Privacy Policy

Introduction

Your privacy is important to us. It is MagicX Inc's policy to respect your privacy and comply with any applicable law and regulation regarding any personal information we may collect about you, including via AI Autocomplete, our website, and associated services.

Personal information is any information about you which can be used to identify you. This includes information about you as a person (such as name and contact details), your devices, payment details, and information about how you use our services.

If our services contain links to third-party sites, please be aware that those sites have their own privacy policies. After following a link to any third-party content, you should read their posted privacy policy information about how they collect and use personal information. This Privacy Policy does not apply to any of your activities after you leave our services.

Business Customers and Our Role

When an organization uses AI Autocomplete, that organization generally determines why and how personal information in its data is processed and acts as the controller or business. MagicX acts as its processor or service provider and processes that information on the organization's documented instructions, including as necessary to provide, secure, support, and maintain the services or as required by law.

MagicX acts as a controller or business for personal information it uses for its own account administration, billing, sales, website analytics, security, legal compliance, and communications.

If an executed Data Processing Addendum or order form conflicts with this Privacy Policy, that agreement controls for the applicable customer data. To request or discuss a Data Processing Addendum, contact procurement@magicx.ai.

Information We Collect

Information we collect falls into one of two categories:

• "Voluntarily provided" – any information you knowingly and actively provide us when using AI Autocomplete and our website.
• "Automatically collected" – any information automatically sent by your device or browser in the course of accessing AI Autocomplete and our website.

Log Data

When you use AI Autocomplete or visit our website, our servers may automatically log standard data provided by your browser, such as:

• IP address
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring site
• Date and time of access

Personal Information

We may ask for personal information—for example, when you register an account or contact us—which may include:

• Name
• Email
• Phone number, if you provide it

AI Autocomplete Customer Content

The information processed through AI Autocomplete depends on how a customer configures its integration and may include:

• Text entered by an end user, including the current query or request
• Completed or identified fields, customer-provided instructions, configuration data, and optional application context
• Suggestions, completions, and other outputs generated by the service
• Organization, product, request, and session identifiers; timestamps; locale; client version; and technical request information
• Usage, selection, performance, diagnostic, error, and security telemetry

In this policy, these categories are referred to collectively as Customer Content.

Legitimate Reasons for Processing Your Personal Information

We only collect and use your personal information when we have a legitimate reason for doing so, and only as reasonably necessary to provide our services.

Collection and Use of Information

We may collect personal information from you when you:

• Register for an account
• Use a web browser to access our content
• Contact us via email, social media, or similar technologies
• Mention us on social media

We may collect, hold, use, and disclose information for purposes such as:

• Providing AI Autocomplete's core features and services
• Enabling you to customize or personalize your experience
• Communicating with you regarding your account or our services
• Measuring service performance and usage, diagnosing errors, preventing abuse, and providing support

We may combine voluntarily provided and automatically collected personal information with information from other trusted sources (e.g., if you connect a social-media profile).

We do not sell Customer Content or use it for cross-context behavioral advertising. MagicX does not use Customer Content, or authorize its AI inference providers to use it, to train general-purpose AI models unless the customer expressly agrees in writing. Provider retention for abuse monitoring or service reliability may still apply unless an approved zero-data-retention configuration is enabled.

AI Autocomplete for Shopify

When a merchant installs our Shopify app and connects their store, we receive and store the following information from Shopify:

• The store's domain
• An API access token that authorizes us to read the store's product catalog
• Product catalog data, such as product titles, types, and attributes

We use this information solely to provide search suggestions on the merchant's storefront. Our app requests read access to products only. We do not request or collect personal information about a store's customers from Shopify.

Search terms entered by storefront visitors are processed by our services in order to generate suggestions. We do not use them to identify individual visitors.

Merchants may request access to or deletion of Shopify connection information by contacting us. We handle verified requests in accordance with applicable Shopify requirements and the retention terms below.

Security of Your Personal Information

We protect personal information by commercially acceptable means to prevent loss, theft, unauthorized access, disclosure, copying, use, or modification. However, no electronic transmission or storage method is 100% secure.

You are responsible for selecting and safeguarding any passwords and ensuring the security of your own information within our services.

How Long We Keep Your Personal Information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, as specified in an applicable order form or Data Processing Addendum, or as required by law. Retention periods vary by data type and deployment configuration.

We respond to valid deletion requests in accordance with applicable law and contractual terms. Information may be deleted, de-identified, or retained where permitted or required for legal, accounting, fraud-prevention, or security purposes. Backups and security records expire under their applicable retention schedules. Zero retention applies only when it is expressly agreed and technically enabled for every applicable MagicX system and provider.

Children's Privacy

We do not target children under 13 and do not knowingly collect personal information about them.

