MayaHow TryMaya handles your data and your visitors' data
TryMaya saves chats as text, saves a lead only after the visitor confirms it, stores no raw voice audio, and keeps each business's data apart with row-level security. The owner can export everything or erase the account. This page says what we store, who processes it and what we tested.
Website text is data, not instructions
An AI that reads web pages can be told what to do by the pages themselves. This is called prompt injection. Maya reads your site, your catalogue and what visitors type, so we treat all of it as material to read and never as orders.
- Anything Maya looks up during a chat (your knowledge, web pages, the catalogue, remembered facts) is wrapped in a marked untrusted-data block before the AI sees it, in text and in voice. The block tells the AI never to follow instructions found inside it.
- The text of the page the visitor is on is fenced the same way.
- Your own site is the source of facts such as prices and claims. Commands hidden inside it are ignored.
- Page translation treats page text as text to translate, never as instructions.
- Passwords, card numbers, one-time codes and API keys are never stored as remembered customer facts. That rule is enforced in code, not left to the AI.
What we tested. In a live text chat on a real customer site, in our test environment, we made six injection attempts. Maya would not reveal her instructions, the owner's private contacts or other visitors' data. She would not invent a 90% discount, would not claim a booking on the Connect plan, and would not reveal another business's data. The transcript held no owner email, no other lead's email and no part of her instructions.
What we store
| What | What is kept | What to know |
|---|---|---|
| Conversations | Text transcripts, word for word, saved while the chat happens. | A phone that closes the tab loses nothing. If a visitor types an email or phone number into the chat, it is in the transcript. Separately, Maya keeps a one-way hash of the first email or phone number in a chat, so an erasure request can find that chat even when no lead was created. |
| Leads | Name, email, phone, message and the page the visitor was on. | Saved only after Maya reads the details back and the visitor confirms them. The server makes that decision, not the AI. |
| Live voice | Text only. The audio is not stored. | Voice streams from the visitor's browser through our voice relay to Google Gemini, and only text comes back to be saved. We found no code that stores raw voice audio. |
| Voice messages | Text only. | A press-and-hold voice message (up to 10 MB) is sent to Gemini for transcription. The audio is held in memory during the request. |
| Phone calls (Reception) | Streamed, not recorded. | The call instructions contain a stream and no recording element. Phone needs a Telnyx account connected. |
| Returning-customer memory | Off by default. | When the owner switches it on, each remembered fact expires after at most 180 days, and a daily cleanup job enforces that. |
| Browser storage | The customer's website decides. | The default is necessary only. Without the website's "functional" consent the widget keeps nothing in persistent browser storage and sets no cookies. |
The microphone is used only through the browser's own permission prompt, when the visitor starts voice. If Maya takes the visitor to another page during a voice chat, she tries to reopen the microphone only when the browser has not denied it.
Export and erasure
The owner can download a full export of the account as a JSON file. Secrets such as tokens and credentials are left out. Viewers get a refusal and signed-out callers get a 401. Erasure works like this:
- Every Maya database table is listed in an erasure plan, and an automated test fails if a new table is missing from it.
- Deleting an account runs in 8 steps that resume after an interruption. Step one switches Maya off on the website, so there is no moment when deletion has been requested and the site still answers.
- Queued outgoing emails are wiped too. A deleted account once kept visitors' addresses in that queue; we found it in a live test on 2 Oct 2026 and fixed it.
- Billing and accounting records are kept after deletion, because EU tax and accounting rules require it. Lead rows stay as blanked placeholders with the name, email, phone and message removed.
- On our test database we seeded two accounts and erased one. All 12 checks passed: nothing of the erased account was left behind and the other account was untouched.
Keeping each business's data separate
- Row-level security. A read-only audit of our test database found every public table protected. Anonymous users have no table access, and signed-in users cannot touch any Maya table directly.
- A signed installation pass. The widget's business comes from a server-signed pass tied to the exact website and re-checked on every request. A workspace id typed into a request can never widen access.
- Re-checked access for the dashboard. A workspace named in a request is only a pointer. Every time, access is checked against ownership, an accepted team seat or an approved agency grant, and a verified email is required.
- Agency access to a client account is written to an audit log, and the request is refused if the log write fails.
- When we asked the owner's ChatGPT or Claude connection for another business's workspace, it was refused.
Who can do what
| Role | Can do | Cannot do |
|---|---|---|
| Owner | Everything: settings, team, billing, export and account deletion. | Nothing within their own account. |
| Editor | Change settings. | Manage the team or billing, or delete the account. |
| Viewer | Read. | Change settings, export, check out or delete. In our test each was refused with a 403. |
When our staff open a business account to help, that session cannot delete the account or export its data, and the access is logged.
