MagicApp Privacy Policy

Last updated: August 13, 2025

MagicApp (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the MagicApp mobile applications including all related software, services, and documentation (the “App”). It also explains your rights and choices regarding your information.

By using our App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the App. We encourage you to read this Policy carefully alongside our Terms and Conditions. If you have any questions, feel free to contact us at support@magicapp.co.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. If we make material changes, we will notify you (for example, via an in-app notice or email) before the changes take effect. We encourage you to review this Policy periodically. The “Last updated” date above indicates when this Policy was last revised. Your continued use of the App after updates become effective signifies your acceptance of the revised Policy.

Data Controller and Contact Information

APPLYFT LTD is the data controller (the organization responsible for determining how and why personal information is processed) for the App. You can reach us with any privacy-related inquiries at: Parnithos 9, Flat/Office A, Germasogeia, 4040, Limassol, Cyprus, support@magicapp.co

Information We Collect

We collect personal information (“Personal Information”) that you provide to us directly, that is generated through your use of the App, or that we obtain from third-party services integrated into the App. The types of Personal Information we collect include:

Device Permissions: To provide certain features, the App may request access to your photos (for selecting or saving images) and your camera (to capture new photos). On iOS, the system will display a prompt tied to the relevant permission (e.g., Photo Library add-only, Camera). We use the system photo picker where available (iOS and Android) so you can select specific photos without giving full library access; on devices/versions where the system picker isn’t available, we use the minimum necessary OS mechanism and permissions. You can change these permissions anytime in your device settings. We access these resources only to deliver the features you request.

We limit our collection of Personal Information to what is necessary for the purposes described in this Policy (see How We Use Your Information). We do not knowingly collect sensitive personal information such as government ID numbers, biometric identifiers, or precise geolocation data. We also do not intentionally collect personal information from children under 13 (see Children’s Privacy). If you provide us with personal data of others, you must ensure you have the right to do so.

How We Use Your Information

We use the collected information for the following purposes, in accordance with applicable law. In each case, we process Personal Information only as needed for that purpose and rely on an appropriate legal basis (such as performing our contract with you, pursuing our legitimate interests, obtaining your consent, or complying with legal obligations). The specific ways we use your information include:

We will not use your Personal Information for purposes that are incompatible with the above, unless we obtain your consent or have a legal obligation or right to do so. If we plan to use your data for a new purpose not described here, we will update this Privacy Policy and, if required, seek your consent. We do not engage in any automated decision-making that produces legal or similarly significant effects on you without human involvement – any profiling we do (e.g. recommending content) is solely to enhance your experience and has no substantial impact on your rights or freedoms.

Cookies and Tracking Technologies

In-App Tracking: Although cookies are typically text files used in web browsers, the mobile App itself does not use cookies. However, we and our service providers use similar tracking technologies within the App environment to collect information automatically. These include software development kits (SDKs) and device identifiers that function analogously to cookies. For example, we use Google’s Firebase Analytics SDK to collect usage analytics, which may automatically gather data like your device’s advertising ID and events within the app (page views, session duration, etc.). We also integrate the AppsFlyer SDK for attribution, which uses device and network identifiers to help us understand through which ad or campaign a user discovered our App. Advertising partners may use their own trackers or unique identifiers to show ads and measure their effectiveness. These technologies are essential to running our App, allowing features such as remembering your login session, delivering content faster, and personalizing your experience and ads.

Website Cookies: If you visit our website, cookies and similar technologies will be used as described in the website’s Privacy policy.

Your Choices: You have controls over tracking technologies:

Please note that even if you opt out of personalized advertising, you may still see ads in our App – they will just be contextual or generic ads not based on your personal data. Also, our App must still use certain necessary tracking (like device identifiers for login security or basic analytics) to operate properly. We do not sell or share data obtained through cookies or trackers with third parties for their independent use, except as outlined in this Policy.

How We Share Your Information

We do not sell your Personal Information to third parties. We only share your information in the following circumstances and with appropriate safeguards:

In all cases of sharing, we strive to minimize the amount of Personal Information disclosed to what is necessary for the intended purpose. We also require recipients to safeguard your information and to not use it for purposes other than as we’ve agreed. Where required by law, we will ensure that third-party recipients are subject to data protection agreements (for example, standard contractual clauses for international data transfers – see International Data Transfers below).

