Privacy Policy
Effective July 22, 2026 · Updated October 1, 2026 · Questions: support@magiecrm.com
The short version
- Your CRM data belongs to you. We store it to run your CRM — nothing else.
- We don't sell data. We don't run ads. We don't let anyone train AI models on your data.
- If you connect Gmail or Google Calendar, we can only send what you approve and create events you asked for. We cannot read your inbox.
- You can export everything to a spreadsheet anytime — including after you cancel — and ask us to delete it all.
Who we are
MagieCRM ("MagieCRM," "we," "us") provides a CRM service for small businesses at magiecrm.com and app.magiecrm.com (the "Service"). This policy explains what information we handle and how. It's written to be read; if anything is unclear, email support@magiecrm.com and a person will answer.
Two kinds of data
A CRM holds two different things, and we treat them differently:
Your account data — what we know about you: your name, email address, business name, login credentials (stored by Firebase Authentication; we never see your password), billing status, and support conversations. We're the "controller" of this data.
Your customer data — what you store about your customers and work: contacts, jobs, notes, files, form responses, emails, invoices. This is yours. We process it only on your instructions, to provide the Service. You're responsible for having the right to store it, and for how you use it (for example, having consent to email or text your customers).
What we collect
- Account information — name, email, business name, and what you tell Magie about your business during setup.
- Content you add — records, fields, notes, photos you snap, files you upload, emails you forward to your CRM's ingest address, form submissions from your public forms, and signatures collected on those forms.
- Billing information — handled by Stripe. You enter a card when you start the free trial, on Stripe's checkout page. Card numbers go directly to Stripe and never touch our servers. We store your subscription status, Stripe's reference IDs, and the record that you agreed to the terms at checkout.
- A record that your business used its trial — each business gets one free trial, so we keep a record that a business used its trial: your account and workspace IDs, the email you sign in with, its domain when it's a company address rather than a personal one like Gmail, and from Stripe the card type (credit, debit or prepaid) and a card fingerprint, not the card number. If another account later matches the record, we add that account's workspace ID to it. We keep this record after an account is deleted, only to stop repeat trials.
- Usage and log data — standard technical logs (IP address, browser type, timestamps, error reports) used for security and to keep the Service working.
On the marketing site at magiecrm.com we count visits ourselves. When a page loads, and when you click a sign-up button, your browser tells our own server which page it was, which website or link brought you there (just the site's name, like google.com, plus any campaign or referral tag in the link), and which button you clicked. We add those to daily totals. We don't set cookies, don't store your IP address or browser details with those counts, don't build a profile of you, and don't use any third-party analytics or advertising trackers. The site loads fonts from Google Fonts, which means Google receives your IP address when the page loads.
If you arrived through a link with a campaign or referral tag, the sign-up button passes that tag along, and it's saved with your new account so we know which link brought you.
How we use it
- To run your CRM — store, display, back up, and export your data.
- To do the "reading and typing": when you snap a photo, forward an email, or ask Magie for a change, the content is processed by an AI model to extract fields, draft the change, and show it to you for approval.
- To send the messages you set up — invoice emails, form notifications, automations you approved.
- To bill you, support you, and tell you about important changes to the Service. Billing notices include the email when your trial starts, the reminder a few days before your trial ends and your card is charged, and notes about a failed payment or a plan ending. They go to the account owner, and since they're about your bill, they don't have an unsubscribe link.
- To send a few plain emails from Ahron in your first weeks: help getting set up, a reminder if you signed up but haven't started your trial, an offer of a short setup call, and later, a request to refer someone. Every one has a link to turn them off.
- To keep the Service secure and debug problems.
What we don't do: we don't sell your data, rent it, use it for advertising, or use your data — account or customer — to train AI models. Our AI provider (Anthropic) is contractually barred from training models on the data we send it.
If you connect Google (Gmail or Calendar)
Connecting Google is optional. If you do, we request the narrowest scopes that make the feature work:
- Send email (gmail.send) — lets MagieCRM send email from your address when you write or approve a message in your CRM. This scope cannot read, browse, or search your inbox.
- Calendar events (calendar.events) — lets MagieCRM create and update events for bookings and meetings you schedule through the CRM.
- Your email address (userinfo.email) — so we can show you which account is connected.
Your Google tokens are encrypted (AES-256-GCM) and stored in a server-only location that client code cannot read. You can disconnect at any time in Settings → Integrations, or revoke access from your Google Account permissions page, and we delete the stored tokens.
MagieCRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Google user data is used only to provide the features described above — never for advertising, never sold, never used to train generalized AI models, and never read by a human except with your permission, for security purposes, or where the law requires it.
Who else touches the data (subprocessors)
We use a small set of service providers to run MagieCRM. Each receives only what it needs to do its job:
| Provider | What for |
|---|---|
| Google Cloud / Firebase | Hosting, database, file storage, and login (data stored in the United States) |
| Anthropic | AI processing — the reading, extracting, and drafting. No model training on your data. |
| Stripe | Subscription billing, and invoicing/payments if you connect your own Stripe account |
| Square | Payments, only if you connect your own Square account |
| Twilio SendGrid | Delivering email your CRM sends and receiving email you forward to it |
| Twilio | Text messages, only if you connect a business phone number |
| Gmail sending and Calendar events, only if you connect Google |
We may disclose data if the law genuinely requires it, or to protect the Service from abuse. We'll tell you when we're allowed to.
Security
Data is encrypted in transit (TLS) and at rest. Each business's data is walled off at the database level — access rules are enforced on the server, not just in the app. OAuth tokens and payment-provider credentials are additionally encrypted at the application layer. No system is perfectly secure, but if we learn of a breach affecting your data, we will notify you without undue delay.
Retention, export, and deletion
- While you're a customer: we keep your data so your CRM works.
- Export: you can export all your records to spreadsheets in one click at any time, including while the account is read-only after you cancel.
- When a plan ends, or the first charge after a trial fails: the account turns read-only. Your data stays viewable and exportable for 90 days from that day, then we may delete it. Ask sooner and we'll delete it sooner.
- On request: email support@magiecrm.com and we'll delete your account and its data within 30 days, except records we're legally required to keep (like billing history) and the trial record described above.
Deleting your data
To delete everything we hold about you or your business, email admin@magiecrm.com from the address on your account, or delete the workspace yourself from Settings → Billing. We remove the account and its data within 30 days, except records we're legally required to keep (like billing history). If you connected Facebook or Instagram lead forms, disconnecting them under Settings → Lead sources deletes the stored page tokens right away.
Your rights
Wherever you are, you can ask us what we hold about you, correct it, export it, or delete it — email support@magiecrm.com. If you're in a place with specific privacy laws (like the EU/UK GDPR or the California CCPA), those rights apply and we honor them; we don't "sell" or "share" personal information as those laws define it. If your customers contact us about data you've stored in your CRM, we'll refer them to you, since it's your data.
Children
MagieCRM is a business tool, not directed to children, and we don't knowingly collect personal information from anyone under 16.
Changes
If we change this policy, we'll update the date at the top. If the change is material, we'll email you before it takes effect. We won't quietly get worse.
Contact
support@magiecrm.com — a person reads it.