Privacy Policy

1. Data Fiduciary

Maple Mind ("Company," "we," "us") is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) responsible for processing your personal data. We are committed to protecting your privacy and ensuring compliance with applicable data protection laws including the DPDP Act 2023 (India) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA, United States).

2. Information We Collect

We collect data that you provide directly and data generated through your use of our Service:

• Account Data: Name, email address, phone number, business name, business address
• Business Data: Property listings, client records, lead information, work orders, maintenance requests
• Voice Data: AI call recordings, transcripts, caller information (with disclosure to callers)
• Payment Data: Invoices, payment history, billing address (processed via Wise Business)
• Usage Data: Feature usage, login times, call volumes, API requests
• Device Data: Browser type, IP address, operating system (collected automatically)

3. How We Use Your Data

We process personal data for the following purposes with lawful basis:

• Providing and operating the Service (contract performance)
• AI voice call handling and lead qualification (contract performance)
• Sending invoices and processing payments (contract performance)
• Service notifications, usage alerts, and system updates (legitimate interest)
• Improving AI accuracy and service quality (legitimate interest, with anonymization)
• Complying with legal and regulatory obligations (legal obligation)

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

4. Data Sharing

We share data only with:

• Voice AI Provider (Omnidim): Call routing and AI processing, under data processing agreement
• Payment Processor (Wise Business): Invoice generation and payment collection
• Cloud Infrastructure: Hosting and data storage, with data encryption at rest and in transit
• Legal Authorities: When required by law, court order, or to protect our legal rights

5. Data Retention

We retain your data for the duration of your subscription and 30 days after account cancellation to allow data export. After the 30-day retention period, all personal and business data is permanently and irreversibly deleted from all systems, including backups. Call recordings are retained for 90 days unless you request earlier deletion. Payment records are retained for 7 years as required by tax law.

6. Data Security

We implement industry-standard security measures including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Key-only SSH access to infrastructure (no password authentication)
• Role-based access controls with principle of least privilege
• Regular security audits and vulnerability assessments
• Database access restricted to internal services only (no public exposure)

7. Your Rights Under DPDP Act 2023

As a Data Principal under the DPDP Act 2023, you have the right to:

• Access: Request confirmation and a summary of your personal data being processed
• Correction: Request correction of inaccurate or misleading personal data
• Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Withdraw Consent: Withdraw consent for data processing at any time, with the understanding that this may affect service availability
• Grievance: File a grievance with our Grievance Officer (see Section 13)
• Nomination: Nominate another individual to exercise your data rights in case of death or incapacity

8. Your Rights Under CCPA/CPRA (California)

If you are a California resident, you additionally have the right to:

• Know: What personal information is collected, used, shared, or sold
• Delete: Request deletion of personal information
• Opt-Out: Opt out of the sale or sharing of personal information (we do not sell personal data)
• Non-Discrimination: Not receive discriminatory treatment for exercising privacy rights
• Correct: Request correction of inaccurate personal information
• Limit Use: Limit the use and disclosure of sensitive personal information

To exercise any of these rights, contact us at hello@maplemind.co.in or use the data export/deletion tools in your account Settings.

9. Cookies & Tracking

We use essential cookies only for authentication and session management. We do not use advertising cookies, third-party trackers, or analytics that identify individual users. No data is shared with advertising networks.

10. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis: We process your data based on contractual necessity (to provide the Service), legitimate interest (to improve our products), and your consent (for optional communications).
• Data portability: You may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interest.
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.
• Data transfers: Data transferred outside the EEA is protected by Standard Contractual Clauses approved by the European Commission.

To exercise GDPR rights, contact hello@maplemind.co.in. We respond within 30 days.

11. Cross-Border Data Transfer

Your data may be processed on servers located outside India. We ensure adequate protection through data processing agreements and encryption. By using the Service, you consent to cross-border transfer with these safeguards in place, as permitted under the DPDP Act 2023.

12. AI & Automated Processing

Our AI voice system processes calls automatically. Callers are informed they are speaking with an AI. You can review all AI interactions, transcripts, and decisions through your dashboard. No fully automated decisions with legal or significant effects are made without human review.

12. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify the Data Protection Board of India within 72 hours as required by the DPDP Act 2023, and notify you promptly via email with details of the breach, data affected, and steps being taken.

13. Grievance Officer

For any privacy concerns, data requests, or grievances:

Grievance Officer: Maple Mind Privacy Team
Email: grievance@maplemind.co.in
Acknowledgment: Within 24 hours
Resolution: Within 15 days

If unsatisfied with our response, you may file a complaint with the Data Protection Board of India.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 15 days before taking effect. Continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact

Maple Mind
Email: hello@maplemind.co.in
Website: maplemind.co