Service Providers and Subprocessors

A provider is a subprocessor under an applicable Data Processing Addendum only when it processes customer personal information on our behalf. The service-delivery providers listed for applicable customer deployments are:

• Microsoft Azure – cloud hosting, databases, and content delivery
• Google Cloud, including Google OAuth – sign-in authentication
• OpenAI – AI model inference
• Google Gemini – AI model inference
• Stripe – billing and payment processing
• Google Analytics – product and service usage analytics
• Sentry – error monitoring
• Datadog – infrastructure monitoring

For our public website, marketing, sales, and support operations, we may also use Google Analytics, PostHog, Google Ads, LinkedIn, X, Reddit, RB2B, Calendly, Brandfetch, and Google favicon services for analytics, advertising, attribution, business-visitor identification, scheduling, communications, support, and logo delivery. Depending on the service, these vendors may act as service providers or independent controllers under their own privacy notices. Visiting the public website does not, by itself, provide these vendors with autocomplete query text.

We require subprocessors to protect customer personal information through written terms. We provide notice of intended subprocessor additions or replacements, and an opportunity to object, as described in the applicable Data Processing Addendum.

Other Disclosures

We may also disclose personal information to our affiliates, employees, contractors, professional advisers, business partners, and agents; to courts, regulators, and law-enforcement authorities; or to an acquirer of all or substantially all of our assets, in each case as permitted or required by law.

Processing Locations and International Transfers

MagicX is based in the United States, and personal information may be processed in the United States and other countries where MagicX or its providers operate. The primary MagicX-hosted production environment is in the United States; provider and onward-subprocessor locations may vary. Customer-specific data-residency commitments apply only when stated in an order form or Data Processing Addendum.

Where required, we use an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses and applicable UK or Swiss supplements.

Your Rights and Controlling Your Personal Information

Your choices include:

• Access – Request details of personal information we hold about you.
• Correction – Request correction of inaccurate, out-of-date, or incomplete information.
• Non-discrimination – We will not discriminate against you for exercising your rights.
• Notification of data breaches – We comply with applicable laws regarding data breaches.
• Complaints – Contact us with any privacy complaints; you may also contact regulators.
• Unsubscribe – Opt out of marketing communications at any time.

Business Transfers

If we are acquired, go out of business, or enter bankruptcy, your data may be transferred to the acquiring party under the same privacy commitments.

Limits of Our Policy

Our website may link to external sites we do not operate. We are not responsible for their content or privacy practices.

Changes to This Policy

We may update this policy to reflect changes in business processes, practices, or laws. Significant changes will be communicated to registered users when required.

Additional Disclosures for U.S. States Privacy Law Compliance

This section applies where U.S. state privacy laws grant you rights, subject to applicable exemptions.

• Your rights: Depending on where you live, you may have the right to request access, correction, deletion, or a copy of your personal information and to opt out of certain sales, sharing, targeted advertising, or profiling.
• Requests: Submit a request to procurement@magicx.ai. We may need to verify your identity or authority and will respond as required by applicable law.
• Website advertising: We do not sell Customer Content. Some public-website analytics or advertising activities may be considered selling, sharing, or targeted advertising under applicable state law. You may submit an opt-out request using the contact above.
• Do Not Track: We currently do not respond to browser DNT signals.

California Notice of Collection (Past 12 Months)

We have collected identifiers such as name, email, phone number, account name, IP address, and account IDs.

Additional Disclosures for GDPR Compliance (EU)

• Controller and processor roles: MagicX is a controller for the business purposes described above and a processor for customer personal information processed on a business customer's instructions.
• Legal bases: Consent, performance of a contract, legitimate interests, compliance with law.
• International transfers: Protected by appropriate safeguards (e.g., SCCs).
• Data Subject Rights: Restrict processing, object, data portability, etc.

Additional Disclosures for PIPEDA Compliance (Canada)

• Expanded definition of personal information (PII).
• Valid consent and right to withdraw.
• Rights of access and rectification; compliance with PIPEDA's ten privacy principles.
• Anti-Spam Legislation compliance.

Additional Disclosures for UK GDPR Compliance (UK)

• Legal bases mirror EU GDPR (consent, contract, legitimate interest, legal compliance).
• International transfers follow UK GDPR rules.
• Data Subject Rights: restrict processing, object, be informed, access, erasure, portability, rectification.

Enquiries, Reports, and Escalation

If we do not resolve your concern, you may contact:

• Canada: Office of the Privacy Commissioner of Canada, 30 Victoria St, Gatineau, QC K1A 1H3, Toll-Free 1-800-282-1376, www.priv.gc.ca
• UK: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, Tel 0303 123 1113, www.ico.org.uk

Contact Us

For privacy requests, Data Processing Addenda, or questions about our subprocessors, contact procurement@magicx.ai.