Privacy Policy. We never sell your information.

This summary helps you read. The full policy below is what counts.

• We keep what we need to build your site, answer calls, send texts, and bill you.
• We never sell your information, and we don't use it for ads.
• We never share phone numbers or text consent with anyone for their marketing.
• Our AI answers calls for the businesses we work for. It says it is AI and that the call is recorded.
• When you call a business we work for, we work for that business. It decides what happens to your details.
• We make free sites from public Google listings and email the owner. Tap “Remove this page” on a free site to take it down.
• Our own code sets no cookies and runs no ad or tracking tools.
• You can ask to see, fix or delete your information. Write to privacy@getmaca.io.

This policy explains what personal information Maca collects, why, who helps us handle it, how long we keep it, and what you can ask us to do. “Maca,” “we” and “us” mean Arkode Holding Group LLC, a Colorado limited liability company based in Boulder, Colorado, which does business as Maca.

It covers getmaca.io and its Spanish pages, the free sites we make for businesses, the websites we run for our clients, the AI that answers calls for our clients, our texts and emails, our own phone lines (our demo line and the calls we make when you tap “Call me”), and our sales emails to businesses.

It is about four groups of people:

• business owners who claim a free site, buy a package, or talk with us;
• people who call or text a business we answer for, and that business's customers;
• owners of businesses we find on public listings and email; and
• people who visit our pages.

For information about business owners, our clients, the businesses we email and the people who visit our pages, and for calls to our own lines, we decide how the information is used.

When you call or text a business we answer for, we work for that business, as its service provider. The business decides what is collected about you and what is done with it. It gets your details, like a summary of your call and your number, and uses them under its own privacy rules.

To see, fix or delete that information, you can ask the business or us. If you ask us, we may pass your request to the business and help it answer.

When you claim a free site or start a package, we collect your name, business name, city, cell and email, the changes you want on your site, the package you pick, whether you pay monthly or yearly, and your language. If someone referred you, we keep their referral code.

If you tick the box to get texts from us, we keep your yes, the time, the words shown next to the box, the language, the page, your IP address and your browser type, as proof. If you don't tick it, we keep none of that.

To set up your phone, we collect your services, the prices callers may hear, your hours, your service area, what counts as urgent, the cell for urgent calls, your phone company and how your calls reach us, answers to common questions, and your yes or no to texts about your calls.

To register your texts with the phone companies, we collect your legal business name, business address, tax ID number (EIN) and a contact person.

Stripe, our payment company, takes your card. We never see or keep your full card number. We keep your Stripe customer number, your package, your billing dates and whether your payments went through.

If your package includes it, we manage your Google listing as a manager and register a web address in your name.

We keep the texts, emails and WhatsApp messages you send us, and notes from our calls with you. Test calls you make to your own line are recorded like any other call.

When our AI answers a call to a client's line, we collect the number you called from and the number you called, the time and length of the call, a recording, a written copy of the call, a short summary, the language, and what you tell the AI. That can be your name, the address for the job, the job you need, the time you want, and whether we may text you about it.

If nobody picks up, we note your number and the time. Missed calls are not recorded. We may text you back once.

If you text the business's line, we keep your texts and pass them to the business.

If you book a time, we keep the booking. After a job, we may text you once to ask for a Google review, and once more if you don't open it. We note if you tap the link.

A business on our Respond package may send us the names and cells of customers it served, so we can ask them for a review. We keep those, and the job date.

Callers sometimes mention health or safety. We don't ask for it. We use it only to pass the message to the business, and to tell anyone in danger to hang up and call 911.

The first thing our AI says is the business name, that it is an AI assistant, and that the call is recorded and may be shared with the companies that run our AI. Our demo line, “Call me” calls and the talk demo on free sites say the same, and that it is a Maca demo.

We record so the business gets your details right, and so a person can check what the AI said and fix its mistakes. A person on our team listens to some calls.

The business you called, the people on our team who need to, and the companies that run our calls can hear or read the call: Twilio for the phone line, ElevenLabs for the AI voice, and Anthropic, whose AI model ElevenLabs uses for our assistant. They may use it only to provide their service to us.

The AI can't turn off the recording. If you don't want to be recorded, you can hang up and reach the business another way. If the AI passes your call to the business owner, the recording goes on.

The recording is kept at ElevenLabs. We don't copy it to our own database.

The AI is not an emergency service. If anyone is in danger, hang up and call 911.

To ask us to delete a recording, write to privacy@getmaca.io with your phone number and the day you called.

We text from two kinds of lines. The Maca line texts business owners about their site and account, only if they said yes. Each client's line texts people who called that business, booked with it or were served by it, for that business. It also sends the owner call summaries and urgent alerts, if the owner said yes. Our Terms of Service describe both programs, at getmaca.io/terms#texts.

How many texts you get varies. Msg and data rates may apply. Reply HELP for help. Reply STOP to stop. When you reply STOP to any line we run, we stop texting that number from every line we run, right away. Reply START to get texts again.

