This Privacy Policy explains what personal data we collect when you use Magicals, why we collect it, and what we do with it. It covers both our marketing website at magicals.com and the Magicals product itself.

Magicals is a business-to-business tool that helps ecommerce brands create marketing emails. That shapes how we handle data: the people whose data we process are almost entirely our customers and their team members — not consumers, and not our customers' shoppers. We've written this policy in plain English because we'd rather you actually read it.

This policy should be read together with our [Terms of Service]. Capitalised terms like "Customer Content", "Email Designs", and "Exported Emails" have the meanings given there.

1. Who we are

Magicals is operated by Codrawer Ltd, a company registered in England and Wales (company number 14729382, registered office at Apartment 144 Dudley House, North Wharf Road, London, England, W2 1QZ), trading as "Magicals."

For the purposes of UK and EU data protection law, Codrawer Ltd is the data controller of the personal data described in this policy.

You can reach us about anything privacy-related at support@magicals.com.

2. The data we collect

Here's what we collect, grouped by where it comes from.

Account and profile data. When you sign up, we collect your name, email address, and login credentials, along with details about your organisation and workspace (business name, team members you invite, and settings you configure).

Customer Content. Anything you upload to Magicals — logos, brand guidelines, product imagery, fonts, copy, and similar. This is mostly business material rather than personal data, but it may occasionally contain personal data (for example, a founder's name in brand copy).

Store content from integrations. If you connect your Shopify store, we sync products, collections, and media, along with the connection credentials needed to keep the integration working. If you connect the optional Google Drive integration, we access only the files and folders you choose to import, plus the credentials needed to authenticate the connection.

Billing data. Subscriptions are billed through Shopify's app subscription system. We receive confirmation of your subscription status and billing events, but we never see or store your payment card details — those go directly to Shopify.

Usage and technical data. As you use Magicals, we collect product analytics events (which features you use, and how), device and browser information, and pseudonymous identifiers. Our servers also log IP addresses and request metadata, which we need to run, monitor, and secure the platform.

Marketing site signups. If you fill in a form on our marketing website (hosted on Framer), we collect the contact details you submit — typically your name, email address, and business details — which are passed into our onboarding flow.

What we don't collect. Magicals does not collect or process personal data about your customers (shoppers). We don't sync customer lists, and we don't send emails to your subscribers — emails you create in Magicals are exported or transferred to your own email platform, which is where your subscriber data lives. Please also don't upload sensitive personal data, payment card data, or confidential third-party information to Magicals — as our Terms explain, content you submit is processed by AI services, and Magicals isn't designed to hold that kind of data.

3. How and why we use your data

Under UK and EU data protection law, we need a lawful basis for each way we use personal data. Here they all are:

• Providing Magicals to you — hosting your account, storing your Customer Content and Email Designs, running integrations, and processing your content through AI features to generate emails. Lawful basis: performance of our contract with you.

• Transactional emails — account verification, onboarding, team invitations, service notifications, and billing communications. Lawful basis: performance of our contract, and our legitimate interest in keeping you informed about your account.

• Product updates and marketing — we may occasionally email you about new features, improvements, or offers. You can opt out at any time using the unsubscribe link in any such email, or by emailing us at support@magicals.com. Opting out never affects transactional emails about your account. Lawful basis: our legitimate interest in telling existing customers about our product, or your consent where required.

• Analytics and product improvement — understanding how Magicals is used so we can make it better. As set out in our Terms (Section 5.4), we may use aggregated and anonymised information about how users interact with Magicals — which features are used, which workflows are common, which kinds of layouts perform well — to improve the product and refine our built-in templates and systems. We will never copy, resell, or redistribute your Email Designs, Customer Content, or Exported Emails. If you'd prefer we didn't use even this aggregated, anonymised information, contact us and we'll discuss options. Lawful basis: our legitimate interest in improving our product.

• Security and abuse prevention — monitoring for fraud, spam, unauthorised access, and misuse of the service. Lawful basis: our legitimate interest in keeping Magicals secure for everyone.

• Legal compliance — keeping records we're required to keep (for example, billing records) and responding to lawful requests from authorities. Lawful basis: compliance with our legal obligations.

