# [](#what-maya-does-not-collect)What Maya Does NOT Collect

In enterprise procurement, the most important page in a vendor's documentation is often the one that names what the vendor refuses to do. This is that page.

## [](#personal-data)Personal data

Maya does **not** collect, ingest, or store:

*   Customer identifiers of any kind, including:
    *   TCKN (Turkish national ID)
    *   Customer number / müşteri numarası
    *   Account number / hesap numarası
    *   Card number, BIN, or any payment instrument data
    *   IBAN
*   Names, email addresses, phone numbers
*   Postal addresses
*   Date of birth
*   Authentication credentials (passwords, OTPs, tokens)
*   Biometric data
*   Geolocation data

## [](#tracking-identifiers)Tracking identifiers

Maya does **not** collect:

*   Cookies (first-party or third-party)
*   Session IDs
*   CSRF tokens
*   Authorization headers
*   Bearer tokens, API keys belonging to your applications
*   Device identifiers (device ID, hardware ID, IMEI)
*   Advertising identifiers (IDFA, GAID, Android Advertising ID)
*   Browser fingerprints

## [](#application-content)Application content

Maya does **not** collect:

*   Database content
*   Internal API responses
*   POST or PUT request bodies
*   Form data
*   File uploads
*   WebSocket frames
*   Authenticated page contents (only public, bot-accessible pages are in scope)

## [](#network-identifiers)Network identifiers

Maya does **not** collect:

*   Raw IP addresses (only an optional, brand-controlled hash)
*   MAC addresses
*   Internal network topology
*   VPC, subnet, or routing information

## [](#behavioral-identifiers)Behavioral identifiers

Maya does **not** collect or attempt to derive:

*   Cross-device user identity
*   Cross-site behavior
*   Page-to-page user journeys (this is GA4 / Dataroid territory; Maya intentionally does not duplicate)

## [](#things-maya-does-not-do)Things Maya does NOT do

*   Maya does not modify your live website.
*   Maya does not inject scripts, pixels, or tags into your pages.
*   Maya does not call any of your internal APIs.
*   Maya does not send marketing communications to your end users.
*   Maya does not redistribute, syndicate, or sell your data.
*   Maya does not use your data to train any model — Maya's, OpenAI's, Anthropic's, Google's, or anyone else's.
*   Maya does not retain prompt simulation outputs at the model provider — enterprise endpoints with zero-retention contracts are used.
*   Maya does not lock you in. Every ingested record is exportable. The filter query is yours. The markdown endpoint is yours.

## [](#how-this-list-is-enforced)How this list is enforced

These are not aspirational statements. They are enforced by:

1.  **Source-side filtering.** The brand applies the filter; Maya never has the option of ingesting forbidden fields because they never leave the brand's perimeter.
2.  **Schema validation.** Maya's ingestion endpoint rejects records containing fields outside the [allowlist](./data-minimization.md).
3.  **Audit logging.** Every internal access to tenant data is logged and auditable.
4.  **Contractual.** The DPA codifies these limits as binding obligations.

## [](#if-you-need-additional-restrictions)If you need additional restrictions

Some clients require even tighter scope — for example, dropping the `referrer` field, refusing to hash IPs, or excluding certain user-agents. The filter is yours. You can restrict it further at any time.

If your compliance team needs a written acknowledgment of additional restrictions, Maya signs an addendum.

[PreviousData Minimization](/docs/security/data-minimization)[Next Data Processing Agreement](/docs/security/dpa)