Finally, we may share aggregated or de-identified data (information that cannot reasonably identify you) with third parties freely, as this does not constitute Personal Information. For example, we might share statistics like “X% of users use the AI Interior Design feature weekly” without any personal details.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. This means that when we collect your Personal Information, it may be processed outside of your home country. For example, if you are located in the European Economic Area (EEA) or United Kingdom, your information will likely be transferred to countries outside the EEA/UK, such as the United States, because our third-party providers (Google, Replicate, Appsflyer, etc.) and certain database storage are based there. Likewise, if you’re outside of the EU, your data might be transferred to the EU or U.S. for processing.

We take steps to ensure that international transfers of personal data are protected by appropriate safeguards as required by applicable law. When we transfer Personal Information out of the EEA, UK, or Switzerland to countries not deemed by those jurisdictions to provide an adequate level of data protection, we rely on lawful transfer mechanisms such as the European Commission’s Standard Contractual Clauses (SCCs). These are contractual commitments between companies transferring personal data, which bind the recipient to protect the data to EU privacy standards. We have SCCs or equivalent agreements in place with our U.S.-based service providers like Google and others, as needed. In some cases, we may rely on other measures, such as an adequacy decision (if the country has been officially deemed to have adequate protections), consent from the individual for the transfer (in limited situations), or other derogations permitted by GDPR (e.g. transfer necessary to perform a contract at your request).

For transfers from the EEA/UK to the U.S., note that Google (Firebase, Analytics) and certain other providers have certifications or commitments under frameworks like the EU-U.S. Data Privacy Framework, which was adopted in 2023. Google has self-certified its compliance with the EU-U.S. and Swiss-U.S. Privacy Frameworks to facilitate lawful and secure data transfers. These frameworks and the SCCs aim to ensure that your data receives a similar level of protection as it would under European law.

If you reside in other regions with data transfer requirements (for example, Brazil or Canada), we similarly ensure that transfers of your data comply with those requirements. By using MagicApp, or by providing us with your information, you understand that your Personal Information may be transferred to our facilities and those third parties with whom we share it as described in this Policy, even if located in other countries. Regardless of where your data is processed, we will protect it in the manner described in this Privacy Policy. We maintain uniform data protection standards across all locations, meaning we afford your data the same level of security and privacy safeguards in every country.

However, different countries have different laws. When your data is in another jurisdiction, it may be accessed by the courts, law enforcement, and national security authorities in accordance with local laws. Specifically, Personal Information stored in the United States may be subject to lawful requests by U.S. authorities. We will, when required, provide or facilitate such access strictly in compliance with legal processes and this Privacy Policy.

If you have questions about our international data transfers or need more information about the specific transfer mechanisms in place, please contact us (see Contact Us below). We can provide additional details, such as copies of relevant contractual clauses, subject to confidentiality considerations.

Data Security and Retention

Security Measures: We implement a variety of technical and organizational measures to protect your personal information. These include industry-standard practices such as encryption of data in transit (SSL/TLS), encryption of sensitive data at rest, firewalls and network security controls, and regular security assessments. We limit access to personal data to authorized employees and contractors who need to know that information in order to process it, and who are subject to strict confidentiality obligations. We also maintain procedures to address suspected security incidents. While we strive to protect your data, no method of transmission over the internet or electronic storage is completely secure. Therefore, we cannot guarantee absolute security. However, we follow best practices and comply with applicable data security regulations to minimize risks. If a data breach ever occurs that compromises your personal information, we will notify you and the appropriate authorities as required by law (for example, we comply with GDPR breach notification rules and relevant U.S. state laws on data breach notification).

Data Retention: We retain Personal Information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In general:

After the applicable retention period has elapsed, or upon your valid deletion request, we will either securely delete or irreversibly anonymize your Personal Information. “Deletion” means removing the data from our active databases, and making reasonable efforts to also remove or scramble it in archival systems. “Anonymization” means transforming the data such that it can no longer be linked to you (for example, aggregating it or replacing identifying fields with random values). Once anonymized, the information is no longer associated with you and may be retained for analytical or statistical purposes indefinitely without further notice to you.

In summary, we keep your data only as long as we have a valid reason to keep it. When we no longer need it, we remove it from our systems. If you have any specific questions about our data retention practices (for example, if you want to know if we still have certain information about you), you can contact us for more information.

