Maya privacy notice
For Maya, the Check It service on WhatsApp
Effective 25 September 2026 · updated 26 October 2026
This notice applies to Maya, the WhatsApp service from IntegriAI Private Limited, trading as IntegrityX.ai ("we", "us"). It does not apply to the IntegrityX business platform, which has its own Privacy Policy.Maya's terms are at integrityx.ai/maya/terms, and its refund rules are at integrityx.ai/refunds.
Who we are
Maya is a WhatsApp service from IntegriAI Private Limited, trading as IntegrityX.ai. Maya lets you check a person, a company, or a vehicle against official Indian registers before you deal with them, pay them, or hire them.
What we collect, and why
| We collect | Why | Kept how long |
|---|---|---|
| Your WhatsApp number | To message you and to match your account. Stored encrypted, plus a one-way hash used to look you up. We never store your number as plain text. | Kept while your account exists — see "How long we keep things" below. |
| What you type to Maya | To run your check and reply to you. | 30 days, then deleted. |
| A photo of a document you send (for example a PAN card, RC, GST certificate or passport) | To read the details into the check's form, so you can check them before the check runs. The photo is fetched from WhatsApp and sent once to a document reader: IDfy, in India, for a PAN card, voter ID, driving licence or passport; Google Gemini in Mumbai for other documents. An Aadhaar card is refused in any form, as set out below. | Not stored by IntegrityX, not in a log. Only the details you confirm in the form are kept, as below. |
| Identifiers you give us — PAN, GSTIN, company name, vehicle number, MCA/company number, domain name, court case details, EPFO/UAN, driving licence, voter ID, passport number, a name and date of birth | To ask the matching official register the question you paid for. | The register's answer is kept 30 days, then deleted. |
| Payment records | To take payment and account for it. This is a financial record, not a data point about the person you checked. | 7 years, then deleted. |
| Your name when you buy, and how you paid | For the receipt and for disputes. Maya asks your name once, just before sending the payment link. From Razorpay we keep the email and phone number you gave Razorpay, the payment method (card, UPI, netbanking or wallet), the UPI handle or the bank or wallet name, and for a card only its network and last 4 digits. Never the full card number. Staff screens show these masked. | 7 years, with the payment record, then deleted. |
| Your own PAN, name and date of birth, once, at your first purchase | To check that you are 18 or over and that the details belong together, so checks cannot be misused against others. IDfy, in India, checks them against the Income Tax register. We keep only that you were verified, when, and the last 4 characters of your PAN. Your full PAN and date of birth are not stored. | Kept while your account exists. |
| A voice note you send | To understand what you said. Google Gemini in Mumbai turns it into text; from then on it is treated exactly like a typed message. | The audio is never saved. The text is kept 30 days, like a typed message. |
| Your reports (the PDF result) | To deliver what you paid for and let you re-download it. | 30 days, then deleted — unless your account has been flagged for review (see below). |
| What you tell us about a family member who has died: which of their papers you have, and whether you were named their nominee | To tell you which official sites to search and what they ask for. | 30 days, then deleted. |
| What you tell us about a call or message offering to recover your money | To point out known scam signs. | 30 days, then deleted. |
| Your request for help with a claim: that you asked | To count how many people want this help. | 30 days, then deleted. |
| Your request for one message when help with a claim opens | To send you that one message. | Until the service opens, when we send you the one message and then delete it; or 12 months if it has not opened by then; or sooner if you reply STOP. |
What we never ask for
We never ask for your Aadhaar number or an Aadhaar photo, your bank PIN, or an OTP. If Mayaever asks you for one of these, it is a mistake or someone impersonating us — do not send it.
If you send an Aadhaar number, an Aadhaar Virtual ID or a photo of an Aadhaar card, Maya refuses it and it is removed before it is stored. We do not accept video. If you send one, Maya tells you to send text, a voice note or a photo instead.
Maya never searches on your behalf and never asks for a one-time code. The official sites Maya names ask you to enter details yourself, on their own pages.
Flagged accounts
If an account's pattern looks unusual, a person reviews it, and while that review is open we keep the evidence and conversation longer than 30 days — otherwise a pattern that only becomes visible over weeks would have already been deleted. This only happens on accounts a review has actually flagged.