Owner tools in ChatGPT and Claude
An owner can connect ChatGPT or Claude to their Maya account. It uses a standard sign-in and a consent screen that names the app and what it can do. Allow and Deny both work, and a login token copied from the browser is refused. The connection has five tools: an activity summary, new leads, open questions, answering a question and listing the owner's workspaces. Text that visitors wrote is shown to the owner's assistant marked as data, and a callback is sent only when the owner explicitly confirms it. Details are on getting found by AI.
We do not claim per-app limits on these connections. A connected assistant signs in as the user who approved it, and our database rules do not check which app a token was issued to.
Payments
Card details are entered in Paddle's own checkout. Paddle handles card payments as Merchant of Record, and Maya never handles card numbers. Paddle's payment notifications are checked with a signature and refused when they are more than 5 minutes old. Tokens for connected stores and CRMs are encrypted before they are saved.
Who processes data
These are the services our code calls, described by what each does for TryMaya. The legal terms are in the privacy policy and the data processing agreement.
| Service | Role |
|---|---|
| Supabase | The database and sign-in. |
| Vercel | Hosts the app (configured for the Frankfurt region). |
| Fly.io | Runs the voice relay (configured for the Paris region). The relay holds no database credentials, and a build check enforces that. |
| Google Gemini | Live voice, voice-message transcription, translation and embeddings, through the Gemini API. |
| OpenRouter | Routes typed-chat requests to language models from Anthropic and OpenAI. The same route builds knowledge and fact-checks it, using models from Anthropic, OpenAI and DeepSeek. Search ranking uses Cohere. |
| Resend | Sends email: owner lead emails, reports and visitor follow-ups. |
| Paddle | Billing, as Merchant of Record. |
| Upstash | Rate limits. |
| Crawl server (Crawl4AI) | Reads your site during a scan. It refuses private and internal network addresses, and checks every DNS answer. |
| LiveKit | Real-time voice rooms. |
| hCaptcha | Anti-spam checks. |
| Sentry | Error reports, when configured. Session replays mask all text and block media. |
| Axiom | Logs, when configured. |
| Telnyx | The phone line on the Reception plan. |
Limits against abuse
- Typed chat: 300 messages per 10 minutes per IP address and 200 per 10 minutes per visitor.
- Data export: 10 per hour. Account deletion: 3 per hour.
- Owner tools in ChatGPT or Claude: 120 calls per hour per user, and calls are denied if the limiter is down.
- Production refuses to start without the shared rate-limit store.
What this page does not claim
It makes no compliance or certification claim. It describes what the code does and what we tested, and the test runs it cites were on our test environment. A transcript holds what the visitor typed, so tell your visitors not to type anything they do not want kept.
Questions people ask
Can text hidden on my website make Maya misbehave?
It is the attack we test for. Text found on a page, in a lookup or in a catalogue is marked as untrusted data before the AI reads it, with the instruction never to follow commands inside it. In a live text chat on a real customer site in our test environment, Maya resisted all six injection attempts we made. No test proves a language model can never be fooled, so we also keep the rules that matter, such as saving a lead only after confirmation, in server code rather than in the prompt.
Does Maya record voice calls or live voice?
No raw audio is stored. Live voice goes through our relay to Gemini and only the text is saved. A press-and-hold voice message is sent to Gemini to be transcribed and held in memory for that request. On the Reception plan, phone calls are streamed and not recorded.
How do I get my data out, or have it erased?
The owner can download a full export as a JSON file, with secrets left out. Viewers and signed-out callers are refused. To erase, the owner deletes the account, which switches Maya off first and then works through the erasure plan. Billing records stay because EU tax law requires it.
Can one business see another business's data?
The database enforces row-level security, the widget's business comes from a signed installation pass that is re-checked on every request, and dashboard access is re-checked against ownership, team seat or agency grant each time.
Is every service you use listed?
The table above lists the services named here, by role. The legal terms are in the privacy policy and the data processing agreement. This page describes what the code does; it is not a certification and makes no compliance claim.
Where is my data processed?
The app is configured to run on Vercel in Frankfurt and the voice relay on Fly.io in Paris. That is not a promise that all processing stays in the EU: Gemini and the text models are called through their own APIs, and we have not restricted them to processing inside the EU.
The quickest check is to talk to her: Maya answers live on our homepage. See also how Maya sets herself up, integrations, getting found by AI, stopping invented answers, the glossary, the privacy policy and the data processing agreement.