Your Privacy Rights and Choices

Depending on your jurisdiction and the applicable privacy laws, you have certain rights regarding your Personal Information. MagicApp is committed to honoring your rights and providing you with control over your data. The following outlines your rights and how you can exercise them:

Rights for Users in the European Economic Area (EEA), United Kingdom, and Equivalent Jurisdictions (GDPR Rights)

If you are located in the EEA, UK, or a country with similar laws, you have the following rights under the General Data Protection Regulation (GDPR) and applicable local legislation:

To exercise any of the above rights, please contact us (see Contact Us at the end of this Policy). For security and identity verification, we may ask you to provide certain information or follow a verification procedure (especially for sensitive requests like access or deletion) to confirm that you are the account holder or data subject in question. This is to ensure we do not provide or delete data improperly at someone else’s request.

Response Time: We will respond to your valid GDPR-related requests without undue delay, and at the latest within one month of receiving the request. If your request is complex or if we have received many requests, we are allowed to extend this period by an additional two months. If we need such an extension, we will notify you within the first month and explain the reason for the delay. Rest assured, we take your rights seriously and will work to address your concerns as quickly as possible.

Some restrictions apply to these rights. For example, if fulfilling your request would adversely affect the rights and freedoms of others (such as privacy or intellectual property rights of others), we may not be able to fully comply. Also, certain data may be exempt from access, correction, or deletion requests under local law (e.g., if it was processed solely for journalistic or research purposes, or if retention is required by law). We will inform you if we cannot fulfill a request due to an exemption.

Rights for California Residents (CCPA/CPRA)

If you are a resident of California, you have specific privacy rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These rights are designed to give California consumers greater visibility into and control over their personal information. The rights include:

Exercising California Rights: If you are a California resident and want to exercise your Right to Know, Delete, or Correct, you (or your authorized agent) can submit a verifiable consumer request to us by contacting our support (see Contact Us). Please indicate that you are a California consumer making a CCPA/CPRA request, and specify which right you seek to exercise. We will need to verify your identity to a reasonable degree of certainty before fulfilling the request. This might involve matching information you provide in the request with information we have on file. For sensitive requests (like obtaining specific pieces of info or deletion), we may require additional verification such as a signed declaration under penalty of perjury that you are the consumer whose personal info is the subject of the request.

If you have an authorized agent (such as someone with power of attorney or a company you have formally authorized) submit a request on your behalf, we will require proof of the agent’s identity and authorization. For example, the agent should provide a signed permission from you or proof of legal authority, and we may still ask you to verify your identity directly with us or confirm that you provided the agent permission. This is to prevent fraud.

We aim to respond to California consumer requests within 45 days of receipt. If necessary, we can take an extension of another 45 days (for a total of 90 days), but if so we will inform you of the reason and extension in writing within the initial 45-day period. If we cannot comply with a request, we will explain the reasons (e.g., we could not verify your identity, or the data falls under an exemption).

For the Right to Know, our response will either provide the requested information or refer you to the sections of this Policy that contain that information (as permitted by CCPA). For specific pieces of information requests, we will provide that data via a secure method. For deletion requests, we will confirm once the data is deleted (or if an exception applies, we’ll let you know what was kept and why). For correction requests, we will confirm the data is corrected or if we cannot fulfill it (with explanation).

We do not charge a fee for processing your verifiable consumer requests, unless they are excessive, repetitive, or manifestly unfounded (in which case we may decline or charge as allowed by law, but we have no intention to do so under normal circumstances).

Additionally, California’s “Shine the Light” law (Civil Code §1798.83) allows residents to ask companies once a year what personal information they have shared with third parties for those third parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing without your consent. Therefore, we believe we are in compliance with this requirement. If you still wish to make a Shine the Light inquiry, you can contact us and we will respond as required.

Other US State Privacy Rights

Several other U.S. states (such as Virginia, Colorado, Connecticut, and Utah) have passed privacy laws that confer rights similar to, and in some cases extending beyond, the CCPA. If you are a resident of these states (effective from their respective dates), you may have the following rights (which largely overlap with what we’ve described above):

MagicApp’s practices are generally aligned with these rights. We do not sell personal data. We do use personal data for targeted advertising in our App, but we provide opt-outs (via device settings or in-app prompts) similar to those laws’ requirements. If you wish to exercise any of these state-specific rights, please contact us with your request, specifying your state of residence. We will verify and respond consistent with the applicable law’s requirements. Notably, Virginia and some other states allow an appeal if you are dissatisfied with our decision regarding your request – if that happens, we will inform you of how to appeal.

