maif

Legal

Privacy Policy

Last updated

Draft: this document is being finalised and may change before it takes effect.

This policy explains what personal data we collect when you use this website, why we collect it, who we share it with, and what rights you have. It covers this website only; the assistant we install on our customers' websites is covered by our agreement with each customer.

Who we are

This website is run by [Company legal name] ([Trade register number, tax ID]), [Registered office address], which is the controller of the personal data described here. The product is built by XCODES.

For anything about your data, write to [privacy@yourdomain].

What we collect, and why

We only collect what you give us, or what is needed to run the site:

  • When you book a call: your name, your email and, if you write one, a note. We use them to schedule the call and send you the invitation. Legal basis: steps you ask us to take before a possible contract.
  • When you send us a message: your name, your email, your company if you give it, and your message. We use them to reply to you. Legal basis: our legitimate interest in answering the people who write to us.
  • When you sign up for the free days: your email and the industry you were looking at. We use them to set the trial up with you and to confirm it by email. Legal basis: steps you ask us to take before a possible contract.
  • When you write to the assistant on this site: the messages you type, the industry you chose and the language of the page. We use them to answer you, and for nothing else. Legal basis: our legitimate interest in answering your questions, which you ask by writing them.
  • When you start a voice call with the assistant: your voice, the transcript of what you and the assistant say, and the same details as for the written chat. Legal basis: your consent, which you give when you start the call and allow the microphone, and withdraw by ending the call.
  • When you ask the assistant to be contacted: your name, your email, your phone if you give it, and the recent messages of the conversation, so that the colleague who writes back knows what you asked about. Legal basis: steps you ask us to take before a possible contract.
  • When you fill in one of the forms (booking a call, a message, the free days, a request to be contacted from the assistant): Google reCAPTCHA checks that a person is sending it, not a program. It loads only once you start on a form; Google then receives your IP address and information about your browser, your device and how you use the page, and gives us a score for that one form. Legal basis: our legitimate interest in keeping the forms free of spam and abuse.
  • Your IP address, to limit how many bookings, messages and assistant questions can be sent from one place and so keep out abuse. We hold it in memory for up to one hour and do not store it. Legal basis: our legitimate interest in keeping the site secure.
  • Technical logs kept by our hosting provider (such as IP address, pages requested and time), for security and to keep the site running. Legal basis: our legitimate interest.

The assistant, the voice calls and the demos on this site

The assistant on this website is an AI system, and it says so when it introduces itself. It answers from our own knowledge base with an AI model; what it says is information about our product, not a contract, and not legal, medical or financial advice.

The scripted demonstration that plays when you arrive, the playground and the case studies run in your browser; nothing of them is sent anywhere. The moment you type your own message, the conversation so far is sent to our server and on to Anthropic PBC, whose Claude model writes the answer. We do not store your conversation. Anthropic processes it on our behalf, does not use it to train its models, and keeps it for a limited time under its data retention policy.

If you start a voice call, you are told first that you will be talking to an AI, and the call starts only when you agree and allow the microphone. During the call your voice is sent to ElevenLabs, which turns it into text and the assistant's answers into speech; the transcript is shown to you in the chat and is answered by the same model as the written chat. ElevenLabs keeps the call's audio and transcript for the period set in our account. You can end the call at any time.

If you ask the assistant to be contacted, it shows a short form. What you enter, together with the recent messages of the conversation, is emailed to our team, and a copy goes to you.

If you use the microphone button to dictate a message, rather than to call, your browser turns your speech into text. In Google Chrome and some other browsers, this is done by sending the audio to the browser maker's speech service (for Chrome, Google). We do not receive the audio.

