This policy describes what data Maia ("the service", maiabio.link) collects, why, and what happens to it. It describes the software's actual behavior; where law requires more than we state here, the stricter obligation applies to us.
1. What we collect and why
| Data | Why |
|---|---|
| Email address | Account identity and transactional email only: welcome message, password resets, order and inquiry forwarding. No marketing without your consent. |
| Profile and content (username, display name, tagline, blocks, posts, products) | To publish your space — this content is public by design. |
| Password | Authentication. Stored only as a scrypt hash — never in readable form. |
| Custom domains you connect, plus Google Search Console verification strings | The custom-domain feature. |
| Page-view counts per space (day, path, referrer source) | Showing space owners how often their pages are visited. We store aggregate counters only — no IP addresses and no visitor identifiers are stored by Maia. |
| Cart cookie | A per-shop cookie remembering what is in a visitor's cart. Contains product slugs and quantities — no personal data. |
| Checkout / inquiry form entries (name, email, message) | Forwarded by email to the seller (or to us for custom-plan inquiries). Not stored in our database. |
2. Analytics cookies
Public pages load Google Analytics 4 so the operator can understand overall traffic. GA4 sets its own cookies on your browser under Google's privacy policy. We do not run advertising or cross-site tracking of any kind.
3. Third parties we rely on
To operate the service, data passes through or is processed by: our hosting provider (Hetzner, where the servers and database live), Cloudflare (DNS), Dokploy (deployment platform on the same server), our email provider (transactional email), Google (OAuth sign-in, Analytics, Search Console), GitHub (OAuth sign-in), and Let's Encrypt (HTTPS certificates). We do not sell data, and we do not share it with anyone else.
4. Retention and deletion
Your data lives while your account exists. Deleting your account (Admin → Settings) immediately and permanently removes your profile, pages, posts, products, domain connections, sessions, and analytics counters from our database. The deleted username may later be registered by another user. We keep no backups containing your data after deletion. Server-level request logs are kept by our infrastructure for short technical periods and are outside this policy's control.
5. Your rights
You can access and edit everything on your page from your dashboard at any time, and delete your account entirely (section 4). For anything else — an export of your data, corrections, or questions — contact us and we will help. If you are in the EU/EEA, you additionally have statutory rights (access, rectification, erasure, restriction, objection, portability, complaint to a supervisory authority); contact us first and we will do our best to resolve things directly.
6. Children
Maia is not directed at children under 13 (and under 16 in the EEA). If you believe a child has created an account, contact us and we will remove it.
7. Changes
If this policy changes materially, we will announce it on the service (and by email to account holders for significant changes) before it takes effect.
8. Contact
Privacy questions and requests: use the contact form.