Saying yes to texts is never a condition of buying anything.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

We share phone numbers only with the companies that deliver our texts, such as Twilio and the phone companies, and only to deliver them.

We look for local US businesses on Google Maps. Through a data company, Apify, we collect what their public listings show: the business name, type of work, phone, address, web address, hours, Google place number, Google rating and number of reviews, and the full listing record the data company returns. Sometimes it also finds a business email in public sources. We check each email with MillionVerifier before we write.

Many small businesses are run by one person, so a listing's phone or email may be the owner's own. We treat it as personal information.

We use these facts to make a free site for the business and to send up to four sales emails about it. Our AI writes the site's words from the listing facts, and a person checks each site before it goes out. The site shows the real rating and number of reviews, never the words of a review, and we keep it out of search engines.

Every sales email says it is a sales email, names Maca, a brand of Arkode Holding Group LLC, gives our mailing address, and lets you stop. To stop, reply “no” or tap the link at the bottom. We stop right away and keep your email on our do-not-email list, so we never write again.

For each sales email, we keep what happened to it: sent, bounced, replied, or asked to stop. We keep it with a one-way code made from your email and a partly hidden copy of the email, not the words of your reply. ReachInbox, the company that sends our sales emails, keeps your email and what we sent you, and may tell us when an email is opened.

Want the free site gone? Tap “Remove this page” at the bottom of it, then confirm on the page that opens. It comes down right away. We stop emailing the business and put its email and phone on our do-not-contact lists. We keep a record of the removal: the time, the language, and the IP address and browser of the person who tapped. Anyone can remove a free site that nobody has claimed. If the button doesn't work, write to hola@getmaca.io with the page's web address, and we take it down within one business day.

We send sales emails only to businesses in the United States.

Our host, Vercel, keeps basic logs of each visit: your IP address, your browser, the page and the time. We use them to run the site and keep it safe.

If you fill out a form, we keep what you type. To stop abuse, we count how many times a form is sent from one connection. For that count we keep a one-way code made from your IP address, not the address itself, and we clear old counts from time to time.

If you tap “Call me,” we keep your name, cell, language, the page, the exact consent words you agreed to, the time, your IP address and your browser. Our AI calls you once. That call is recorded and written down.

If you talk to the demo on a free site, your browser asks to use your microphone. The talk is recorded and written down like a phone call.

Counting visits to free sites: when we turn this on, a free site we made for a real business sends our server a short note each time it is opened in a browser. We keep the page, the day, whether the link came from our email, the name of the site that sent you there, and a one-way code made from your IP address, the page and the day, so one visitor counts once a day. We don't keep your IP address or browser for this, and we set no cookie. We use the count to decide which businesses to email again. This counting is off unless we turn it on.

Our own code sets no cookies. We use no analytics, ad or social media tracking tools, and we don't let others use our pages to follow you across websites.

Our forms keep what you typed, and your first name, in your browser tab, so we can thank you by name and put your words back if the form has an error. It is gone when you close the tab.

The talk demo on free sites is run by ElevenLabs. Your browser loads its code from unpkg.com, a public code host, and asks ElevenLabs for its settings, so both see your IP address and browser. When you start to talk, our page gives the demo a new random ID for that visit, not one tied to your device. The demo keeps your last language and a setting for its error messages in your browser.

Stripe's payment page and the booking page for your setup call are on those companies' own sites and use their own cookies.

We don't track you across websites, so a Do Not Track or Global Privacy Control signal doesn't change what our pages do. If we ever sell or share information for ads, we will treat those signals as a request to opt out.

To clear what your browser keeps, clear the site data for getmaca.io in your browser settings.

We use it to:

• answer calls, take messages, book times and send the business the details;
• send texts and emails, including account and billing messages;
• build, host and run websites, and manage Google listings for our clients;
• find businesses, make free sites and send sales emails;
• run our demos;
• bill you, and handle refunds and cancellations;
• check and fix our work, and count calls, bookings, texts and reviews;
• keep the service safe, stop abuse, keep records of consent and opt-outs, and follow the law and the phone companies' rules; and
• make counts that name no person or business, like how many calls we answered in a month.

We use AI to write the words on sites, to answer calls and to sum up calls. A person checks each site before it goes live. The AI takes messages and offers the times a business set. It makes no decisions about you that have legal or similar effects.

We use callers' and customers' information only for the business they dealt with, and to run and improve the service we give our clients. We don't market to them.

We never sell personal information. We don't share it for ads that follow you across websites, and we don't use it to build profiles about you.

We share it only:

• with the business you called, texted or were served by;
• with the companies that help us, listed below, which may use it only to provide their service to us;
• with the phone companies and The Campaign Registry, to register and deliver texts (a registration carries the business's details and sample texts, not callers' information);
• with Google, when we manage a client's Google listing for them;
• when the law requires it, or to protect someone's safety, stop fraud, or protect our rights;
• if our company is sold or merges with another, in which case this policy still covers your information; and
• when you ask us to, or say yes.

