Privacy Policy

1. Data controller and contact

The data controller is TW MICRONICS SARL, headquartered in Yaoundé, P.O. Box 14674, Cameroon, registered in the Trade and Personal Property Credit Register (RCCM) under No. 95 F 0271 (Court of First Instance, Yaoundé-Centre Administratif).

For any question about your data, its deletion or the exercise of your rights, write to [email protected]. We answer every request within thirty days.

2. MAYA account data

MAYA is business management software for companies. When an organization opens an account, we process the following data, regardless of any connection to a Google service:

• User identity: name, e-mail address, password (stored only as a bcrypt hash), and the second-factor authentication secret when enabled.
• Organization: legal entities, user roles and permissions, application settings.
• Business data entered by the organization itself: contacts, quotes, invoices, documents, conversations with its customers. MAYA processes them on behalf of the organization, in a database dedicated to that organization.
• Technical logs: audit log of sensitive actions, scheduled-task log, IP address and timestamp of logins.
• One session cookie (httpOnly, secure), required for the service to work. MAYA sets no advertising cookie and no third-party analytics tracker.

3. Signing in with Google

A user can sign in to MAYA with their Google account instead of their password. MAYA then asks Google only for the openid, email and profile permissions: the person's Google identifier, their email address (and whether Google has verified it) and their name.

This information is used to find the active MAYA account that carries the same address. MAYA keeps the Google identifier and the address, linked to that account, for later sign-ins. No Google token is kept and MAYA accesses no other data of the Google account. An address Google has not verified is refused. Signing in does not create an account: if one already exists, the person signs in and then links Google. An account required to use a second factor still passes it, as after a password.

On the clients instance only, the same permission can open a new trial house. The person gives the house name, its sector, a phone number and a country, and accepts the terms and the privacy policy. The country determines the currency and the accounting referential. The person becomes the administrator of that house, and of no other. A second trial with the same address is refused. Joining a house that already exists remains an invitation from its administrator.

4. Data received from Google APIs

An organization can connect its YouTube channel to MAYA from the Social Networks screen. The connection uses Google OAuth: the administrator explicitly authorizes MAYA on a Google consent screen and can withdraw that authorization at any time (see section 7). MAYA requests exactly three permissions, described below. No other Google data (Gmail, Drive, Calendar, Sheets, contacts) is requested or accessible.

4a. Google Calendar, Google Chat and Google Tasks (the organization's own connections)

Three MAYA features use additional Google permissions: creating Google Meet meetings, the internal Google Chat messaging and task synchronization with Google Tasks. They do not go through the YouTube application described in section 4. These permissions are requested with the organization's own Google Cloud project, whose client ID the organization enters in MAYA. Nothing is requested until the organization has configured these connections.

Google Meet meetings: an appointments administrator of the organization connects the Google calendar that organizes the meetings. MAYA creates, updates and cancels in that calendar the events of meetings scheduled from MAYA, with their Google Meet link. Google sends the invitations to the participants. MAYA sends Google the meeting's title, agenda, time and time zone, along with each participant's email address and name.

Google Chat messaging: each person in the organization connects their own Google account, and MAYA never acts on behalf of another person. In addition to the two permissions described below, this connection requests the openid, profile and email identity permissions. They are used to know which account is connected: Google ID, email address, name and domain.

Google Tasks synchronization: it is off by default; the organization turns it on, then each person who wishes connects their own Google account and chooses one task list. MAYA never acts on behalf of another person and creates no list. Between that person's MAYA tasks and that list, MAYA reads and writes the title, the status (to do or completed) and the due date, in both directions; a task added to the list becomes a MAYA task of that person.

• Artificial intelligence: Google Calendar, Google Chat and Google Tasks content is not sent to any artificial intelligence service, OpenAI included. It is used neither for advertising nor to train a model.
• Tokens: the tokens of these connections are encrypted (AES-256-GCM). The calendar access token is kept in memory only, for the duration of the call.
• Meeting retention: meetings are kept in the organization's workspace as long as it uses MAYA. A meeting cancelled from MAYA is also cancelled in Google Calendar.
• Message retention: a copy of each Google Chat message read is kept for at most 30 days. An expired message is no longer displayed and is deleted at the next synchronization. If the person links a message to a MAYA record, only its reference is kept on the record, without its text.
• Disconnecting Google Chat: disconnecting in MAYA immediately deletes the person's tokens and all copies of their messages. Only a record of the connection (account, dates) is kept for audit purposes.
• Google Tasks: for each synchronized task, MAYA keeps the Google ID of the task and of the list, its version (etag) and a preview of the title, status and due date on both sides, as long as the organization uses MAYA; conflicts and failures are logged without any secret. Disconnecting in MAYA stops the synchronization and immediately deletes the tokens; MAYA tasks and their mappings remain, with no further call to Google, and nothing is deleted in the Google list.
• Deactivating the calendar: deactivating the calendar connection in MAYA stops every call to Google. The connection is not deleted, because past meetings refer to it, and its encrypted token remains attached to it.
• Revoking at Google: MAYA does not itself revoke these permissions with Google. Each person can withdraw them at any time from https://myaccount.google.com/permissions. The application appears there under the name the organization gave its Google Cloud project. To request the deletion of your data, write to [email protected].

