Personal Data Processing Policy

Version of June 30, 2026

Data operator: JSC «Nastoyashchiy Iskusstvennyy Intellekt» (AO «Настоящий Искусственный Интеллект»), INN 5406842568, KPP 540601001, OGRN 1245400027982, address: 46 Deputatskaya St., room 1184, Novosibirsk, 630099, Russia. E-mail: hello@maia-ai.com. The MAIA service is available at maia-ai.com and in the cabinet at dashboard.maia-ai.com.

1. General provisions

This Personal Data Processing Policy (the "Policy") defines how AO «Настоящий Искусственный Интеллект» (the "Operator") processes personal data and the measures taken to keep it secure. It is published pursuant to Article 18.1(1)(2) of Russian Federal Law No. 152-FZ "On Personal Data" ("152-FZ").

The Policy applies to all information about data subjects that the Operator may obtain through the maia-ai.com website, the dashboard.maia-ai.com cabinet, other MAIA services, and in the course of performing contracts. The current version is always available at maia-ai.com/personal-data.html.

2. Key definitions

Personal data — any information relating to a directly or indirectly identified or identifiable natural person (data subject).
Processing — any action or set of actions performed with personal data (collection, recording, structuring, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, deletion, destruction).
Operator — the entity that organises and/or carries out the processing and determines its purposes and scope.
Subject — the natural person the personal data relates to.
Client — a legal entity or sole trader using the MAIA service to run voice and text AI agents.
Processor on instruction — a party processing personal data on the Operator's behalf under a contract (Art. 6(3) of 152-FZ).

3. Categories of data subjects

Visitors of maia-ai.com who submit a request or otherwise contact the Operator.
Cabinet users and Clients (including their authorised representatives and employees).
Representatives of the Operator's counterparties and partners.
Individuals the Client's AI agent interacts with by phone or in text channels. For such data the Operator acts as a processor on the Client's instruction; the Client is the operator of that data and is responsible for the legal basis and the required consents.

4. Categories of personal data processed

4.1. Website visitors

Name; phone number; e-mail address or messenger username; message text; technical data (IP address, browser type and version, interface language, cookie data and similar technologies).

4.2. Cabinet users and Clients

Name; e-mail address; phone number; account details; organisation details; service-usage and payment data (bank card details are not stored by the Operator — payments are handled by certified payment providers).

4.3. Data processed on the Client's instruction

Contact details of the Client's subscribers (name, phone number), call content and recordings, transcripts, and data extracted during the conversation. For this data the Operator acts as a party processing it on the Client's instruction (Art. 6(3) of 152-FZ); the Client is the operator of this data and ensures the legal bases and the required consents, including consents for special-category and biometric data (Arts. 10, 11 of 152-FZ) where its subscribers may disclose such data.

To provide the service the Operator, as a processor, may engage sub-processors (including providers of speech synthesis/recognition and language models), some located outside the Russian Federation, as provided by the Client's instruction (see Section 11).

Within the basic service (call recording and transcription) the Operator does not subject voice recordings to biometric identification and does not process them as biometric personal data within the meaning of Art. 11 of 152-FZ. If the Client uses voice cloning, the voice sample is processed on, and under the responsibility of, the Client. Conversation content and transcripts processed on the Client's instruction are not used by the Operator to train its own models or for any other own purposes without a separate instruction or consent.

The Operator does not process special categories of personal data for its own purposes and asks that such data not be submitted unnecessarily.

5. Purposes of processing

Contacting the subject about a submitted request, running a demo, preparing a proposal.
User registration and granting access to the service, identification and authentication in the cabinet.
Concluding and performing the contract (public offer) and providing the MAIA service.
Settlements, invoicing and payment, accounting and tax records.
Technical support, notifications about service changes and terms.
Ensuring the operability, security and quality of the service.
Informational and marketing communications — subject to separate consent.
Compliance with the legislation of the Russian Federation.

6. Legal bases for processing

The data subject's consent to the processing of their personal data.
A contract (including the public offer) to which the subject is a party or beneficiary.
Federal laws and other regulations of the Russian Federation, including 152-FZ, the Tax Code and the Accounting Law.
The Operator's legitimate rights and interests, where the subject's rights and freedoms are not violated.