We treat privacy seriously for all users. Even if you are not in a jurisdiction with specific privacy laws, we strive to provide you with control over your data wherever feasible. For instance, any user can contact us to request deletion of their account or data, and we will honor it in line with our retention policy and legal obligations. We also allow anyone to unsubscribe from marketing and to control certain tracking.

Data Security and Breach Response

We take the security of your Personal Information very seriously. We have implemented a combination of administrative, technical, and physical safeguards designed to protect your data from unauthorized access, disclosure, loss, misuse, or alteration. These measures are in line with industry standards and are regularly reviewed and updated to address new threats.

Security Measures: Some of the key security practices we follow include:

Despite all these measures, it’s important to note that no system is 100% secure. The transmission of information via the internet is not completely without risk; there is always a possibility of a security breach or some unauthorized access. We strive to protect your Personal Information, but we cannot guarantee its absolute security. You should also play a part in protecting your data by keeping your account credentials confidential and notifying us if you suspect any unauthorized use of your account.

Breach Response: In the unlikely event of a data breach that affects your Personal Information, we have a breach response plan in place. This plan includes:

We also comply with any industry-specific or region-specific regulations concerning data security. For example, if MagicApp is subject to California’s requirements, we implement reasonable security measures appropriate to the nature of the information (California law requires businesses to use reasonable security for personal data). Similarly, we adhere to standards under Canada’s PIPEDA or Australia’s Notifiable Data Breaches scheme if applicable.

In summary, we employ strong safeguards to protect your data and have policies and procedures to deal with any security incident in an effective and transparent manner.

Children’s Privacy

MagicApp is not intended for children under the age of 13. We do not knowingly collect personal information from anyone under 13 years old. If you are under 13, please do not use the App or provide any information about yourself (such as your name, address, or email). If we discover that we have inadvertently collected personal information from a child under 13 without proper consent, we will delete that information as quickly as possible.

For residents in the European Union or other countries with stricter age limits: our App is generally not intended for anyone under the age at which consent for data processing is required in your jurisdiction. In most EU countries, that age is 16 (unless a member state has set a lower age, which can be no lower than 13). We do not knowingly collect data from children under 16 in the EU without parental consent. For example, if we become aware that a 14-year-old from an EU country has signed up without a parent’s consent, we will take steps to remove their data.

If you are a parent or legal guardian and you believe that your child under the applicable age has provided us with personal information, please contact us immediately. We will take steps to verify your identity as the parent/guardian and then will help you to exercise any rights on behalf of your child. This may include deleting the child’s personal information from our records (unless an exemption applies) and terminating the child’s account.

Changes to This Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. If we make changes, we will post the updated Policy on this page with a new “Last updated” date. We encourage you to periodically review this Privacy Policy to stay informed about our data practices and any updates. It’s important that you understand how your information is handled.

If you continue to use the MagicApp after a revised Privacy Policy has been posted and become effective, that means you accept the revisions. Of course, if you do not agree with any changes, you should stop using the App and may request that we delete your data.

In summary: your use of the App following the posting of an updated Privacy Policy constitutes your acceptance of those changes, to the extent permitted by law. If required by law (for example, if any change requires fresh consent), we will obtain your consent.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your Personal Information, please feel free to reach out to us:

Applyft Ltd

Parnithos, 9 Flat/Office A

Germasogeia, 4040, Limassol, Cyprus

Email: support@magicapp.co

We will do our best to respond promptly to your inquiry. For privacy-specific requests (exercise of rights, etc.), it may be helpful to put “Privacy Request” in the subject line of your email and indicate the nature of your request (e.g., “Access Request” or “CCPA Deletion Request”).

If you prefer to contact us by mail, please address your correspondence to the mailing address above. Keep in mind that postal communications may take longer than email.

Thank you for reading our Privacy Policy. We value your trust and are dedicated to protecting your personal information while providing a useful and enjoyable app experience.