4b. The organisation's Gmail mailbox (Gmail connector)

An administrator of the organisation can connect a Gmail or Google Workspace mailbox, for the whole organisation or for one of its entities. The organisation's emails (quotes, invoices, replies to customers) are then sent from that mailbox through the Gmail API, with no app password. An entity with its own Microsoft 365 mailbox keeps it. Nothing is requested until an administrator connects a mailbox.

In addition to the permission described below, this connection requests the openid and email identity permissions. They tell which mailbox is connected: the address verified by Google and the Google account identifier. MAYA requests no read access to the mailbox: it does not read, modify or delete any message in it.

• Tokens: the refresh token is encrypted in the database (AES-256). The access token is kept in memory only, for one hour at most.
• Disconnection: disconnecting the mailbox in MAYA revokes access at Google, then immediately erases the token. Only a record of the connection (address, dates, revocation result) is kept for audit.
• Revocation at Google: access can also be withdrawn at any time from https://myaccount.google.com/permissions. Emails then go through the platform's sending service again. To request deletion of your data, write to [email protected].

4b. Data received from Meta platforms (WhatsApp, Facebook, Instagram, Messenger)

An organization can connect its WhatsApp Business number, its Facebook Pages and the Instagram professional accounts linked to those Pages to MAYA. These connections go through the Meta app "MAYA", published by TW MICRONICS SARL: an administrator of the organization explicitly authorizes MAYA on a Meta screen, and can withdraw that authorization at any time. MAYA receives nothing from Meta until an account is connected.

This data is used solely to provide the organization with the features it uses: receiving and answering its customers' messages, publishing on its Pages and accounts, and reading and answering the comments it receives. It is not sold, rented, used for advertising or advertising profiling, or passed to any data broker. MAYA processes it on behalf of the organization, in the database dedicated to that organization. Its use complies with the Meta Platform Terms and the Meta Developer Policies.

• WhatsApp: messages received and sent by the connected number (text, images, documents, voice notes), the sender's phone number, the WhatsApp profile name they chose, and the date of each message. For the organization's number: its Meta identifier, the identifier of its WhatsApp Business account and the displayed number.
• Messenger and Instagram messages: the identifier Meta assigns to the person for the Page or account concerned, their display name, and the messages exchanged with that Page or account.
• Connected Facebook Pages and Instagram accounts: identifier, name, username, category, profile picture, follower count, and the link between an Instagram account and its Page.
• Posts: the content the organization publishes from MAYA and the identifier Meta assigns to each post, to track its status and reach.
• Comments: comments received under the posts of connected Pages and accounts, with the public identity of their authors (identifier, display name), MAYA's analysis of them (sentiment, intent) and the reply published, if any.
• Access tokens: the token of each connected Page, account and number is encrypted at rest (AES-256-GCM) with a dedicated key, separate from the session key. It is never displayed, nor passed to anyone other than Meta.
• Artificial intelligence: when MAYA's assistant prepares or sends a reply to a WhatsApp, Messenger or Instagram message, or analyzes a comment, the content concerned (the text, its author's display name and the earlier exchanges needed for the reply) is sent to OpenAI (gpt-5-nano model) through its API. Voice notes received are transcribed by OpenAI (whisper-1), which also produces voice-note replies (tts-1). Google (Gemini) receives this content only as a fallback, rarely, when OpenAI does not respond. These providers act as processors; under their API terms, the data sent is not used to train their models. MAYA does not use any data received from Meta to train a model.
• Sharing: this data is passed only to Meta (the messages, posts and replies the organization decides to send), to the artificial intelligence processors listed above, and to Hostinger International Ltd., which hosts MAYA's servers in the Netherlands. The full list is on the subprocessors page.
• Retention: comments are deleted 24 months after collection. A Page or Instagram account whose authorization has been revoked or whose token has become invalid is deleted, with its tokens, comments and image, 12 months after deactivation (section 7). WhatsApp, Messenger and Instagram messages: deleted 24 months after they are received or sent. Deactivated WhatsApp number: its token is deleted no later than 30 days after deactivation.
• Revocation: an administrator removes a Page or Instagram account from MAYA's Social networks screen, which deletes the data MAYA holds about it. They deactivate a WhatsApp number from the Conversation channels screen, which immediately stops all receiving and sending. Neither action revokes the authorization at Meta: remove the MAYA app from Facebook (Settings & privacy > Settings > Business integrations, or Apps and websites) and, for WhatsApp, from the WhatsApp Manager of your Meta Business account. Once revoked, MAYA can no longer read or publish anything.
• Deletion: anyone can request the deletion of the data about them that MAYA received from Meta. From Facebook, by removing the MAYA app and choosing "Send deletion request": Meta forwards the request to us, and you receive a confirmation code with a tracking link. Or by email to [email protected], giving your account name (or your WhatsApp number) and the business you wrote to. The full procedure is on the page https://maya-erp.com/data-deletion. The data concerned is deleted within 30 days of the request.
• Your rights: you can request access to your data, its correction, deletion or portability, and object to its processing, by writing to [email protected]. We answer within thirty days. If you wrote to a business that uses MAYA, that business decides on its exchanges with you and TW MICRONICS SARL acts on its behalf: we may forward your request to it.

