Maya is operated by Lean Labs Pvt. Ltd. (“we”, “us”, “our”). This policy explains what information we collect when you use Maya on WhatsApp or our website, how we use it, and the choices you have. By messaging Maya or using tellmaya.live, you agree to this policy.
Information we collect
We collect information you provide directly and data generated by using the service:
- WhatsApp identity — your phone number and display name as provided by WhatsApp/Twilio.
- Messages — text you send Maya, including invoice requests, quotation instructions, client details, and other business queries.
- Voice notes — if you send audio, we transcribe it (via OpenAI Whisper) to process your request. Voice is available on Growth and Pro plans.
- Images — if you send photos (e.g. receipts, purchase orders), we may analyze them to extract details you ask for.
- Business profile — business name, type, GSTIN, address, state, bank details, UPI ID, invoice/quotation prefix, and your role in the business.
- Business data you create — clients, products and services catalog, invoices, quotations, line items, payments recorded, and associated notes.
- Team member data — phone numbers and roles of team members who join your business workspace via the business code.
- Payment information — subscription status and billing metadata from Razorpay. We do not store full card numbers; payment details are handled by Razorpay.
- Website usage — anonymous analytics on our marketing and checkout pages (via Vercel Analytics / PostHog), such as page views and referral source.
How we use your information
We use your data to operate Maya and improve the product:
- Read and respond to your WhatsApp messages using AI (OpenAI models).
- Create, store, and manage invoices, quotations, clients, and catalog items on your behalf.
- Generate GST-compliant PDF invoices and quotations and deliver them to your clients via WhatsApp.
- Store business context (clients, outstanding invoices, catalog, memory) so Maya can assist consistently over time.
- Send proactive reminders for invoice due dates, overdue payments, and quotation expiry.
- Enforce plan limits (Starter, Growth, Pro) and process subscriptions.
- Detect abuse, enforce rate limits, and keep the service reliable and secure.
- Measure aggregate product usage to improve features (not to sell your personal data).
Encryption and storage
Message content in our database is encrypted at rest with AES-256-GCM, using a data-encryption key unique to each business workspace. A leaked database backup would not reveal readable messages, invoice notes, or client communications without our master key, which is stored only in our server environment.
This is not end-to-end encryption. Maya must decrypt your messages on our servers to generate replies. WhatsApp’s own transport encryption still applies between your phone and Meta’s servers; our encryption protects data at rest in our systems.
Other fields (such as phone numbers, business names, client details, invoice amounts, and GSTIN) may be stored in plaintext where needed for search, billing, PDF generation, or business operations. When you delete a business workspace, its encryption key is discarded and encrypted message history becomes unrecoverable.
Generated invoice and quotation PDFs are stored in Supabase Storage with signed URLs. PDFs contain the business and client details you have provided, including GSTIN and bank details where applicable.
Who we share data with
We use trusted processors to run Maya. They access data only as needed to provide their service:
- Twilio — WhatsApp message delivery, webhook handling, and MMS PDF delivery to clients.
- OpenAI — language models, embeddings, and speech-to-text for voice notes.
- Supabase — hosted PostgreSQL database and file storage for PDFs and documents.
- Razorpay — subscription payments (India).
- Railway / Modal — application hosting and background workers (including PDF generation).
- PostHog / Vercel — product and site analytics.
Within a business workspace, invoices, clients, catalog, and related records are visible to all team members by design. Admin-only data (bank details, GSTIN, business settings) is role-gated so only business admins can update it.
We do not sell your personal or business information to advertisers or third parties.
Retention
We keep your data while your business account is active and as needed for legal, billing, or security purposes. Raw Twilio webhook payloads are retained for a limited period for debugging, then cleared. Invoice and quotation PDFs in Supabase Storage are retained as long as your business account is active. You can ask us to delete your business workspace; encrypted messages cannot be recovered after the workspace key is destroyed, but PDFs and plaintext business records may need to be separately requested for deletion.
Your choices and rights
Depending on where you live, you may have rights to access, correct, or delete personal data we hold about you. To exercise these rights:
- Stop using Maya by ceasing to message our WhatsApp number.
- Ask your business admin to remove you from the workspace, or request workspace deletion.
- Email us at leanlabsinnovations@gmail.com with the phone number associated with your account.
We will respond within a reasonable time. Some data may be retained where required by law or for dispute resolution, including invoice and financial records.
Financial and tax data
Maya handles business financial data including invoice amounts, GST calculations, client GSTINs, and bank account details you choose to share. This information is used solely to generate invoices and quotations on your behalf. We do not file GST returns or interact with any tax authority on your behalf. You are responsible for verifying the accuracy of invoices and tax calculations generated by Maya before sending them to clients or using them for compliance purposes.
Children
Maya is a business tool intended for adults operating businesses. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data without consent, contact us and we will delete it.
Security
We use signed webhooks, rate limiting, encrypted message storage, role-based access controls on business data, and access controls on production systems. No method of transmission or storage is 100% secure; please avoid sharing passwords, full bank credentials beyond what Maya needs for invoice generation, or government IDs not required for GST purposes.
International users
Maya is designed for Indian SMBs and is India-first in its pricing and GST support. Your data may be processed in the United States, India, or other regions where our providers operate. By using Maya, you consent to this transfer subject to applicable law.
Changes to this policy
We may update this policy from time to time. We will post the revised version on this page with an updated “Last updated” date. Continued use of Maya after changes constitutes acceptance of the updated policy.
Contact
Questions about privacy? Email leanlabsinnovations@gmail.com.
Lean Labs Pvt. Ltd.
Maya — WhatsApp AI for Indian businesses.