Privacy Policy

1. Who we are

Maia Labs LTD is a company registered in England and Wales. We are the data controller responsible for your personal data processed through this website and our services.

Contact: info@maialabs.net

2. What data we collect

We may collect and process the following personal data:

• →Identity data: name, job title, company name.
• →Contact data: email address, phone number, postal address.
• →Technical data: IP address, browser type and version, operating system, and platform.
• →Usage data: the pages you request, the date and time, and the referring page, as recorded in our server and network logs.
• →Communication data: messages you send us via contact forms, email, or telephone, including call recordings where our AI Receptionist service is in use and you have been informed at the start of the call.
• →Caller memory data: where a business that uses our AI Receptionist has switched caller memory on, the phone number you call from, your first name if you give it, why you rang (as a category), how the call ended, the language you spoke, and the dates of your calls. See section 6.
• →Transaction data: payment details, purchase history, and billing information processed through our payment provider.
• →Business content data: where you give us a website address during onboarding, we read the publicly available content of that website and use it to build your AI agent's knowledge base. This can include information about your staff and your published contact details. You are responsible for ensuring you have the right to provide this content to us (see Terms of Service, clause 9).

3. How we collect your data

We collect data through:

• →Direct interactions: when you fill in forms, contact us, subscribe to our services, or correspond with us.
• →Automated technologies: server logs as you interact with our website.
• →Third parties: our payment processor and, for the services we run for your business such as paid ads, the analytics and advertising platforms those services use. None of them collects data from your visit to this website.

4. Lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we rely on the following lawful bases:

• →Consent: where you have given clear consent for us to process your personal data for a specific purpose (e.g. marketing emails).
• →Contract: where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• →Legitimate interests: where processing is necessary for our legitimate interests (e.g. improving our services, fraud prevention) and your interests and fundamental rights do not override those interests.
• →Legal obligation: where we need to comply with a legal or regulatory obligation.

5. How we use your data

We use your personal data to:

• →Provide and manage our AI services (AI Receptionist, Custom AI Agents, Business Automation, Data Analytics, Website Design, and Vertical AI Solutions).
• →Process payments and manage your account.
• →Communicate with you about your account, services, and support requests.
• →Send marketing communications where you have opted in.
• →Improve our website, products, and services.
• →Comply with legal and regulatory obligations.

6. AI-specific data processing

Our AI services process data to deliver functionality such as call handling, appointment booking, and workflow automation. Key points:

• →Call recordings and call transcripts are stored securely and retained for a maximum of 90 days unless you request earlier deletion.
• →Website voice chat (Talk to Sarah): Maia Labs is the controller. We use the chat to answer your questions about our services and to improve how Sarah answers them, relying on our legitimate interests in responding to enquiries and improving our service. Your voice is processed live so Sarah can understand you, but no audio recording is kept. We keep a text transcript of each chat, set to be deleted after 30 days; Sarah tells you this at the start of the chat. Nothing is loaded from ElevenLabs, unpkg, jsDelivr or Google Cloud Storage until you select Talk to Sarah; the chat widget then loads from them, which gives them your IP address and browser details. The chat is processed by ElevenLabs, our AI voice provider, in the United States under the transfer safeguards described in section 8. To have a transcript deleted sooner, email info@maialabs.net with the date and approximate time of your chat. If you change the chat's language, the widget remembers that choice in your browser (see section 11).
• →AI models are trained on aggregated, anonymised data. Your individual business data is not used to train models shared with other customers.
• →Knowledge-base content built from your website is deleted from our AI voice platform within 30 days of your subscription ending or your trial expiring. We keep a record of what was deleted and when, but not the content itself.
• →Each client's AI agent is a separate instance with its own knowledge base. No client's agent can access another client's knowledge base or call data.
• →Caller memory is optional and off unless the business you are calling has switched it on. When it is on, the receptionist checks at the start of the call whether your number has rung that business before, and if so greets you by first name where you gave one on an earlier call.
• →It keeps: your phone number, your first name if you gave it, why you rang as a category, how the call ended as a category, the language you spoke, and the date and count of your calls. It never keeps audio, a transcript or a voiceprint for this purpose, and it does not record sensitive details such as health or payment information.
• →Each fact is deleted 90 days after the call it came from. Withheld or unavailable numbers create no memory.
• →If you share a phone line, the greeting may use the name of whoever rang last from it. Tell the receptionist and it will correct the record; it will also stop remembering the line if you ask.
• →The business you called is the data controller for this memory. Maia Labs processes it on that business's behalf under a data processing agreement. On our own demonstration and sales lines, Maia Labs is the controller and relies on legitimate interests; our assessment is available on request.
• →The extraction of these categories from the call is performed by our AI voice provider as part of processing the call.
• →No automated decision-making with legal or similarly significant effects is carried out without human oversight.

