Privacy policy

Who is responsible

Magma Productions Limited, company 13137932, 71–75 Shelton Street, Covent Garden, London, England, WC2H 9JQ, is controller for account administration, billing administration, website enquiries, security and its own communications. Privacy contact: hello@magmaproductions.dev.

For private CRM records and connected communications processed solely on a business customer's documented instructions, that customer is controller and we act as processor under the DPA. The actual purpose and activity determine the role. We remain responsible for any research or reuse for which we independently determine purposes; public availability does not remove data-protection obligations.

Information, purposes and legal bases

Customer-directed workspace data may contain companies, professional contacts, names, roles, email addresses, phone numbers, addresses, notes, links, selected correspondence, attachments and generated analyses. Customer controllers determine their lawful basis and notices. This service is not intended for children's, special-category or criminal-record data.

Account information needed for the service is mandatory where the form marks it so; without it we may be unable to create or maintain the account. Optional analytics and mailbox connections are not required to browse the website.

Sources and public business research

We receive information from you, authorised account users, connected providers and requested public research. Public information can come from company websites, professional profiles, search sources and business publications. Source links are retained where available so a result can be checked or disputed.

If Magma independently collects personal data from another source, we provide required indirect-collection information within the applicable deadline, generally no later than one month and earlier where first communication or disclosure requires it, unless a documented legal exception applies. Customers must address their own notification and outreach obligations for customer-directed research. We do not claim that a public email address is permission for marketing.

AI and optional mailbox connections

OpenAI API services support requested discovery, analysis, translations and Scout assistance. Relevant queries, selected public-source text and selected workspace context needed for the requested action may be sent to that provider. A full mailbox is not automatically sent to AI. We do not authorise private CRM or mailbox content for unrelated model training; provider-specific retention and processing terms remain relevant. Read the AI notice.

Google or Microsoft mail connections are optional and use the permissions shown at authorisation. Disconnecting stops future synchronisation and removes the saved connection credentials. It does not automatically erase copies already imported into the workspace or data in the original mailbox. You may also revoke access in your provider's security settings. Imported correspondence follows workspace retention or an earlier valid deletion instruction.

We do not use this service to make solely automated decisions producing legal or similarly significant effects on individuals.

Providers and international processing

Recipients include contracted hosting/database providers, OpenAI for requested AI research, Resend for transactional email, Stripe for payments, and Google for consented public-page Analytics. Authorised Google/Microsoft mailbox services act under their applicable roles and terms. See Provider and processing information for functions, provider identities and source documents. Disabled legacy search providers are not treated as current recipients merely because old code references them.

Processing and remote access can occur outside the UK or EEA, including the United States, depending on the provider and requested function. We do not promise exclusive EU hosting or zero provider retention. Applicable transfers require a valid adequacy route or appropriate safeguards such as relevant EU standard contractual clauses and the UK Addendum, together with necessary assessments. You may request the locations and a copy or description of the applicable safeguards at our privacy address. A provider's own privacy notice explains its independent-controller processing; it does not replace our obligations.

We may disclose necessary information to confidential professional advisers, authorities where legally required, or a business successor subject to appropriate safeguards. Private workspace data is not sold for unrelated use.

Retention and deletion

We retain account and workspace records while needed to supply the selected service and act on authorised export or deletion instructions. Cancelling renewal alone does not delete those records. For an account-closure or deletion request, we identify the relevant records, return or delete customer data as instructed, and explain any specific legal retention. Necessary accounting and dispute records may be retained for the applicable statutory or claim period; this is not a reason to keep an entire mailbox or CRM indefinitely.

Security and support records are kept only as needed for their operational, investigation or complaint purpose, with longer holds limited to a documented legal or security need. Provider logs and backups have separate retention: deleted active records can persist in protected recovery copies until that backup cycle expires, and applicable deletion instructions must be reapplied after restoration. Request details relevant to your account at our privacy address.

App sessions last at most 14 days unless ended sooner. Cookie choices last up to 180 days; language and theme preferences remain until changed or cleared. Optional Analytics retention also depends on the Google property settings. The Cookie policy gives storage names and controls.

Optional Google Analytics

The public website uses Google Analytics 4 only after analytics consent. The Google tag is not downloaded beforehand. Advertising storage, advertising user data, Google Signals and ad personalisation are disabled by this integration. The private application does not load the Analytics tag.

Our public-page events remove query strings and URL fragments. We do not intentionally send form values, credentials, private prospect records or mailbox contents to Analytics. Google receives browser identifiers and technical request information, including the IP address needed for the request. Reject Analytics or withdraw consent through Cookie settings. Withdrawal does not affect prior lawful processing.

Your rights and complaints

Depending on applicable law and the processing basis, you may request access, correction, erasure, restriction or portability, withdraw consent, and object to processing based on legitimate interests, including direct marketing. A marketing objection is acted on without balancing it against sales interests. A minimal suppression record may be retained to respect that choice.

Contact our privacy address, identify the relevant account or source record and explain the request. We ask only proportionate verification and do not routinely require identity documents. We respond within applicable statutory limits, normally one month under GDPR, and explain any lawful extension. For processor-held records we assist and notify the customer controller as appropriate.

You may complain directly to the UK Information Commissioner's Office or the competent EEA supervisory authority, including the Italian Garante. You need not complete our complaints procedure first. We publish material changes and give further notice where required.