What Maya Does NOT Collect

In enterprise procurement, the most important page in a vendor's documentation is often the one that names what the vendor refuses to do. This is that page.

Personal data

Maya does not collect, ingest, or store:

• Customer identifiers of any kind, including:
  • TCKN (Turkish national ID)
  • Customer number / müşteri numarası
  • Account number / hesap numarası
  • Card number, BIN, or any payment instrument data
  • IBAN
• Names, email addresses, phone numbers
• Postal addresses
• Date of birth
• Authentication credentials (passwords, OTPs, tokens)
• Biometric data
• Geolocation data

Tracking identifiers

Maya does not collect:

• Cookies (first-party or third-party)
• Session IDs
• CSRF tokens
• Authorization headers
• Bearer tokens, API keys belonging to your applications
• Device identifiers (device ID, hardware ID, IMEI)
• Advertising identifiers (IDFA, GAID, Android Advertising ID)
• Browser fingerprints

Application content

Maya does not collect:

• Database content
• Internal API responses
• POST or PUT request bodies
• Form data
• File uploads
• WebSocket frames
• Authenticated page contents (only public, bot-accessible pages are in scope)

Network identifiers

Maya does not collect:

• Raw IP addresses (only an optional, brand-controlled hash)
• MAC addresses
• Internal network topology
• VPC, subnet, or routing information

Behavioral identifiers

Maya does not collect or attempt to derive:

• Cross-device user identity
• Cross-site behavior
• Page-to-page user journeys (this is GA4 / Dataroid territory; Maya intentionally does not duplicate)

Things Maya does NOT do

• Maya does not modify your live website.
• Maya does not inject scripts, pixels, or tags into your pages.
• Maya does not call any of your internal APIs.
• Maya does not send marketing communications to your end users.
• Maya does not redistribute, syndicate, or sell your data.
• Maya does not use your data to train any model — Maya's, OpenAI's, Anthropic's, Google's, or anyone else's.
• Maya does not retain prompt simulation outputs at the model provider — enterprise endpoints with zero-retention contracts are used.
• Maya does not lock you in. Every ingested record is exportable. The filter query is yours. The markdown endpoint is yours.

How this list is enforced

These are not aspirational statements. They are enforced by:

1. Source-side filtering. The brand applies the filter; Maya never has the option of ingesting forbidden fields because they never leave the brand's perimeter.
2. Schema validation. Maya's ingestion endpoint rejects records containing fields outside the allowlist.
3. Audit logging. Every internal access to tenant data is logged and auditable.
4. Contractual. The DPA codifies these limits as binding obligations.

If you need additional restrictions

Some clients require even tighter scope — for example, dropping the referrer field, refusing to hash IPs, or excluding certain user-agents. The filter is yours. You can restrict it further at any time.

If your compliance team needs a written acknowledgment of additional restrictions, Maya signs an addendum.