We never sell your personal data. To anyone.

4. AI processing

Magicals uses third-party AI providers to power email generation and related features. Currently these are:

• Anthropic — powers AI-assisted email creation. Processes text and contextual content submitted through Magicals, including store and brand-related material used to generate or refine marketing emails.

• Google (Gemini) — powers content generation, analysis, image understanding, and semantic search. Processes text, images, and related content submitted through the API, along with the prompts and instructions we provide.

• Mistral AI — powers document and image understanding, including text extraction from uploaded assets. Processes images and documents submitted for analysis.

In each case, the provider processes your content to return outputs to Magicals — nothing more. We do not permit our AI providers to use your data to train their public models. Some providers may process inputs and outputs transiently to deliver the service, but your content is not retained to build or improve their general-purpose models.

This list is the current, canonical list of AI providers referred to in our Terms of Service. If it changes, we'll update this policy.

5. Who we share data with (sub-processors)

We use a small number of trusted service providers to operate Magicals. Each one processes data only to perform its specific job for us, under contractual commitments. Here's the full list and what each provider does:

PlanetScale is our hosted database provider. It stores and processes account information, workspace and organisation data, email projects and designs, integration settings, and other data required to operate the service. PlanetScale provides the database infrastructure; we remain responsible for what's stored and how it's used.

Hetzner hosts our application and related infrastructure in Germany. It may process server logs, IP addresses, request metadata, and other technical information needed to run, monitor, and secure the platform. Hetzner is used only for hosting and operations.

Cloudflare (R2) provides file storage and delivery. It stores and serves media and other files uploaded or generated through Magicals — brand assets, product imagery, and email-related files. Cloudflare is used to store and deliver this content, not for advertising.

GitHub is used for source control, continuous integration, and deployment. It processes application source code, build artifacts, and deployment credentials during releases.

Resend sends our transactional emails. It processes recipient email addresses, message content, and delivery metadata for emails Magicals sends, such as account verification, onboarding, and service notifications.

Loops sends certain transactional emails, including team and organisation invitations. It processes recipient email addresses, message content, and basic sending metrics, and is used only to deliver those communications.

Anthropic powers AI-assisted email creation (see Section 4). It processes text and contextual content submitted through Magicals, including store and brand-related material used to generate or refine marketing emails.

Google (Gemini) powers AI features including content generation, analysis, image understanding, and semantic search (see Section 4). It processes text, images, and related content submitted through the API, along with the prompts and instructions we provide.

Mistral AI handles document and image understanding, including text extraction from uploaded assets (see Section 4). It processes images and documents submitted for analysis.

PostHog (EU) provides product analytics. It processes usage events, interaction data, device and browser information, and pseudonymous identifiers to help us understand how the service is used and improve the product.

Shopify powers our store integration and billing. It processes store connection details, access credentials, and store content synced through the integration (products, collections, and media), as well as billing information handled through Shopify's app subscription system. This data is used only to operate the integration and the billing flows you've authorised.

Google (OAuth / Drive) supports the optional import of content from your Google account. When connected, it processes OAuth credentials and the files or folders you select for import, and is used only to authenticate the connection and access content you've authorised.

Framer hosts our marketing website and captures signups. It processes information submitted through marketing forms (such as contact details provided at signup) before forwarding it to our onboarding flow.

Beyond these providers, we may disclose personal data if we're legally required to (for example, in response to a valid request from a public authority), or as part of a merger, acquisition, or asset sale — in which case we'd let you know before your data becomes subject to a different privacy policy.

If we add or replace a sub-processor that handles your personal data, we'll update this list.

Google user data

Magicals' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: data we access through your Google account is used only to provide the import feature you've asked for — never for advertising, and never sold.

6. Where your data lives (international transfers)

Magicals stores and processes data primarily in the European Union. Our application servers and main database are hosted in Germany, and files uploaded through the service are stored with an EU-based cloud storage provider. Our product analytics run on PostHog's EU infrastructure.

Some of our sub-processors (listed above) may process data in countries outside the UK and EU, including the United States, where that's required to deliver their service. When that happens, we rely on appropriate safeguards for the transfer — such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum — together with the providers' contractual commitments.