Each company gets only what it needs for its job:

• Supabase: our database, in the United States.
• Vercel: hosts getmaca.io, free sites and client sites, and keeps visit logs.
• Twilio: phone numbers, calls and texts. It also files texting registrations.
• ElevenLabs: the AI voice that answers calls, makes “Call me” calls and runs the talk demo. It keeps call recordings and written copies.
• Anthropic: the AI model behind our voice assistant, through ElevenLabs, and the AI that writes the words on free sites from listing facts.
• Retell AI: a second voice company we are testing.
• Stripe: payments and billing.
• Resend: our emails to owners and clients.
• ReachInbox: our sales emails.
• MillionVerifier: checks email addresses before we write.
• Apify: collects public Google Maps listings.
• Trigger.dev: runs our scheduled jobs, like reminders and summaries.
• unpkg: sends the talk demo's code to your browser.
• Google: we manage clients' Google listings, and some of our emails load their fonts from Google.
• Cal.com or Calendly: the booking page for your setup call.
• WhatsApp: if you message us there.

When you use Stripe's payment page, a booking page, WhatsApp or Google, those companies also handle your information under their own privacy policies.

We keep personal information only as long as we need it for the reasons in this policy:

• Call recordings, written copies of calls and summaries: as long as the business we answer for needs them and we need them to check our work. You can ask us to delete one sooner.
• Call and text logs, bookings and review requests: as long as the business needs its history, for example for its monthly report.
• Facts about a business that never claims its free site: while its free site is up, and until the business asks us to delete them.
• Our do-not-email, do-not-text and do-not-call lists, and records of removed pages: as long as we send emails or texts, so we never contact you again by mistake.
• Proof of consent to texts or to a “Call me” call: as long as we may need to show that the text or call was allowed.
• Your account as a client: while you are a client, and after you leave for as long as we need it for taxes, billing questions and disputes. Your free site stays up after you cancel, so what it shows stays until you ask us to take it down.
• Billing records: as long as tax law requires.
• Our host's visit logs: a short time, as our host's own rules set.

Wherever you live, you can ask us to:

• tell you whether we have personal information about you, and what it is;
• give you a copy of it;
• fix what is wrong; and
• delete it.

You can also stop our emails and texts at any time, as this policy explains. We don't sell information or use it for targeted ads, so there is nothing of that to opt out of.

To ask, email privacy@getmaca.io. Tell us your name and the phone number or email the request is about. For a call, give the number and the day you called. We may ask you to show the phone or email is yours, for example by answering a text or email we send to it. We won't ask for more than we need.

We answer within 45 days. If we need more time, we tell you within those 45 days, and we may take up to 45 more days.

Someone else can ask for you if you give them signed, written permission. We may ask you to confirm it.

If your request is about a call or text to a business we answer for, we may send it to that business, because it decides about that information, and we help it answer.

We won't treat you worse, charge you more or deny you service for asking.

When we delete, we keep a few things: your number or email on our do-not-contact lists, so we never contact you again; a record with your number partly hidden where a client's bill depends on it; proof of consent (the words you agreed to, the time, the page and the connection it came from) with your name, number and email hidden; and billing records the law requires. Some records stay with the companies that help us, like Twilio's call logs and Stripe's billing records, until their own rules delete them. We ask them to delete where they allow it.

If we say no, we tell you why. You can appeal: reply to our answer within 45 days and ask us to look again. We decide within 45 days of your appeal and tell you why. If we still say no, we tell you how to send a complaint to your state's attorney general.

Some state privacy laws, like California's, Colorado's and Texas's, give these rights only when a company is above a certain size. We give them to everyone, whether or not those laws apply to us.

For California residents: in the last 12 months we collected identifiers (like name, phone, email and IP address), business and billing details, call recordings, written copies of calls and texts, and activity on our pages. Where it comes from, how we use it and who we share it with are in this policy. We did not sell it or share it for ads.

Maca is for businesses and is not meant for children under 13. We don't knowingly collect information from children under 13 on our pages. A child might call a business we answer for, and our AI doesn't ask anyone's age. If you think we have information about a child under 13, write to privacy@getmaca.io and we will delete it.

Only our servers can reach our database, and only the people on our team who need it can see your information. Phone numbers and emails are partly hidden in our logs and alerts. We keep one-way codes instead of IP addresses where we can, and we check that messages from Twilio, Stripe and ElevenLabs really come from them.

No system is perfect, so we can't promise nothing will ever go wrong. If a breach affects your information, we tell you as the law requires.

We keep our database in the United States. Some companies that help us may handle information in other countries, under their own safeguards. Maca is meant for people in the United States.

We may change this policy. We post the new one here and change the date at the top. If a change matters for how we use information we already have, we tell our clients by email at least 30 days before it starts, and we ask for consent where the law requires it.

Maca, a brand of Arkode Holding Group LLC, Boulder, Colorado.

Privacy requests and questions: privacy@getmaca.io. Everything else: hola@getmaca.io.

This policy is in English and Spanish. If the two differ, the English version controls.