Your Privacy Matters: Magic Flow is committed to protecting your personal information and respecting your privacy rights. This Privacy Policy explains how we collect, use, store, and safeguard your data when you use our permission-based business messaging platform.
1. Introduction
This Privacy Policy applies to Graham Tutin trading as Magic Flow (hereinafter referred to as "Magic Flow," "we," "us," "our," or "the Platform"), a permission-based business messaging platform that enables businesses to create and send opt-in marketing campaigns to consenting customers across WhatsApp, SMS, Email, and Web Chat.
By using Magic Flow, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Service.
2. Information We Collect
2.1 Information You Provide Directly
When you register for Magic Flow or use our Service, you may provide:
- Account Information: Name, email address, phone number, business name, company details, billing address
- Payment Information: Credit card details, billing information (processed securely through third-party payment processors)
- Profile Data: Business logo, team member information, user preferences
- Communication Content: Messages, conversation history, customer contact information, attachments, and files you upload or transmit through the Platform
- Support Requests: Information you provide when contacting customer support
2.2 Information Collected Automatically
When you use Magic Flow, we automatically collect:
- Usage Data: Pages visited, features used, time spent on the Platform, interaction patterns
- Device Information: IP address, browser type, operating system, device identifiers
- Cookies & Tracking: We use cookies, web beacons, and similar technologies to enhance your experience (see Section 8)
- Log Data: Server logs, error reports, API calls, performance metrics
2.3 Information from Third Parties
We may receive information from third-party platforms you connect to Magic Flow:
- WhatsApp Business API: Message delivery status, customer phone numbers, conversation metadata
- SMS & Email Providers: Message content, delivery reports, contact information
- Payment Processors: Transaction confirmations, payment status (we do NOT store full credit card numbers)
- Analytics Services: Aggregated usage statistics, demographic data
3. How We Use Your Information
We use the information we collect to:
3.1 Provide & Improve the Service
- Deliver core messaging features and functionality
- Process and route messages across multiple channels
- Enable AI-assisted campaign features (message drafting and translation)
- Maintain and improve Platform performance, security, and reliability
- Develop new features and enhancements
3.2 Customer Support
- Respond to your inquiries and support requests
- Troubleshoot technical issues
- Provide account assistance and onboarding help
3.3 Communication
- Send transactional emails (account verification, password resets, billing notifications)
- Provide service updates, new feature announcements, and product newsletters (with your consent)
- Send important security alerts and policy changes
3.4 Analytics & Business Operations
- Analyze usage patterns to understand how customers use the Platform
- Generate aggregated, anonymized statistics for business intelligence
- Conduct market research and customer satisfaction surveys
- Detect and prevent fraud, abuse, and security threats
3.5 Legal & Compliance
- Comply with legal obligations (court orders, subpoenas, regulatory requirements)
- Enforce our Terms of Service and Acceptable Use Policy
- Protect our rights, property, and the safety of our users
4. AI & Machine Learning
4.1 How AI Processes Your Data
Magic Flow uses artificial intelligence and machine learning to help you build campaigns. Our AI features include:
- Campaign Drafting: AI helps draft and brand campaign messages, which you review and approve before sending
- Language Translation: Campaign messages can be translated across 200+ languages
- Human in Control: AI never sends messages on its own — the business approves every campaign, and messages go only to opted-in customers
4.2 AI Data Usage
To provide AI features, we:
- Process Conversation Content: AI models analyze message text to generate suggestions
- Learn from Usage Patterns: Aggregated, anonymized data helps improve AI accuracy
- Do NOT Train on Your Private Data: Your individual messages are NOT used to train public AI models without explicit consent
4.3 AI Limitations & Human Review
Important: AI-generated suggestions are not always accurate. You are responsible for reviewing and approving all AI-generated content before sending. In some cases, our team may manually review conversations to improve AI performance (only with your consent or for quality assurance purposes).
5. Data Sharing & Disclosure
5.1 We Do NOT Sell Your Data
Magic Flow will never sell your personal information or customer data to third parties.
5.2 When We Share Your Data
We may share your information in the following limited circumstances:
With Third-Party Service Providers
- Messaging Platforms: WhatsApp, SMS providers, email services (to deliver your messages)
- Payment Processors: Stripe, PayPal (to process subscription payments)
- Cloud Hosting: AWS, Google Cloud (to store data securely)
- Analytics Tools: Google Analytics (to understand usage patterns)
- Customer Support: Help desk software (to manage support tickets)
All third-party providers are contractually obligated to protect your data and use it only for specified purposes.
For Legal Reasons
We may disclose your information if required by law or if we believe in good faith that such disclosure is necessary to:
- Comply with legal obligations (court orders, subpoenas, government requests)
- Enforce our Terms of Service or investigate violations
- Protect the rights, property, or safety of Magic Flow, our users, or the public
- Prevent fraud, security threats, or illegal activity
Business Transfers
If Magic Flow is involved in a merger, acquisition, or sale of assets, your information may be transferred to the new entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.
5.3 Aggregated & Anonymized Data
We may share aggregated, anonymized data (e.g., "80% of users prefer WhatsApp over SMS") for marketing, research, or business purposes. This data cannot be used to identify you personally.
