Glossary: "The product" means the MAIA product; "Chat Instance" means the AI Chat interface you created when using the product. "You”, “the admin" is the people who create a new chat instance and have the permission to config and customize the chat instance; "Your users" means the people who use the Chat instance, send messages, and use the chat features on your chat instance, this could be your teammate, your users, your community members, etc.

MAIA Shared & Dedicated Cloud

• When you create a new chat instance at https://web.maia.id, we gather certain information about you, which includes your email address, your name, and the name of your chat instance. This information is used to send you an email containing a link to your chat instance.

• All information collected is securely stored on our server. We never share your information with anyone else or any third-party service provider. If circumstances arise where we need to share your information with a third party (for instance, to link your billing information with your chat instance), we will always seek your explicit permission beforehand.

• We use lemonsqueezy.com and mayar.id for processing payments. We neither have access to nor store any of your credit card or payment data.

• The chat instance you create is utilized by your users/team/community. When your users log in to the chat instance, we collect their email address to verify their identity. This information is used to send them an email with a login link. We also collect their name, avatar, and other information, but only if they choose to provide it to us. We use this information to display their name and avatar on the chat instance.

• During the setup of your chat instance, we collect your OpenAI API key or other platform API key. These keys are utilized to connect to OpenAI/other API Provider to generate AI chat responses when your users use your AI chat instance. We never share your API keys with anyone else or any third-party services. Your API keys are encrypted, your users will not have access to see your API key, and keys are not used for any other purposes.

• When your users log in to your chat instance, we dispatch an email to them containing the login link. The email originates from "no-reply@mail.maia.id", with your name and email address displayed to the users as the "Reply-to" address. You can configure this sender email address by using your own SMTP credentials, this can be set up in the Admin panel. Note, only individuals explicitly added by you in the Admin Panel can log in.

• The chat history and messages of your users are transmitted through our server when they interact with your chat instance. Chat messages are stored on our server so we can sync the chat between multiple devices for your users. You can opt-in to view your users' chat messages in the Admin Panel, please make sure you have informed the users that the chat messages are recorded in your privacy policy. You can attach a privacy policy link in the Admin Panel (General Settings). Even if chat history and message logging are turned off, the messages must still pass through our server to prevent your API key from being exposed to the end users. We do not log sensitive information (API Key) or user personal information on any other logging system.

• Users on your chat instance are unable to view each other's data and chat history.

• We use cookies to remember user login state, preferences, and other relevant information. Only essential cookies are stored; no tracking and no analytics cookies are used.

• We permit the embedding of custom HTML/JS code via the Admin panel. This embedded code executes on all your users' browsers when they use the app. You are responsible for carefully checking the external code for malicious elements and potential privacy concerns.

MAIA Self-hosted

• Glossary: “The system” refers to services included in the self-hosted instance setup, for instance: the NodeJS server, the Postgres database, etc. Please consult the self-host instructions to learn about all the services required for setting up the MAIA Self-host system.

• When you sign up for the self-host setup, we collect your GitHub or Gitlab username. This username is utilized to grant you access to the private repository, which houses the self-host software.

• Your self-hosted instances of MAIA are deployed on your infrastructure. The system works entirely within your infrastructure environment and internal network. You have complete freedom to set up any supplemental security layers and configure the system as you see fit.

• The system never sends any user data outside of your infrastructure. All data is stored within the system’s database (Postgres).

• To ensure the system operates normally, it makes three types of external network requests: 

  • Requests to OpenA or other external LLM API if you use an external LLM for the chat model: this is fundamental for app functionality, allowing you to chat with AI. You can opt to use an internal private LLM API, in which case no external requests will be made to OpenAI/Anthropic; 

  • Requests to check for software updates: this notifies you when a new system upgrade is available for new features, improvements, and bug fixes. This request is sent to the MAIA's server and only contains minimal information needed for update checks: your current system version; 

  • Requests to check for licenses: this verifies the valid license of your self-host instance and ensures that you are using the correct number of users and instances as per your contract/subscribed plan. This request is sent to the MAIA's server and only contains minimal information needed to verify your license: your instance key, the user's unique identifier ID (this could be the user’s email or a unique random string, depending on the authentication system used), and your instance hostname.

• Absolutely no user data is sent out to any external services. This can be verified using various black-box testing methods like monitoring network requests from the app.

• Note, some features in the app, such as “Share Chat”, “Export to file”, “Share character”, “Share plugins”, etc., allow users to share or export data (including chat conversations) to external services. Control is beyond our reach if users choose to share/expose this data to external services on the internet.

• Some data from the Admin panel are hidden from the user, for instance: System Instruction, Training Data, AI Character Instructions, etc. Check the labels under each field in the Admin panel to understand what users can and can't see.

• The system uses cookies to store users' login states, preferences, and other pertinent information. We only store essential cookies; no tracking and no analytics cookies are used.

• The system allows you to embed custom HTML/JS code via the Admin panel. This embedded code executes on all your users' browsers when they use the app. You are responsible for meticulously checking the external code for any malicious elements and potential privacy issues.