Who we share it with

We do not sell your data or share it for advertising. We use a few service providers who process it on our behalf:

  • Anthropic PBC (United States), whose Claude models write the assistant's answers from your messages.
  • ElevenLabs (United States), which carries voice calls with the assistant: speech to text and text to speech.
  • Google (Google Calendar), to schedule calls and send invitations.
  • Google (reCAPTCHA), to tell people from programs on the forms. Google LLC may process the data in the United States, is certified under the EU-US Data Privacy Framework, and applies its own Privacy Policy and Terms of Service to reCAPTCHA.
  • Resend (United States), our email provider, to deliver the messages you send us and the confirmations we send you.
  • Hotjar Ltd (Malta), which, only with your consent, shows us how the pages are used, with heatmaps and recordings of visits, and stores the data in the European Union.
  • Our hosting provider, to run the website.
  • picsum.photos, which serves some of the sample photos in the demos; your browser requests them directly, so that service sees your IP address.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is covered by the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

How long we keep it

  • Bookings stay in our calendar for as long as we need them to follow up with you, and no longer than two years after the call.
  • Messages stay in our inbox for as long as the conversation with you is active, and no longer than two years after it ends. The same applies to a request to be contacted sent from the assistant, and to a sign-up for the free days.
  • Conversations with the assistant are not stored by us. Anthropic keeps what it processed for a limited time under its data retention policy; ElevenLabs keeps the audio and transcript of a voice call for the period set in our account.
  • Rate-limiting data is held in memory for up to one hour.
  • Hotjar keeps recordings of visits and heatmap data for one year from when they were collected.
  • We do not keep reCAPTCHA's score: it is read for the one form it was asked for. Google keeps what it collects under its own Privacy Policy.

Cookies

This website sets one cookie it needs: “locale”. It remembers the language you are reading the site in, chosen with the language switcher or by opening a page in that language, so the pages you visit next and your next visit open in it. It holds nothing but the language code and expires after one year.

It also keeps one item in your browser's local storage: “maif-demo”. Once the assistant's demo on the home page has played for you, and you have watched it to its end, stopped it, closed it or taken the conversation over, it records when that was and which version of the demo you saw, and nothing else, so the demo does not play by itself on your next visits; it still plays whenever you ask for it. It is never sent to us, and it is forgotten six months after it was last set. Clearing this site's data in your browser erases it.

Once you start filling in a form, Google reCAPTCHA loads to keep out programs sending spam. To tell people from programs, Google may set a cookie called “_GRECAPTCHA” under google.com, which expires after six months, and keep similar data in your browser's storage. It is needed for the form you are filling in to be accepted, so the banner does not ask about it; if you never use a form, it never loads.

With your consent, and only then, it also uses Google Analytics 4 to measure how the site is used: which pages are visited, from where and for how long, as aggregate statistics. Google Analytics sets the cookies “_ga” and “_ga_GHWTXKB1RD”, which expire after two years. It does not record your IP address, and we have switched off Google's advertising features, so the data is not used to build a profile of you or to show you advertising. Google LLC, which processes the data on our behalf and may do so in the United States, is certified under the EU-US Data Privacy Framework.

With the same consent, it also uses Hotjar to see how the pages are used: where visitors click and how far they scroll, as heatmaps, and recordings of visits that show the pointer, the scrolling and the pages as they appeared. What you type into fields is never recorded, and your conversation with the assistant and the email address a confirmation names are hidden in your browser before anything is sent. Hotjar sets the cookies “_hjSessionUser_6834586”, which expires after one year, and “_hjSession_6834586”, which expires 30 minutes after your last action, plus a few working cookies and storage items that last no longer than the visit. It does not store your IP address. Hotjar Ltd, in Malta, processes the data on our behalf, stores it in the European Union (Ireland) and keeps it for one year; Hotjar may also use it to improve its own services.

On your first visit a banner asks whether to allow analytics. Nothing from Google or Hotjar loads until you say yes; if you decline, or say nothing, the site is measured by no one. Your answer is kept for six months in a cookie called “cc_cookie”. You can change it at any time with “Cookie settings” in the footer — withdrawing consent erases Google's and Hotjar's cookies — or delete the cookies in your browser.

Your rights

Under the GDPR you can ask us to:

  • tell you what data we hold about you, and give you a copy;
  • correct it, or delete it;
  • restrict how we use it, or stop using it where we rely on our legitimate interest;
  • give it to you, or to someone else, in a machine-readable form.

Write to [privacy@yourdomain]. We will answer within one month. You also have the right to complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), https://www.dataprotection.ro.

Security

The site is served only over HTTPS, bookings, messages and assistant conversations are checked on our server before anything is done with them, the keys to our AI and email providers never leave the server, and access to our calendar and inbox is limited to the people who need it.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change matters for how we use your data, we will say so on the website.

See also our Terms of Use.