7. Data sharing

We may share your data with:

• →Service providers: hosting and infrastructure, telephony and messaging, AI voice and language processing, payment processing, workflow automation, and, for the services we run for your business (not this website), analytics providers, all of whom process data on our behalf under data processing agreements. A current list of our sub-processors is available to business customers on request, under our Data Processing Agreement.
• →Professional advisers: lawyers, auditors, and insurers where necessary.
• →Regulatory bodies: HMRC, the ICO, or other authorities where required by law.

8. International transfers

We do not sell your personal data to third parties.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or transfers to countries with adequate data protection standards as determined by the UK Secretary of State.

9. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Typical retention periods:

• →Account data: duration of your contract plus 6 years (for tax and legal compliance).
• →Call recordings and transcripts: 90 days.
• →Website voice chat transcripts (Talk to Sarah): set to be deleted after 30 days. No audio recording is kept.
• →Caller memory: 90 days from each call, deleted automatically.
• →After you ask us to erase caller memory, short-lived copies can remain for a limited time in our processors' systems until they expire on their own schedule: post-call notifications to the business (deleted within 48 hours), workflow-automation execution logs (up to 30 days), and database backups. Backups expire on a rolling schedule and we do not restore them.
• →Call metadata (the numbers involved, date, time, and duration — never the content of the call): duration of your contract plus 6 years, retained as billing and accounting records.
• →Knowledge-base content built from your website: deleted within 30 days of your subscription ending or your trial expiring.
• →Where our workflow-automation provider processes call or enquiry data as part of delivering the service, its processing logs are retained for up to 30 days before automatic deletion.
• →Marketing data: until you unsubscribe or withdraw consent.

10. Your rights

Under UK GDPR you have the right to:

• →Access your personal data (Subject Access Request).
• →Rectify inaccurate or incomplete data.
• →Erase your data (right to be forgotten) where there is no compelling reason for continued processing.
• →Restrict processing in certain circumstances.
• →Data portability — receive your data in a structured, commonly used format.
• →Object to processing based on legitimate interests or direct marketing.
• →Withdraw consent at any time where processing is based on consent.

To get a copy of your caller memory or to have it erased, email info@maialabs.net from any address and tell us the phone number you called from and the business you called, or ask that business directly and it will pass the request to us. We reply within 72 hours with the copy or a confirmation of erasure, and we tell you which short-lived copies remain and when they expire.

11. Cookies and browser storage

Our website does not set cookies and, unless you use Talk to Sarah, does not save anything in your browser's local or session storage. It does not use analytics, advertising or any other tracking.

Talk to Sarah: the ElevenLabs chat widget is loaded only when you select Talk to Sarah; nothing is requested from ElevenLabs before that. If you change the chat's language, the widget saves that choice in your browser's local storage (as xi:convai-widget-last-used-language) so the chat opens in that language next time. You can clear it at any time in your browser settings.

Because nothing we store needs your consent, we do not show a cookie banner: the language choice is saved only when you ask for it and is not used for tracking.

Our website is delivered through Cloudflare, our network and security provider. If Cloudflare shows a security check to confirm that a visitor is a person and not an automated program, it may set a short-lived security cookie, such as cf_clearance. This cookie is strictly necessary to protect the website and is not used for tracking.

Cloudflare also asks your browser to report failed attempts to load our website (Network Error Logging). Your browser keeps this instruction for up to 7 days and sends a report to Cloudflare only when a page fails to load, never for successful visits. A report contains technical details such as the page address, the type of error and your IP address, and is used only to keep the website working.

12. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, regular security assessments, and incident response procedures.

13. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• →Website: ico.org.uk
• →Telephone: 0303 123 1113

14. Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.