7. How long we keep your data

Retention follows the lifecycle of your account, as set out in Section 8 of our Terms:

• While your subscription is active, we keep your account data, Customer Content, and Email Designs so the product works.

• If you cancel your subscription, your account moves into a read-only "archive" state. We keep your data so you can continue to view and export your existing library, until you either resubscribe or ask us to close your account.

• If you close your account (or we close it for breach of our Terms), we delete your Customer Content, Email Designs, and account data from our production systems within 30 days — except where we're legally required to retain certain information, such as billing records. Backups may persist for a limited period before being overwritten in the normal course.

• Aggregated and anonymised usage information that no longer identifies you or your account may be retained after closure to inform product improvements, as described in Section 3 above and Section 5.4 of our Terms.

Server logs and technical data are kept for shorter periods appropriate to security and operations.

8. Security

We take reasonable technical and organisational measures to protect your data: encryption in transit, access controls, and hosting with established infrastructure providers in the EU.

That said, no method of transmission or storage is completely secure, and Magicals is in early access — as our Terms say, you shouldn't rely on Magicals as the sole home of any business-critical asset. Keep your own backups of brand assets and exported emails.

If we become aware of a data breach affecting your personal data, we'll notify you and the relevant authorities as required by law.

9. Your rights

If you're in the UK or EU, data protection law gives you the following rights over your personal data:

• Access — ask us what personal data we hold about you and get a copy.

• Rectification — have inaccurate or incomplete data corrected.

• Erasure — ask us to delete your data.

• Restriction — ask us to limit how we process your data.

• Portability — receive your data in a structured, machine-readable format.

• Objection — object to processing based on our legitimate interests, including any marketing.

• Withdraw consent — where we rely on your consent, withdraw it at any time.

To exercise any of these, email us at support@magicals.com. We may ask you to verify your identity before acting on a request, and we'll respond within the timeframes required by law. Note that some data is necessary to provide the service — if you ask us to delete it, we may not be able to keep your account open.

You also have the right to complain to a supervisory authority. In the UK, that's the Information Commissioner's Office (ico.org.uk); in the EU, it's your local data protection authority.

If you're in the United States (including California): we don't sell your personal information, and we don't share it with third parties for cross-context behavioural advertising. Depending on your state, you may have rights to access, correct, or delete your personal information — email us at support@magicals.com and we'll honour those requests in line with applicable law.

10. Cookies

We keep cookies minimal:

• Essential cookies — used for authentication, sessions, and security. The product doesn't work without them.

• Preference cookies — used to remember settings you've chosen.

• Analytics — we use PostHog (EU) to understand how the product is used. Analytics requests are served through our own domain rather than a third-party tracker domain.

We do not use advertising cookies, and we don't allow third parties to track you across other websites through Magicals.

You can block or delete cookies through your browser settings, but blocking essential cookies will stop parts of Magicals from working.

11. Our role: controller and processor

For most of the data described in this policy — your account details, usage data, billing status — Codrawer Ltd is the data controller: we decide how and why it's processed.

For Customer Content you upload, you remain responsible for what you put into Magicals, including making sure you have the right to upload it. Where Customer Content contains personal data that you control (for example, personal data belonging to your own customers or staff), we act as your data processor, handling it only to provide the service to you.

If you're a business customer processing personal data through Magicals and you need a Data Processing Agreement (DPA), one is available on request — email support@magicals.com.

12. Third-party links

Our website and product link out to third-party services — Shopify, the email platforms you connect, our providers' sites, and so on. Once you leave Magicals, those services' own privacy policies apply. We don't control them and aren't responsible for their practices.

13. Children

Magicals is a business product for users aged 18 and over. It isn't intended for children, and we don't knowingly collect personal data from anyone under 18. If you believe we have, contact us and we'll delete it.

14. Changes to this policy

We may update this policy from time to time, especially as Magicals moves from early access toward general availability. If we make material changes, we'll let you know by email or via the product at least 14 days before the changes take effect, and we'll update the "Last updated" date at the top.

15. Contact us

Questions, requests, or concerns about this policy or your data:

Email: support@magicals.com

Post: Codrawer Ltd, Apartment 144 Dudley House, North Wharf Road, London, England, W2 1QZ