← Back to MAUDI

Privacy notice

MAUDI Privacy Notice Effective date: September 28, 2026

1. What this notice covers

This notice explains what information passes through MAUDI, what we use it for, who we share it with, and what you can ask us for.

We wrote it in plain words on purpose.

Responsible for the information: Zomau LLC, a Texas company ("Zomau"). Address: 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States. Privacy email: hola@zomau.com.

2. What information we collect

a) The messages that come into your business. Emails, web form submissions, text messages (SMS), WhatsApp messages, Instagram direct messages, voice notes (the audio and its transcript), the recordings and transcripts of voicemails, the text of what was said on the calls the voice receptionist handles (those calls are not recorded), and reviews you paste in by hand. Along with them come the sender's contact details: name, phone number, email address or Instagram username, and whatever that person chose to say in their message.

b) Your details as a MAUDI customer. Business name, contact name, email, phone, business address, and your subscription information.

c) Technical usage data. Records of when what was sent, who approved which message, and system errors. These keep the service working and let us check what happened if something goes wrong.

d) Your phone alerts. If you turn on alerts on your phone, we store the delivery address your browser gives us (an alert "subscription") so we can alert you when someone writes. If no phone has alerts on, we text the cell number you registered as the owner, provided your business number can send texts; otherwise we email your owner address.

We do not collect your card number. Payment is processed by a payment provider; we do not store the full number.

3. What we use it for

  • To classify the messages you receive and understand what they are about.
  • To draft a reply for you to review and approve.
  • To send the message you approved.
  • To transcribe voice notes and voicemails and understand them as text.
  • To send routine replies instantly if you turn on the "MAUDI answers on its own" mode and, only with that mode on, the "got it" acknowledgement when something awaits your approval.
  • To send the appointment reminder, which is a fixed template.
  • For the one-tap survey after an appointment: to email it if you turn it on, and to keep the rating and comment your customers leave (they are for you and are not published).
  • To ask for the Google review the day after the appointment, if you keep it on: a fixed note by WhatsApp or email, once per person.
  • To alert your phone (an app notification, a text to your cell or an email) when someone writes.
  • To show you your history and reports.
  • To bill your subscription and give you support.

Nothing else. We do not sell your information. We do not sell your customers' information. We do not use it for advertising.

4. Who we share it with, and why

MAUDI runs on these services. Each one receives only what it needs:

CompanyWhat forWhat it receives
Anthropic (Claude models)Classify the message and draft the reply; write the Redes postsThe text of the message, after it passes the sensitive-number filter; if you use Redes, the photo you upload to post
SupabaseThe database where everything is stored (Postgres, hosted in the United States)Messages, contacts, history, your account; the photos people send you (30 days, in private storage)
ResendSending the emails that go out from your businessThe approved email and the recipient's address
VercelThe servers MAUDI runs onData passes through; nothing is stored there
SentryAlerting us to technical errors in the systemThe error notice and the page where it happened; request data (text, cookies, parameters) is stripped before it leaves
StripeBilling your subscription (and, if you use Get paid, your customers' payments in your own Stripe account)Your name, email and payment; we never see your card
Cloudflare and a Google mailboxReceiving the email that arrives at your business address and handing it to MAUDI; a copy stays in a zomau Google mailbox in case MAUDI is downThe full email: sender, subject, text and attachments
Google (Gemini, the dashboard voice and Google Maps)Transcribing WhatsApp and Instagram voice notes; the dashboard voice assistant; drawing the Redes images; the Google Maps listings (the reviews on your website)The audio of the note (transcribed, then discarded); text that already passed the filter for the voice and the images; your Google listing ID
TwilioSending and receiving text messages, handling calls, recording and transcribing voicemails, and texting you the alertThe message and the phone number; the voicemail recording and its transcript
Meta (WhatsApp and Instagram APIs)Sending and receiving WhatsApp messages and Instagram direct messagesThe message and the WhatsApp number or Instagram account
Your phone's notification service (Apple, Google or Mozilla, depending on your browser)Delivering the alert when someone writesThe title and short text of the alert (who wrote and where)

We also share information if a law or a valid court order requires it.

Mobile phone numbers. Mobile numbers collected to send text messages, and the consent to receive them, are not shared with third parties or affiliates for marketing or promotional purposes, and are not sold. Only Twilio receives them, and only to deliver the message.

4A. Text messages (SMS)

When a customer of your business leaves their mobile number and checks the consent box while booking an appointment on the business's public booking page (the box is unchecked by default), or texts the business's number first, or asks the voice receptionist for the booking link during a call and agrees to get it by text (a single message with that link, to the number they are calling from), MAUDI may send them text messages about their appointment or inquiry: reminders, the link to pick a day and time, and replies you approved.

  • Message frequency varies: it depends on their appointments and inquiries; these are not recurring or promotional messages.
  • To stop receiving them: reply STOP to any message. For help, reply HELP, or email hola@zomau.com.
  • Message and data rates may apply according to the carrier plan.
  • If the customer does not check the box and has not texted first, no text is sent: the reminder goes by email, if one was provided.

5. The AI is NOT trained on your data

The text of your messages is sent to the Anthropic API to be classified and to draft a reply.

