Draft. Not checked by a lawyer yet. It can change before it is final.
We are a small Australian company. This page says plainly what we do to protect data, and what we don't do yet.
Where your data is kept
We use well-known cloud services. Some keep data overseas, mainly in the United States and Germany.
- Twilio: phone numbers, calls, voicemail and texts.
- Airtable: client records and Job Catcher enquiries.
- n8n Cloud: the automations that link the services.
- Anthropic: the AI that turns enquiries into job cards.
- Stripe: card payments.
- Cal.com: booking links, only when a client replies BOOK.
- Vercel and GitHub: this website and our code.
- Slack: our internal alerts, with as little personal detail as we can.
- Google (Gmail): email.
Full list: our privacy policy, section 7.
What we do
- This website is served over a secure connection (HTTPS) by Vercel.
- Card details are handled by Stripe. We never see or keep full card numbers.
- We turn on two-step login on our systems where it is offered. We have not yet confirmed it is on for every one.
- Passwords and keys are kept in the tools' own credential stores, not in documents or chat.
- We choose settings that keep customer data out of AI training where a service offers them. We have not yet confirmed this on every AI account.
- We keep personal details out of alerts and logs where we can.
- The AI sorts and summarises enquiries. A person always makes the decision. Job Catcher never quotes, prices or rejects anyone.
- Our clients own their customer data. We never sell it or use it for our own marketing.
What you should know
- Access to customer records is limited by our own rules, not by a technical lock. The founder, and AI tools he controls, can reach records to set up, support and fix the service.
- Job form photos are sent to the business as links. No login is needed, so anyone with the link can open the photo. The texted link stops working after 2 hours. It leads to a second link, at Airtable, that can keep working for a few more hours.
- Logs of failed runs can hold customer details until they are cleared.
- Texts travel over public mobile networks. Please don't send card numbers or similar by text.
- We have not had an independent security audit of MAIA. We choose providers that publish their own security programs.
- No system is perfectly secure.
How long we keep data
Job Catcher enquiry records: 12 months, then deleted (not yet an automatic job). When a client leaves: deleted within 30 days, after they can take a copy. Twilio keeps its own copies of texts and voicemails, which can last longer. Full table: privacy policy, section 12.
If something goes wrong
If we find a breach likely to cause serious harm, we contain it and tell affected clients within 2 business days of finding it. Where the Notifiable Data Breaches scheme applies, we also tell the OAIC and the people affected.
Insurance
We will have professional indemnity and cyber insurance in place before any client goes live.
Found a security problem?
Email hello@maiasystems.com.au with "Security" in the subject. Please don't test on real customer data. We will reply within 5 business days.