Privacy policy
Last updated 9 September 2026
MAICA handles a client's accounting evidence. That deserves a policy someone can actually read, so this one says what is collected, why, where it goes and how to get rid of it — without the usual hedging.
Who runs this
MAICA is operated by an independent developer based in India. It is pre-launch software in beta.
Contact: add a working address here before inviting anyone outside your own testing.
What is collected
Your account
Sign-in is Google only. When you sign in, Google gives us a stable account identifier, your email address and your display name. We store those three things to identify you on return visits.
We never receive or store your Google password, and we never ask for a NetSuite password, token or integration secret.
What you upload
The CSV exports you provide, and the normalised records derived from them. Depending on what you export, these may contain transaction identifiers, amounts, account names, dates, field-level change history and the names of NetSuite users who made changes.
Both the original file contents and the normalised records are retained, so every ranked factor can be traced back to the exact row it came from. That traceability is the point of the product; discarding the source would make the output unverifiable.
Your session
A single cookie on the application, holding a signed session identifier. It is
marked HttpOnly, Secure and SameSite=Lax,
and it exists only to keep you signed in. It is not used for advertising or
cross-site tracking.
This website
The marketing site at maica.in sets no cookies. If you allow it, it counts page views using Cloudflare Web Analytics, which is cookieless and does not track you across other sites. Decline and nothing is loaded. Your choice is remembered in your browser's local storage, not in a cookie.
Why we hold it
| Data | Purpose |
|---|---|
| Google account identifier, email, name | To sign you in and show whose account is whose |
| Uploaded exports and derived records | To run the analysis and cite the evidence behind every factor |
| Session cookie | To keep you signed in between requests |
| Page views, if allowed | To know whether anyone is finding the site |
Who can see it
Client accounts are isolated. Every read is checked against the account you have been granted access to, so one client's evidence is never served under another's.
The operator can technically access stored data in order to run and debug the service. Nothing is sold, rented, or shared for advertising, and nothing is handed to a third party except the infrastructure providers listed below.
Where it goes
- Render — hosts the application and its PostgreSQL database.
- Netlify — serves this marketing site. It receives no uploaded evidence.
- Google — handles sign-in. Google learns that you signed in to MAICA; it receives none of your uploaded data.
- Cloudflare — page-view counts for this site only, and only if you allow it.
These providers operate outside India, so data is processed abroad.
Language models
MAICA can generate a plain-English narration of a finding. That runs against a self-hosted model, and no uploaded evidence is sent to a third-party model provider. If that ever changes, this policy will say so before it does, and the ranked factors themselves are computed without a model either way.
How long it is kept
Uploaded evidence is kept until you delete it. Deleting a client account removes its analyses and uploaded records with it. Account details are kept while your account exists.
Because this is beta software running on trial infrastructure, treat nothing here as a system of record. Keep your own copy of anything that matters.
Your choices
- Delete any client account, and its evidence goes with it.
- Ask for your account and everything under it to be erased.
- Ask what is held about you, and get a copy.
- Decline analytics on this site, or change your mind by clearing your browser's site data for maica.in.
- Revoke MAICA's access to your Google account at any time, from your Google account settings.
Security
Traffic is encrypted in transit. Sign-in is delegated to Google, so no password is stored. Access to client evidence is authorised on every request, and state -changing actions carry a token to prevent them being triggered from another site.
Being plain about a limitation: uploaded evidence is not currently encrypted at the column level in the database, beyond the encryption the hosting provider applies to its disks. That is on the list before the product handles a real client's data in earnest.
Children
MAICA is a tool for accounting professionals. It is not intended for anyone under 18 and we do not knowingly collect their data.
Changes
If this policy changes materially, the date at the top changes and the change will be described here rather than quietly folded in.