Privacy Policy

Last updated: 2026-08-10

Maze Agents ("Maze", "we", "us") provides an AI sales agent that runs on top of your WhatsApp Business account and/or your Instagram Professional (Business/Creator) account. This page summarizes what we collect, how we use it, and your rights. A formal long-form policy is in active drafting with our legal counsel; this summary reflects our current operating practices.

What we collect

• Account data: name, email, password (hashed), authentication tokens.
• WhatsApp message data: inbound and outbound messages of conversations handled by your Maze agent. We need this to respond, qualify, book, and follow up on your behalf.
• Instagram message data: when you connect your Instagram Professional account, we receive your Instagram Business Account ID, handle and profile picture; a long-lived access token (60 days, refreshed automatically), encrypted at rest with AES-256; direct messages sent to your connected account, along with each sender's Instagram-Scoped User ID (IGSID) and username; and metadata for each conversation (timestamps, message type, delivery status).
• Calendar data: appointment details you choose to expose to the agent (titles, times, attendees).
• Payment data: handled directly by Stripe. We never see or store card numbers.
• Usage data: page views, clicks, anonymous analytics through Google Analytics 4.

How we use it

• To operate the AI agent on your behalf inside WhatsApp and Instagram Direct Messages.
• To send you billing receipts, product updates, and onboarding emails.
• To improve the product through aggregated, non-identifying analytics.

Instagram integration — specifics

You may disconnect Instagram from Maze at any time by clicking "Desconectar" in the Instagram settings inside your Maze dashboard, or by revoking Maze from your Instagram account under Settings → Business Tools → Connected Apps. Upon disconnection we mark the connection as revoked, clear the encrypted access token, and stop processing new events; conversation history is retained for 30 days after disconnection and then permanently deleted. If Meta notifies us of a user-initiated data deletion request via the Meta App Dashboard, we schedule that user's data (Instagram identifiers, messages, contact metadata) for permanent deletion within 30 days.

What we don't do

• We don't sell your data to third parties.
• We don't share your customer conversations with other Maze accounts.
• We don't train shared AI models on your conversation content.

Third-party processors

Maze uses these subprocessors to deliver the service: Stripe (billing), Supabase (database + auth), OpenAI (LLM inference), Evolution API (WhatsApp transport), Meta Graph API (Instagram messaging transport), Vercel (hosting), Resend (transactional email), Google Analytics 4 (anonymous usage analytics).

Your rights

You can request to access, export, or delete your account data at any time by emailing us. Account closure deletes your tenant data within 30 days.