Anthropic does not train its models on data sent through the API. Your information does not become training material for any model, ours or theirs.

WhatsApp and Instagram voice notes are transcribed with Google's paid API (Gemini), whose terms for paid customers state that what is sent is not used to train its models. The audio is sent only to be transcribed and is not stored on our side (section 7). Voicemails are recorded and transcribed by Twilio, the same service that handles the call.

6. The filter that hides sensitive numbers

Before any text goes out to the AI, it passes through a filter of ours that looks for and covers sensitive numbers. It runs on everything that arrives in writing (email, text, WhatsApp, web form, documents) and also on what a caller says, while the call is happening. What we store and what you see in your dashboard stays complete: it is your customer writing to you. What we protect is what travels. This is what gets covered:

  • Social Security numbers and ITINs
  • Credit card numbers (validated)
  • Bank account and routing numbers
  • Driver's license numbers

When it finds one, it replaces it with [NÚMERO OCULTO] (hidden number). The AI model never sees the original number.

The filter works in two layers: fixed patterns that look for known shapes of those numbers, plus an additional review by a small model.

We will be straight with you: no filter catches 100%. A number written in an unusual way can slip through. That is why the Terms ask you not to use these channels to request financial data.

7. Attachments: what is read and what is kept

When someone sends a PDF or a photo, MAUDI pulls out the text on our own servers, hides sensitive numbers, and only that filtered text goes to the AI. The AI never receives the file or the photo.

  • PDFs: read and discarded. The file is not stored.
  • Photos: kept for 30 days so you can see them in your dashboard (for example, to quote a job) and then deleted automatically. They are stored without the camera's hidden data (such as location), in private storage that only your business can see (and Zomau support staff when they open your dashboard to help you, see section 8; it is recorded in your log). They are not used for anything else.
  • We recommend asking your clients not to send photos of IDs or account numbers through these channels: if they arrive, they are kept like any photo.

The same goes for voice notes: the audio is transcribed and discarded; what stays in your history is the text of the transcript.

8. Where it is stored and who can see it

Data is stored in Supabase, a Postgres database hosted in the United States.

Each business is isolated from the others by its own identifier. One business never sees another business's data. That separation is enforced in the database, not just on the screen.

On the Zomau side, only the staff who need access to provide support or fix a failure have it, and only for as long as that work lasts. That includes being able to see your dashboard just as you see it — which is what makes it possible to help you over the phone without ever asking for your password. That access is used only for a support or service-operation reason, never to browse.

9. How long we keep the information

  • Messages and conversation history: for as long as your account is active.
  • Account and billing data: for as long as you are a customer, and afterward for as long as U.S. tax rules require.
  • Photos people send you: 30 days, then deleted automatically (see section 7).
  • PDFs and voice-note audio: not stored (see section 7).
  • Voicemail recordings: kept at Twilio while your account is active; the transcript, in your history.
  • Phone alert subscriptions: until you remove them in Settings (SYSTEM in the classic dashboard) or the phone stops receiving them.
  • The "do not contact" list: kept indefinitely, on purpose. It is the only way to guarantee that person is never written to again.

If you cancel, we delete your data within 60 days after cancellation, except what we must keep by law and the "do not contact" list.

10. Your rights

You, and any person whose data has passed through MAUDI, can ask us for:

  • Access: to be told what information we hold.
  • Correction: to have wrong information fixed.
  • Deletion: to have information erased, except what the law requires us to keep.
  • A copy: to receive your data in a readable file.

And the most important one for anyone who receives messages:

  • "Do not contact me again." Anyone can ask for this, at any time, through the same channel the message came from, or by writing to hola@zomau.com. That person is blocked in the database and the system refuses to send to them, even if the business owner approves the message. There is no way around it.

To exercise any of these rights, write to hola@zomau.com. We respond within 30 days.

11. Security

We take reasonable measures: information travels encrypted, access is restricted per account, each business is isolated, and we keep a record of who approved what.

We do not promise absolute security. No honest provider does. No system connected to the internet is unbreakable.

If there were ever improper access to your information, we will tell you without delay, what happened, and what we are doing about it.

12. MAUDI is not for health information

MAUDI is not offered to clinics, medical offices, dentists, therapists, labs, or any business that handles patient health information.

The reason: that information is protected by HIPAA, the federal health law, and HIPAA requires a chain of signed agreements with every technology vendor involved. That chain is not in place for MAUDI.

We also do not offer MAUDI to debt collection.

Please do not send anyone's medical information through MAUDI.

13. Minors

MAUDI is a business tool for adults. It is not directed at anyone under 18, and we do not knowingly collect information from minors.

If we discover that we received a minor's information when we should not have, we delete it.

14. Changes to this notice

If we change this notice, we publish the new version with its date. If the change is significant, we notify you by email.

14A. The agreement you can sign

If your company needs a written confidentiality and data processing agreement — with the list of providers, deletion timelines, and 72-hour breach notice — it is published at https://maudi.ai/confidencialidad and applies from the day you signed up. If you need it signed, ask at hola@zomau.com.

15. Who to write to

For any question, complaint, or request about your information:

Email: hola@zomau.com Phone: email only, for now Address: 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States

Write to us. A person will answer.