Privacy policy

This policy explains what personal data AI Magicx, a Delaware company in the United States (“we”, “us”), collects when you use the AI Magicx website, app, API and connectors (the “service”), why we collect it, who processes it for us, how long we keep it and the choices you have. For the personal data of the people who use apps you build and publish with AI Magicx, you decide how it's used and we process it for you; see Apps you publish and their users.

Questions about privacy, or a request about your data: support@aimagicx.com.

What we collect

• Account details: your name, email address, how you sign in (email code, password or Google), your time zone and your settings. If you turn on two-step sign-in, we keep your authenticator secret encrypted and your recovery codes only in a scrambled (hashed) form.
• Workspaces and teams: the workspaces you belong to, your role, invitations you send or receive, and seat requests.
• Your content: messages, files you upload, instructions, memory you choose to keep, skills, commands, projects, schedules, and everything the service makes for you, including images, video, audio, documents and app code.
• Billing: your plan, purchases, receipts, balances, billing address and the saved-card details our payment provider shows us (such as card brand and last four digits). Card numbers stay with the payment provider; we never see or store them. If you turn on automatic top-ups, we keep your settings and a record of the consent you gave.
• Usage: which models and tools ran, what they cost, and the technical logs needed to run, bill and secure the service.
• Keys and connections: API keys you add for other providers, and the access tokens of apps you connect. Both are stored encrypted and used only for your requests. Your AI Magicx API keys are stored only as a scrambled (hashed) value.
• Apps you build: app files and versions, who edited and saved them, the addresses and custom domains you connect, and request and traffic counts for published apps.
• Shared links: what you chose to share, the link settings and how many times the link was opened.
• Security signals: when you sign up or sign in, we check that you're a person (Cloudflare Turnstile) and keep keyed, one-way digests of your email address, browser and network to limit abuse such as repeated free sign-ups. We don't store those values in readable form.
• Messages to us: what you send to support, and reports about published apps (the address, the reason and the details given). We don't store the IP address of the person who reports.

Why we use it

• To provide the service you asked for, including running your requests, storing your work and publishing what you choose to publish (performance of our contract with you).
• To take payments, keep balances accurate and keep financial and tax records (contract and legal obligation).
• To keep the service secure, prevent fraud and abuse, and enforce our acceptable use policy (legitimate interests).
• To send service emails such as sign-in codes, receipts, and notices about your account, payments and published apps (contract).
• To understand which features are used, only if you allow it (consent).
• To meet legal requests and protect our rights (legal obligation, legitimate interests).

We don't sell your personal data or share it for advertising, and we don't use your content to train AI models.

How AI processing works

When you send a message or start a task, the content needed for it (your prompt, the files you attached or picked, and the relevant parts of the chat) is sent to the model provider that runs it: the one you chose, or the one Auto picked. Results come back to your account. Web searches send the search text to a search provider. Code and app builds run in a private sandbox that is created for the task. If you use your own provider keys, that provider receives the request under your own account with them.

Google Drive and Gmail

The Google Drive and Gmail connectors become available after launch, once Google has reviewed them. This section describes how we handle Google user data when you connect them.

• What we access: for Drive, only the files you pick in Google's file picker, plus files we create for you after you approve them. We can't see the rest of your Drive. For Gmail, and only for the permissions you grant: searching and reading messages and attachments when you ask, sending a message you approved, and saving a draft you approved. We also read the email address of the connected Google account.
• How we use it: only to provide the features you use in AI Magicx, such as bringing a file or email into a chat, answering questions about it, and sending or saving what you approved. Content you bring into a chat is sent to the AI model provider that answers that request, like any other chat content. Nothing is sent or saved in your Google account without your approval of the exact message or file.
• What we don't do: we don't use Google user data to train or improve AI models, we don't sell it, we don't use it for advertising, and we don't transfer it to anyone except as needed to provide the features you use, for security, or to comply with the law. Our staff don't read it unless you ask us to (for example, for support), it's needed for security or to investigate abuse, or the law requires it.
• Keeping and deleting: Gmail messages are fetched when needed and not kept separately; what a tool returns becomes part of that chat. Files you import become chat files. Unsent local drafts are deleted after 30 days. When you disconnect, we end access immediately, delete the picked-file list, imported copies and unsent drafts, and revoke our access at Google. You can also remove access from your Google Account settings at any time.

AI Magicx's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Apps you publish and their users

You can publish apps you build with AI Magicx, connect your own domain to them and give them a database with sign-in for their own users.

