Privacy Policy

1. Data Controller

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address
• Name (optional)
• Company name (optional)
• Password (stored as a secure hash)

2.2 API Usage Data

When you use our API, we log:

• API requests (endpoint, timestamp, response status)
• Message metadata (recipient channel, delivery status — not message content)
• IP address of API calls

2.3 Payment Data

Payments are processed by our Merchant of Record:

2.4 Website Analytics

We do not use third-party analytics services (Google Analytics, Meta Pixel, etc.). We do not track you across the web. Basic server logs (IP, user agent, timestamp) are retained for security purposes only.

3. Legal Basis for Processing (GDPR Art. 6)

4. Data Processors & Sub-processors

We use the following third-party services to operate Magini.io:

No US-based processors. Your data never leaves the EU/EEA or countries with an EU adequacy decision.

5. Data Retention

• Account data: Retained until you delete your account, plus 30 days for backup recovery.
• API logs: Retained for 90 days, then automatically deleted.
• Invoices & payment records: Retained for 10 years (German tax law, AO §147).
• Server logs: Retained for 7 days, then automatically deleted.

6. Your Rights (GDPR Art. 15–22)

You have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data
• Erasure ("Right to be forgotten") — Request deletion of your data
• Restriction — Limit how we process your data
• Portability — Receive your data in a machine-readable format
• Object — Object to processing based on legitimate interest
• Withdraw consent — Where processing is based on consent

To exercise any of these rights, contact us at privacy@magini.io. We will respond within 30 days.

7. Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority. For Poland:

8. Cookies

We use only strictly necessary cookies for:

• Session management (if logged in)
• Language preference

We do not use advertising cookies, tracking cookies, or third-party cookies. No cookie consent banner is required under GDPR for strictly necessary cookies.

9. Data Security

We implement appropriate technical and organizational measures:

• TLS 1.3 encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Regular security updates and patching
• Access controls and audit logging
• Servers located exclusively in EU data centers

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. The "Last updated" date at the top of this page indicates when it was last revised.

11. Contact Us

For any questions about this Privacy Policy or our data practices: