went to the server's shared system log, and a refusal wrote the full number. Those older lines stay there until the server recycles them, which it does by its own size and rotation limits, not on a date we set.

What Twilio and OpenAI keep is described above.

Why, and on what basis

We verify your number, and limit how many codes a number or an address can receive and how many questions an address can ask, because every message and every answer costs us money, and an open service of this kind is abused within minutes of going online. The legal basis is Article 6(1)(f), our legitimate interest in keeping the service available and its cost bounded. The same basis covers the server log, which we keep to operate and secure the service.

We send your conversation, and what you tell MAIA about yourself, to OpenAI because that is how the service you asked for answers you and writes the page for you. The legal basis is Article 6(1)(b), processing necessary to provide the service you request.

You do not have to give us your number, but without one you cannot sign in. MAIA makes no decision about you that has legal or similarly significant effects. What it notes about you shapes the answers and the page you are shown, and is used for nothing else.

Cookies and browser storage

This service sets no cookies, and writes nothing to local storage, session storage or any other store on your device. The page loads nothing from any third party.

Where data goes

The service itself runs in Frankfurt. Twilio and OpenAI are United States companies, and what they receive may be processed outside the European Economic Area. Those transfers rest on the mechanisms in Chapter V of the Regulation: adequacy decisions, including the EU–US Data Privacy Framework, where they apply, and the Standard Contractual Clauses in the processors' terms where they do not. You may ask us for information about the safeguards that apply.

Your rights

You may ask for access to your personal data, for it to be corrected or erased, for its processing to be restricted, and, where the conditions in Article 20 are met, for it to be given to you in a portable form.

Where we process on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation, and we will stop unless we can show compelling legitimate grounds that override your interests.

Write to info@maiabrain.com. We answer within one month, and we will tell you if we need longer and why. Because the conversation is gone when you disconnect, we will usually have nothing of it to give you; a request about what Twilio or OpenAI hold, we will pass on to them.

If you are not satisfied

You may lodge a complaint with the Information and Data Protection Commissioner, the supervisory authority for Malta, or with the authority in the country where you live or work. Doing so does not affect any other remedy available to you.

Changes to this notice

This notice describes what the service does today, and it is written from the code that was running when it was published. If that changes, this notice changes with it.

MAIA Brain P Ltd · 2 Spinola Road, St Julians STJ 349, Malta · info@maiabrain.com · Back to the chat