Privacy policy

Mayapro is a service of 25BRAINS LLC, a New Jersey limited liability company doing business as Mayapro (“we”, “us”). We provide an AI phone assistant that answers calls, answers questions about a business's services, and books appointments on its behalf.

This policy covers two groups of people, and it is worth separating them because we hold very different things about each. Client businesses are the practices that buy the service and sign in to our console. Callers are the people who phone those businesses and reach an assistant we operate. If you are a caller and want your information removed, the business you called controls it — contact them, or write to us at hello@mayapro.ai and we will route your request to them and act on it.

From callers. When someone reaches an assistant we operate for a client business, we process the audio of that call, a transcript of it, the caller's phone number, and whatever they provide in order to be helped — typically a name, a contact email, and what service they are asking about. If an appointment is booked, that appointment and the details attached to it are stored for the business.

From client businesses. Account information: name, work email, a password (stored only as a bcrypt hash, never in a form we can read) or a Google sign-in, timezone, the practice's public phone, contact email and website, the staff and services entered into the calendar, and a log of administrative actions taken in the console. If you subscribe, Stripe collects and holds your payment details — we never see or store a card number.

From a business's website. Before an assistant takes its first call, we fetch the public pages of the website that business gave us, so the assistant knows its services, hours and prices. We identify ourselves as MayaproBot, we respect robots.txt, and we never sign in, submit forms, or reach anything behind a login.

We do not run advertising trackers, third-party analytics, or third-party cookies on this website. We do count page visits ourselves, on our own servers: which page was opened, when, and the site that linked to it. That count is tied to a random number held in your browser tab for as long as the tab is open, so we can tell one visit from two — it is not a cookie, it does not follow you to another site, and it is gone when you close the tab. The console sets one cookie, which is the session that keeps you signed in.

Call data is used to answer the call, book or change the appointment, notify the business, and let that business review what was said. Account data is used to operate the console, bill the subscription, and send service email — a summary after each call, and notifications about the account.

We may use de-identified information to measure and improve assistant quality. De-identified means the caller's name, number, and any other identifying detail have been removed. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not permit our subprocessors to train their own general-purpose models on your call data.

Calls handled by a Mayapro assistant are recorded and transcribed, and the recording is available to the client business in its console.

Recording and monitoring consent is set by law where the caller is located, and a number of US states require every party to a call to consent. Laws in some jurisdictions also require that callers be told they are speaking to an automated or AI assistant. The client business decides what its line discloses and is responsible for meeting those requirements — this is stated in the Service Agreement each business signs. We will configure disclosure and consent messaging into an assistant on request, but we are not in a position to determine what any individual business is legally required to say.

If you are a caller who does not wish to be recorded, say so and ask for a person; the assistant is built to hand off.

Mayapro is not intended for the collection of protected health information. We do not act as a HIPAA business associate and we do not offer a Business Associate Agreement at this time. This is the same position as Section 6 of our Service Agreement.

Assistants working for aesthetic and medical practices will nonetheless sometimes hear health-adjacent detail, because callers volunteer it. We treat that data with the controls described below — access is scoped to the single practice the data belongs to, recordings and transcripts are treated as confidential, and every administrative action in the console is written to an audit log — but those are security measures, not a compliance certification, and we will not describe them as one.

If your obligations require a signed BAA, Mayapro is not the right fit today. Write to us at hello@mayapro.ai before subscribing and we will tell you plainly where we stand rather than sell you a maybe.

We do not sell personal information. We share it with the providers needed to run the service, each bound to use it only to provide that service to us:

• Amazon Web Services — hosting, database, and the sending of service email. United States.
• Vapi — the voice platform that carries the call, issues your assistant's phone number, and stores the recording and transcript.
• OpenAI — the language model that conducts the conversation, accessed through Vapi.
• Deepgram — speech-to-text transcription, accessed through Vapi.
• ElevenLabs — the synthesised voice the caller hears, accessed through Vapi.
• Anthropic — summarising a client business's public website into its assistant's knowledge base. Caller data is never sent here.
• Stripe — subscription payments. Stripe holds card details; we do not.
• Google — optional sign-in for the console. If you use it, Google tells us your email address and name; we store those and nothing else, and we never gain access to your Google account.
• Netlify — hosting for this marketing website.

We will also disclose information where the law requires it, and to a successor if the business is sold — in which case this policy travels with the data.

Recordings, transcripts, appointments and account data are retained for as long as the client business maintains an account, because that history is the record the business uses to run its front desk.

A client business may ask us to delete its data at any time, and we will do so within 30 days of a written request to hello@mayapro.ai. We do the same within 30 days of an account closing. Deletion is carried out by us on request rather than by an automatic schedule, and we would rather say that plainly than advertise a retention limit we do not currently enforce in software. Limited records may survive where the law requires us to keep them — billing records, for example — and backups are overwritten on their own cycle.

Data is encrypted in transit. Console access is scoped per practice, so one business cannot see another's calls, patients or calendar. Passwords are stored only as bcrypt hashes. Administrative actions are written to an audit log. Payment card details never touch our systems.

No service can promise perfect security, and we will not pretend otherwise. If a breach affects your data we will tell you, and we will tell you what we know rather than wait until the picture is complete.

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to have it corrected, and to have it deleted. To exercise any of these, write to hello@mayapro.ai. We will verify the request — usually by confirming you control the email address or phone number concerned — and respond within 45 days. Exercising these rights costs nothing and we will not treat you differently for it.

If you are a caller, the business you rang is the one that decides how your information is used; we hold it on their behalf. Send the request to us anyway if that is easier and we will pass it on and act on it.

Under the California Consumer Privacy Act, as amended by the CPRA, California residents have the rights described above: to know, to access, to correct, to delete, and to be free from discrimination for asking. You may use an authorised agent.

The categories we collect are set out in “What we collect”: identifiers (name, email, phone number), commercial information (appointments and subscription records), internet activity limited to what is needed to operate the console, and audio recordings and their transcripts. We collect these for the business purposes set out in “How we use it”, from you directly and from the client business whose line you called.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA — and we have not in the preceding twelve months. There is therefore no “Do Not Sell or Share My Personal Information” link, because there is nothing for it to switch off. We do not knowingly collect information from anyone under 16.

We may update this policy. The date at the top always reflects the current version, and we will give client businesses notice of any material change before it takes effect.

Questions about this policy, or any request under it, go to hello@mayapro.ai, and a person will answer.

25BRAINS LLC, d/b/a Mayapro
New Jersey, United States