Privacy Policy
What we collect, why, who sees it and how long we keep it.
- We do not sell data, use it for advertising, or use cookies on this website.
- We keep only what we need to run the service, and delete texts, chats and voicemail automatically.
- Clients’ customer details belong to the client, and are exported to them and then deleted when they leave.
- You can ask to see, correct or delete your data at any time.
1. Who we are
MagiLux Media Ltd (“MagiLux”, “we”) is a company registered in England and Wales, based in the Midlands, UK. Our company details are in the footer of this page. We are the controller of the personal data described in sections 2 to 5. Questions about your data: magiluxmedia@gmail.com, or WhatsApp 07438 771105.
This policy covers four groups of people: visitors to this website, businesses we get in touch with, our clients, and our clients’ customers. For the last group, we mostly act on behalf of the client business (section 5).
2. People who visit magiluxmedia.com
What happens when you visit. Our web host keeps standard server records (your IP address, browser type and the pages requested) to keep the site secure and working. We do not use cookies, advertising trackers or analytics on this site. The site loads its font from Google Fonts, which means your IP address is sent to Google when the page loads.
If you book a call or send an enquiry. We collect what you type in: your name, business name, mobile number, email (if you give one), and your answers about your business. We use it to contact you about your demo and to answer your questions. We rely on our legitimate interest in replying to business enquiries, and on taking steps you ask for before a contract. We keep it for up to 12 months after our last contact with you, unless you become a client.
If you tap the WhatsApp or email options instead, your message goes to us through those services and is also covered by their privacy policies.
3. Businesses we contact
We contact local businesses that might benefit from the Growth System by phone, text, email or social media. We use business details from public sources, such as your website, Google Business Profile and social media pages (business name, the owner’s name if shown, phone number and email address). Our basis is legitimate interest in promoting our service to businesses. Before we phone, we check numbers against the Telephone Preference Service and Corporate Telephone Preference Service, and we only send marketing texts or emails to people who have agreed or where the law allows. You can tell us to stop at any time and we will not contact you again. We keep a note of that so we do not make the same mistake twice.
If you want to know what we hold about you, or want it deleted, email us. We will respond within one month.
4. Our clients
If you are a client, or the owner or staff of a client business, we collect:
- Your name, business name, mobile number, email address and the details from your onboarding form (opening hours, services, areas and prices).
- Your login information (a texted one-time code and sign-in sessions), and the notification address of your phone, so we can send you alerts.
- Billing details. Payments are handled by Stripe; we do not see or store your full card details. We keep invoices and payment records.
- Your messages to us (for support) and counts of how the service is being used (for example number of enquiries).
We use this to set up and run your service, to take payment, and to give you support. Our basis is our contract with you, and our legitimate interest in running a secure and reliable service. We keep it while you are a client. After you leave we delete your account data and keep only invoices and payment records for 6 years, as tax and accounting law requires.
We can see the data in your account so we can support you and keep the service running. Our routine reporting uses counts only. We do not read your customers’ messages unless needed to fix a problem or help you, to protect someone from harm, or because the law requires it.
5. Our clients’ customers
When a business uses MagiLux, details of the people who contact it go through our system: what they send through the website form or chat, their texts, calls and voicemail, bookings, and review requests. The business decides how that information is used and we handle it for them, on the terms in our Data Processing Terms. If you have a question about your own details or want to see or delete them, the quickest way is to contact the business you dealt with. You can also email us and we will pass your request to them.
- The website assistant tells you it is an assistant. Your chat is stored so the business can see it. Transcripts are deleted after 180 days.
- If you leave a voicemail, you are told it is recorded. We keep the recording and a typed copy for 90 days, then delete both. The typing-out is done by Cloudflare’s speech-to-text.
- The wording of texts is cleared after 90 days.
- Every text we send for a business has a way to stop them. Reply STOP and we will not text you again for that business.
- Visits to client websites are counted without cookies. A visitor is recognised for one day only, using a one-way code made from their connection details and a value that changes daily and is then deleted. Browsers set to “Do Not Track” or “Global Privacy Control” are not counted.
6. Calendars and social accounts a client connects
If a client connects Google Calendar, Instagram, TikTok or YouTube, the service gives us a key that allows only the access needed. We store these keys encrypted, and use them only to show the client their diary or numbers, avoid double bookings, and add or remove bookings. For Instagram, TikTok and YouTube we read follower numbers and recent posts’ public details and counts. We do not post, message or change anything. Disconnecting in the app deletes the key and the data we read from that account. You can also remove our access from your Google, Instagram or TikTok account settings.
MagiLux’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to show the Diary, avoid double bookings and add or remove MagiLux bookings. We do not use it for advertising, we do not sell it, and people do not read it unless the client asks us to for support, or the law requires it.
The app uses YouTube API Services. By adding a YouTube channel you agree to the YouTube Terms of Service; Google’s handling of data is covered by the Google Privacy Policy.
7. Who we share data with
We do not sell personal data and we do not use it for advertising. We use these companies to run our service:
- Cloudflare: hosting and storage for the app and client websites, and speech-to-text for voicemail.
- Twilio: sending and receiving texts and calls.
- Anthropic: writes the website assistant’s answers.
- Stripe: takes payment from clients.
- Namecheap: hosts this website.
- Google, Meta and TikTok: only when a client connects those accounts.
- Apple, Google and Mozilla: deliver app notifications.
We may also share information where the law requires it, or to protect people from harm.
Some of these companies are outside the UK, for example in the United States. When that happens we use safeguards that UK law allows, such as the UK–US data bridge, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
8. Your rights
You can ask us to show you the personal data we hold about you, correct it, delete it, restrict how we use it, or hand it to you in a portable format. You can object to us using it where we rely on legitimate interests, and you can object at any time to marketing. Email magiluxmedia@gmail.com and we will respond within one month.
Business owners can delete a customer and their messages in the app (open the conversation, then “Delete this customer”), or delete their whole account (More, then “Delete my account”). Step-by-step instructions are on our delete your data page.
If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
9. Keeping it safe
All connections are encrypted. Logins use a one-time code sent by text, and keys for connected accounts are stored encrypted. Access to client data is limited to the people who need it. Texts, chats and voicemail are deleted on a schedule. No online service can promise perfect security, but we take this seriously, and we will tell the people affected, and the ICO where required, if there is ever a breach.
10. Automated decisions
The website assistant writes answers to questions and offers booking times. It does not make decisions that have legal or similarly significant effects on anyone, and a person at the business can see and take over any conversation.
11. Changes
We will update this policy when what we do changes, and the date at the top will show when it was last updated. If we make an important change we will tell our clients directly.