• You're in charge of your app users' data. For the personal data your app collects from its users (for example their email address and what they store in the app), you are the controller and we process it on your behalf, only to run, store, back up and deliver your app as set out in our terms. You should tell your app's users how you use their data.
• Each app's database is kept separate from AI Magicx's own data and from other apps. Sign-in codes for your app's users are sent by our email provider; we don't keep the addresses or the codes after sending.
• Published apps run on their own web address, separate from AI Magicx, and we don't add cookies, trackers or analytics to them. We count requests and traffic for each app to apply plan limits.
• People who use an app should contact the app's owner about their data. If you can't reach the owner, or want to report an app, write to support@aimagicx.com.

Who we share it with

We share personal data only with the service providers that help us run AI Magicx, under contracts that limit their use of it to providing their service to us, and only what each needs:

Apps and servers you connect yourself, such as Notion, Linear or your own connector, receive what each action needs, within the access you grant them. Their own terms and privacy policies apply. People you share a link with see what you chose to share.

We may also disclose data when the law requires it, to protect people from harm, or as part of a sale or reorganisation of the business, in which case this policy continues to apply to it.

International transfers

Several of these providers process data in the United States and other countries. When personal data is transferred out of the UK, the European Economic Area or Switzerland, we make sure it's protected by a safeguard recognised by data protection law, such as an adequacy decision or standard contractual clauses.

How long we keep it

• Your content stays until you delete it or close your account.
• When you delete a chat or a file, it's removed from the service straight away. Our backup copies are kept for 90 days, so a copy can remain in a backup for up to 90 days after you delete it.
• Data downloads you request are kept for 7 days. Older app releases beyond the 10 most recent are deleted after 14 days. App database backups are kept for 7 days. Unused top-up mana lasts 12 months.
• When you close your account, there's a 7-day grace period in which you can change your mind. After that we delete your chats, files, projects, memory, skills, schedules, connectors, keys, published apps, custom domains, app databases and their backups, shared links and settings. Files deleted from our main storage can remain in backup copies for up to 90 days.
• We keep the records the law and our accounts require: usage receipts, balances, orders and the audit log. These no longer carry your name or email address.
• The keyed digest of your email address that stops the free welcome mana being claimed twice is kept for 12 months after you close your account, then deleted. It can't be turned back into your email address.

Security

Data is encrypted in transit. Provider keys, connector tokens and other secrets are encrypted at rest and never shown back to a browser. Stored files are private and served only to people allowed to see them. You can turn on two-step sign-in in Settings → Account, and sensitive actions such as connecting a domain ask you to confirm your identity again. No system is perfectly secure; if a breach affects your personal data, we'll tell you and the authorities as the law requires.

Your rights

Depending on where you live, you can access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent at any time. In Settings → Account you can download your data (chats, messages, files, memory, settings and usage in one file) and close your account. For anything else, email support@aimagicx.com. We'll reply within the time the law requires. You can also complain to your local data protection authority.

Cookies and browser storage

• Needed: cookies that keep you signed in and protect sign-in and connector set-up, and browser storage that remembers settings such as the theme and unsent edits.
• Bot protection: Cloudflare Turnstile runs on sign-up and sign-in to check that you're a person.
• Analytics: anonymous product analytics (see below). It uses no cookies and stores nothing in your browser.

We don't use advertising cookies.

Product analytics

We count which pages and features are used so we can see what works. These counts are anonymous and cookieless: nothing is stored on your device, and visits are grouped by a code made from your network address and browser that changes every day, so you can't be followed from one day to the next. Your address isn't kept.

If you also turn analytics on in Settings → Notifications and below, we use opaque identifiers to link feature names, task outcome categories and plan and usage amounts to your account. Conversations, file and email contents, Google data, provider keys, card numbers and billing addresses are excluded. Analytics runs on a server we operate ourselves; it isn't shared with an analytics company.

You can switch analytics off for this browser below. Settings → Notifications separately controls optional account analytics. Browser privacy signals such as Global Privacy Control and Do Not Track are respected. Essential security, account and financial records are separate from optional analytics.

Analytics preferences

Children

The service isn't for people under 18, and we don't knowingly collect their data. If you think a child has given us personal data, email support@aimagicx.com and we'll delete it.

Changes

If we make significant changes, we'll tell you by email or in the app before they take effect. The date at the top shows when this policy last changed.