Who processes your data, and where
- Meta (WhatsApp Cloud API)carries every message between your phone and our server. Meta is a US company, and messages may be processed outside India as part of Meta's own systems.
- Google Gemini, running in Mumbai (Google Cloud's
asia-south1region), writes Maya's replies, turns voice notes into text, checks what kind of document a photo shows, and reads the details of documents other than a PAN card, voter ID, driving licence or passport. This model runs under a zero-retention setting: your conversation is not kept by Google beyond answering. - IDfy answers the official-register questions (PAN, GSTIN, vehicle, court, EPFO, and others) and reads your documents. IDfy is an Indian company.
- Razorpayprocesses your payment. We never store your full card number or bank login — Razorpay does. We keep only the payment details listed in the table above.
- Google Cloud (India,
asia-south1) hosts our servers and database. - We may also send you a one-time code by email through SendGrid, a US company, only if you use the Maya web console (not the WhatsApp check itself).
- TypeSafe, an AI company in the United States, may read your messages with everything that identifies you removed first, to understand what you are asking for and to check Maya's replies before they are sent. Its model is reached through OpenRouter, also a US company, which passes the masked text on to TypeSafe. Before anything is sent, we take out your name and the names of people you ask about, your phone number, identity numbers (PAN, GSTIN, vehicle and similar), email, UPI id, address, date of birth and account details. What you get back from a check, your reports and your payment details are never sent. TypeSafe answers typed questions only; it does not write to you and cannot charge you.
No other AI service reads your WhatsApp messages.
Who at IntegrityX can see your number
Our staff can see your number only to help with a purchase, a complaint, a safety report or a legal request, and every look is recorded.
How long we keep things — the short version
Everything is deleted at 30 days except: your WhatsApp number and account (kept while the account exists), your payment record (kept 7 years, then deleted), a flagged account's evidence (kept until a person clears the flag), a request for one message when help with a claim opens (kept until it opens, 12 months at most, or until you reply STOP), a locked minimal record of what we processed (kept one year from processing, as the law requires; see below), and a security log of which check was used and when. That log holds no message, no identifier and no result, only a scrambled form of your number, and we cannot edit it, so no one can hide what was run.
Your rights
Under India's Digital Personal Data Protection Act, 2023, you can ask us to:
- tell you what personal data we hold about you and why (access)
- correct data that is wrong (correction)
- delete your data (erasure)
- nominate someone to exercise these rights if you are unable to
- raise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it
How to ask: email grievance@integrityx.ai from any address, giving the WhatsApp number your account uses. We will answer within 30 days.
Or ask Maya:tap "Delete my data" in the menu, or send "delete my data". Maya asks once more, with two buttons. Your data is then deleted within the hour, except while a check is still running (it finishes first) or while an account is under review. Any paid check you have not used is refunded first.
What stays after deletion: payment records (7 years, for accounting and disputes), the security log described above, the record of your deletion request, and anything on an account under review for threats or abuse until a person closes that review. IDfy, which runs the register checks, keeps its own record of each check it ran; we cannot delete that for you.
The locked record: when you delete your data, or when we delete it after 30 days, we keep a locked minimal record for one year from when it was processed, as the DPDP Rules 2025 require: your number, the checks you ran and what was sent to the register, and message times and ids. Never your messages or reports. It can be opened only for a lawful request, every opening is recorded, and it is then deleted.
Grievance Officer: Arjun Khanna, grievance@integrityx.ai.
Children
Check It is only for adults: at your first purchase we check that you are 18 or over. Maya does not run checks on anyone under 18. If a date of birth, from a form, a photo or a register, shows the person is under 18, Maya stops the check and their details are not passed on.
If you are in distress
Maya is a fraud-checking service, not a counselling service. If you tell Mayayou are thinking of hurting yourself, Mayastops the check and gives you: Vandrevala Foundation +91 9999 666 555 (24 hours, call or WhatsApp), Tele-MANAS 14416 (24 hours), iCall 9152987821 (Mon–Sat, 10am–8pm). In immediate danger, call 112.
Changes to this notice
We will update this page when what Maya does changes, and change the effective date above.
Contact
- maya@integrityx.ai — questions about a conversation or your account.
- grievance@integrityx.ai — rights requests (access, correction, erasure, nomination) and grievances.
- Refunds — see integrityx.ai/refunds.