6. Data Security
6.1 How We Protect Your Data
Magic Flow implements industry-standard security measures to protect your information:
- Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256)
- Secure Servers: Data is stored on secure, monitored cloud infrastructure
- Access Controls: Only authorized personnel can access user data (with strict logging and monitoring)
- Regular Audits: We conduct security audits and vulnerability assessments
- Incident Response: We have procedures in place to detect and respond to data breaches
6.2 Your Responsibilities
You are responsible for:
- Keeping your account password secure
- Notifying us immediately of any unauthorized access
- Using strong, unique passwords
- Enabling two-factor authentication (if available)
6.3 No Absolute Security
Important: While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security against all threats.
7. Data Retention
7.1 How Long We Keep Your Data
We retain your information for as long as necessary to provide the Service and comply with legal obligations:
- Active Accounts: Data is retained as long as your account is active
- Conversation History: Message history is retained according to your subscription plan settings
- Deleted Accounts: After account deletion, data is typically removed within 30 days (some data may be retained for legal or security reasons)
- Backup Systems: Data in backup systems may persist for up to 90 days after deletion
- Legal Requirements: Some data may be retained longer if required by law (e.g., financial records for 7 years)
7.2 Data Deletion Requests
You can request deletion of your data by:
Note: Some data may need to be retained for legal, security, or business reasons even after deletion.
8. Cookies & Tracking Technologies
8.1 What Are Cookies?
Cookies are small text files stored on your device when you visit a website. Magic Flow uses cookies and similar technologies to enhance your experience.
8.2 Types of Cookies We Use
- Essential Cookies: Required for the Platform to function (login sessions, security features)
- Performance Cookies: Help us understand how users interact with the Platform (Google Analytics)
- Functional Cookies: Remember your preferences and settings
- Marketing Cookies: Track advertising campaign effectiveness (only with your consent)
8.3 Managing Cookies
You can control cookies through:
- Browser settings (most browsers allow you to block or delete cookies)
- Cookie consent banner (appears on first visit)
- Account settings (opt out of non-essential cookies)
Note: Disabling essential cookies may affect Platform functionality.
9. Your Privacy Rights
9.1 General Rights (All Users)
You have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Request corrections to inaccurate or incomplete data
- Deletion: Request deletion of your personal data (subject to legal exceptions)
- Portability: Request your data in a machine-readable format
- Objection: Object to processing of your data for certain purposes
- Restriction: Request restriction of processing under certain circumstances
- Opt-Out: Unsubscribe from marketing emails (link included in all marketing messages)
9.2 GDPR Rights (EU/EEA Users)
If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
- Right to Restrict Processing: Request limitation of how we process your data
- Right to Data Portability: Receive your data in a structured, commonly used format
- Right to Object: Object to processing based on legitimate interests or direct marketing
- Right to Lodge a Complaint: File a complaint with your local data protection authority
9.3 CCPA Rights (California Users)
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):
- Right to Know: Request disclosure of personal information collected, used, or shared
- Right to Delete: Request deletion of personal information
- Right to Opt-Out: Opt out of the "sale" of personal information (Note: We do NOT sell your data)
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
9.4 How to Exercise Your Rights
To exercise any of these rights, contact us at:
We will respond to your request within 30 days (or as required by applicable law).
10. International Data Transfers
10.1 Where We Store Your Data
Magic Flow is based in Australia. Your data may be stored and processed in:
- Australia (primary data centers)
- United States (cloud hosting providers like AWS, Google Cloud)
- European Union (for EU customers, if applicable)
10.2 Data Transfer Safeguards
When we transfer data internationally, we use appropriate safeguards such as:
- Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
- Adequacy Decisions: Transfers to countries with GDPR-equivalent protections
- Encryption: Data is encrypted during international transfers
11. Children's Privacy
Magic Flow is not intended for children under 18 years of age. We do not knowingly collect personal information from children.
If you believe a child under 18 has provided us with personal information, please contact us immediately at [email protected], and we will delete the information.
12. Third-Party Links
Magic Flow may contain links to third-party websites, services, or applications (e.g., WhatsApp). We are not responsible for the privacy practices of these third parties.
We encourage you to review the privacy policies of any third-party services you access through Magic Flow.
13. WhatsApp Business API & Data Sharing
13.1 WhatsApp Data Sharing
If you use Magic Flow to send messages via WhatsApp Business API, please note:
- WhatsApp Access: WhatsApp (owned by Meta) may access message metadata (phone numbers, delivery status, timestamps)
- WhatsApp Privacy Policy: Your use of WhatsApp is also governed by WhatsApp's Business Policy
- No Content Sharing: Magic Flow does NOT share the content of your WhatsApp messages with third parties (except as required to deliver messages via WhatsApp)
13.2 BSP Application Status
Magic Flow is currently applying to become an Official WhatsApp Business Solution Provider (BSP). Once approved, additional WhatsApp-specific terms may apply.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:
- We will post the updated Privacy Policy on this page with a new "Last Updated" date
- For material changes, we will notify you via email or in-app notification
- Your continued use of Magic Flow after changes constitutes acceptance of the updated Privacy Policy
We encourage you to review this Privacy Policy periodically.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Your privacy is important to us.
By using Magic Flow, you acknowledge that you have read and understood this Privacy Policy.
Magic Flow Hub™