5. What is stored

For each connected YouTube account, MAYA stores in the organization's database:

• the channel ID and name, its image, its profile URL, and its subscriber, view and video counts;
• the OAuth tokens (access token and refresh token), encrypted at rest with AES-256-GCM using a dedicated key, separate from the session key;
• the comments read under the channel's videos, with the public identity of their authors, together with MAYA's analysis of them (sentiment, intent) and the reply published, if any;
• the IDs of the videos published by MAYA.

6. Sharing with third parties

To draft a reply to a comment and analyze its sentiment and intent, MAYA sends to OpenAI (gpt-5-nano model): the text of the comment, the public name of its author, the title and an excerpt of the description of the video concerned, and the history of comments by the same author on our channels. OpenAI acts as a processor, through its API; under the terms of that API, the data sent is not used to train its models.

Hostinger International Ltd. hosts MAYA's servers and acts as a hosting processor: all the data described in this policy resides on those servers.

Google LLC receives what MAYA publishes on YouTube on behalf of the organization: videos, replies to comments, moderation actions.

When an organization connects other networks (Meta for Facebook and Instagram, TikTok, LinkedIn, X), the posts and replies it chooses to send there are transmitted to those platforms. No data received from Google is transmitted to those platforms.

MAYA does not sell any data, does not share any data for advertising purposes, and does not use any data received from Google APIs to train an artificial-intelligence model.

7. Retention and purge

The retention periods below are enforced by an automated task that runs every night; they do not depend on manual intervention.

• Comments read on connected networks, YouTube included: deleted 24 months after collection.
• A social account whose authorization has been revoked or whose token has become invalid: deleted, with its tokens, comments and image, 12 months after deactivation.
• An active social account: kept as long as the organization keeps it connected; deleted immediately when an administrator removes it (section 7).
• MAYA account data: kept as long as the organization holds an account, then deleted upon written request to [email protected].

8. Data deletion and revoking Google access

An administrator of the organization removes a YouTube account from MAYA's Social Networks screen. This immediately revokes the authorization with Google, deletes the comments read on that account, its image and its tokens, and then the account itself. If Google cannot be reached at that moment, the local deletion is still performed and the failure is logged; the authorization can then be revoked from your Google account.

You can review and revoke the access granted to MAYA at any time from your Google account: https://myaccount.google.com/permissions. As soon as access is revoked, MAYA can no longer read or publish anything; the account is deactivated at the next check and deleted as described in section 6.

For the other networks (Meta, TikTok, LinkedIn, X), removing an account deletes the data MAYA holds but does not revoke the authorization on the platform side: do so from the security settings of the platform concerned.

If you authored a comment under a video of an organization using MAYA and want that comment and your public identity removed from our systems, write to [email protected], naming the channel and the video concerned.

Manage the permissions of my Google account

9. Security

At rest: the OAuth tokens of social accounts and the application secrets are encrypted with AES-256-GCM using a dedicated key. Passwords are stored only as hashes. Each organization has its own database, physically separated from those of other organizations.

In transit: all communications between your browser and MAYA, and between MAYA and the APIs of Google, OpenAI and the other platforms, are encrypted with TLS.

Access to data is restricted by roles and permissions, and sensitive actions are recorded in an audit log.

10. Google API Services User Data Policy

MAYA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: data received from Google APIs is used only to provide and improve the user-facing features described in section 3; it is not transferred to third parties except in the cases listed in section 5 (processors necessary to the service, with the user's consent, or for security or legal reasons); it is not used for advertising, creditworthiness assessment, or the training of generalized artificial-intelligence models; and no human reads it except with your explicit consent, for security reasons, to comply with the law, or in aggregated form.

Read the Google API Services User Data Policy