Privacy Policy
Last updated: October 29, 2026 • Compliant with GDPR, CCPA/CPRA, and Paddle Merchant Standards
This Privacy Policy explains how Magiquip (“we,” “us,” or “our”) collects, uses, shares, retains, and protects personal information when you use magiquip.com, console.magiquip.com, and related distribution services (collectively, the “Service”).
This Policy forms part of our Terms of Service. It is intended to help you understand your privacy rights under applicable laws, including the EU/UK General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act as amended by the CPRA (“CCPA”).
1. Information We Collect
Account information
When you register or manage a workspace, we collect:
- Name;
- Email address;
- Password hash (bcrypt);
- Profile or avatar preferences;
- Workspace and organization details;
- Role and permission information.
Build and distribution information
When you upload or distribute mobile builds, we may process:
- APK, AAB, IPA, or other supported binary files;
- Build numbers, version codes, and bundle identifiers;
- Release notes and build metadata;
- Debug symbols or mapping files, where uploaded;
- Tester email addresses and download/access events;
- Distribution-link access logs.
Billing information
Payments are processed by Paddle, our Merchant of Record. We do not store full card numbers or CVV codes on our servers.
We may receive from Paddle:
- Customer and subscription identifiers;
- Plan, billing-cycle, and transaction status;
- Invoice or receipt references;
- Billing country or tax-related information where needed.
Technical information
We collect standard technical data, including IP address, browser and device user-agent, referring URL, timestamps, and service logs. We use this information to operate, secure, and troubleshoot the Service.
Cookies and analytics
We may use cookies, local storage, and similar technologies to keep you signed in, remember preferences, measure usage, prevent abuse, and improve the Service. You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Service from working.
2. How We Use Information
We use personal information to:
- Provide, operate, maintain, and improve the Service;
- Authenticate users and enforce workspace role-based access controls;
- Store and distribute builds to authorized testers;
- Generate secure distribution links and access logs;
- Send transactional emails, invitations, build alerts, and security notices;
- Process subscriptions and billing through Paddle;
- Detect fraud, abuse, unauthorized access, and security incidents;
- Comply with legal obligations and enforce our Terms.
3. Legal Bases
Where GDPR applies, we process personal information based on:
- Contract: to provide the Service you requested;
- Legitimate interests: to secure the Service, prevent abuse, improve reliability, and communicate service updates;
- Consent: for optional marketing communications or non-essential cookies, where applicable;
- Legal obligation: to comply with tax, accounting, security, or regulatory requirements.
4. Sharing and Service Providers
We do not sell personal information. We share information only with service providers and processors necessary to operate the Service, including:
- Paddle: Merchant of Record, payments, invoicing, tax collection, and refunds;
- Cloudflare: Cloudflare R2 object storage, global CDN edge content delivery, and security services;
- Supabase: Cloud PostgreSQL application and database infrastructure;
- Resend: Transactional email delivery for invites, receipts, and build notifications;
- Professional advisers: where needed for legal, security, or compliance purposes;
- Authorities: where required by law, legal process, or to protect rights, property, or safety.
These providers process information strictly on our instructions and under contractual confidentiality and data security obligations.
5. International Data Transfers
Your information may be processed in countries other than your own. Where personal information is transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as standard contractual clauses or other lawful transfer mechanisms.
6. Data Retention
We retain personal information only as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.
Retention periods depend on the data type:
- Account data: retained while your workspace is active and for a reasonable period after closure;
- Billing records: retained as required by tax and accounting laws;
- Build artifacts and metadata: retained according to your plan’s storage and retention limits (e.g. 7-day, 90-day, or permanent retention);
- Logs and security records: retained for a limited operational and security period.
When data is no longer required, we delete or anonymize it, subject to legal retention requirements and backup cycles.
7. Security & Encryption at Rest
We use administrative, technical, and organizational safeguards designed to protect personal information, including strict access controls, encrypted connections (TLS 1.3 / HTTPS), encryption at rest across our datastores (including AES-256 encryption on Cloudflare R2 object storage and Supabase database infrastructure), password hashing (bcrypt), and automated security logging.
No method of transmission or storage is completely secure. If we become aware of a personal-data breach affecting your information, we will notify affected users and regulators where required by applicable law.
8. Your Rights
Depending on your location, you may have rights to:
- Access the personal information we hold about you;
- Correct inaccurate information;
- Delete personal information;
- Export or receive a copy of your data;
- Restrict or object to certain processing;
- Withdraw consent where processing is based on consent;
- Lodge a complaint with a privacy regulator.
You can manage workspace data and builds through Console settings. To exercise privacy rights, email [email protected]. We may need to verify your identity before fulfilling a request.
California residents may also have the right to know, delete, correct, and opt out of the “sale” or “sharing” of personal information. We do not sell personal information as those terms are commonly defined under the CCPA.
9. Children
The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact [email protected].
10. Changes to this Policy
We may update this Privacy Policy as our practices, services, or legal requirements change. Material changes will be announced through the Service, email, or our website.