Consent is given by the subject at the point of collection — when submitting a form on the site or registering in the cabinet — by an affirmative action (ticking a box) referencing this Policy. Informational and marketing communications are sent only with separate consent.

7. Processing principles

Processing is lawful and fair; limited to specific, predefined and legitimate purposes; the scope and content of data match the stated purposes and are not excessive; accuracy and relevance are maintained; data is stored no longer than the purposes require.

8. Procedure and conditions of processing

Processing is carried out with the subject's consent or on another lawful basis, by mixed means (with and without automation), with and without transfer over information and telecommunication networks. Actions performed: collection, recording, structuring, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion, destruction.

9. Data storage and localisation

Recording, structuring, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation (Art. 18(5) of 152-FZ). Localisation of the primary databases does not preclude engaging certain sub-processors outside the Russian Federation for specific processing operations (see Section 11).

Retention periods are set by the processing purposes: request/lead data — until the purpose is achieved or consent is withdrawn; account data — for the life of the account and a reasonable period after closure; accounting and payment documents — for the period set by law (generally 5 years); call recordings and transcripts — for the period set by the Client and the contract. Once the purposes are achieved or the period expires, data is destroyed or anonymised.

10. Transfer to third parties

The Operator does not sell personal data. Transfer to third parties occurs only: with the subject's consent; to perform a contract with the subject; to parties processing data on the Operator's behalf under confidentiality and security obligations; or upon a lawful request from authorised state bodies.

Such processors include, in particular: hosting and infrastructure providers; telephony and SIP providers; speech synthesis and recognition providers; language-model (AI) providers; content delivery network (CDN) providers; payment services; CRM and analytics systems. Some of these providers may be located outside the Russian Federation (see Section 11).

11. Cross-border transfer

When providing the service, certain processing operations (speech synthesis and recognition, language-model inference, static-asset delivery) may be performed by providers whose infrastructure is located outside the Russian Federation, including in the USA. Cross-border transfer of personal data — including conversation content and transcripts — may therefore occur.

Such transfer is carried out on the basis of the subject's consent and/or to perform a contract, subject to the requirements of Art. 12 of 152-FZ, including the required notification of the authorised data-protection body about the cross-border transfer. For personal data processed on the Client's instruction, the duty to determine the legal bases and to file such notification lies with the Client as the operator of that data.

12. Cookies and analytics

The site stores the interface language in the browser's localStorage and may use cookies and web-analytics systems to operate and improve the site. You can disable cookies in your browser settings; this may affect the availability of some features.

13. Security measures

The Operator takes the necessary legal, organisational and technical measures to protect personal data from unlawful access, destruction, alteration, blocking, copying, distribution and other unlawful actions (Arts. 18.1, 19 of 152-FZ), including: appointing a person responsible for organising processing; adopting internal policies; identifying security threats and assessing harm; access control; secure communication channels and encryption; backups; media accounting and control of the measures taken.

14. Rights of the data subject

The subject has the right to: obtain information about the processing of their personal data; require correction, blocking or destruction of data that is incomplete, inaccurate, unlawfully obtained or no longer needed for the stated purpose; withdraw consent; and appeal the Operator's acts or omissions to the authorised data-protection body (Roskomnadzor) or in court.

Requests should be sent to hello@maia-ai.com; the Operator reviews them and responds within the periods set by 152-FZ.

15. Withdrawal of consent

Consent to processing may be withdrawn at any time by sending a notice to hello@maia-ai.com. Upon withdrawal the Operator stops processing and destroys the personal data within no more than 30 days from the date the withdrawal is received, except where processing must continue under the law.

16. Changes to the Policy

The Operator may amend this Policy. A new version takes effect once published on the site unless the new version provides otherwise. The current version is always available at maia-ai.com/personal-data.html.

17. Responsible person and contact

The person responsible for organising the processing of personal data is appointed by the Operator's order (Art. 22.1 of 152-FZ). For any questions regarding the processing of personal data, to exercise your rights, or to reach the responsible person, write to hello@maia-ai.com with the subject line “Personal data”.

← Back to home