Privacy Policy
Last updated 5 September 2026
Who we are
Magic Agent (“we”) is operated by Magic Webs Technologies Pvt Ltd, Office No. 705, ABC Tower-1, Sector 135, Noida, Uttar Pradesh 201305, India. For anything in this policy, write to privacy@magicwebs.ai.
Magic Agent is a business tool. Our customer is the business that opens a workspace. Where that business uses Magic Agent to talk to its own customers, the business is the data controller for those conversations and we are its processor, acting on its instructions.
What the mobile app collects
The Android app is an operator console. It shows a business its own workspace; it does not collect anything about the people using it beyond what is needed to sign in and to notify them.
| Workspace credentials | A workspace name and password, exchanged for a session token held in the device's secure storage. Passwords are never stored in readable form — only a PBKDF2-SHA256 hash, on the server. |
| Push token | An Expo push token, the platform (Android or iOS) and the device name, so new orders and escalations can be delivered to the right device. Deleted when the device is unregistered or the install is gone. |
| Questions you ask an agent | The operator chat on the agent screen is stored against your workspace so the thread is there next time. You can delete it from the app at any time. |
The app contains no analytics SDK, no advertising SDK and no third-party tracker. It does not request location, contacts, camera, microphone or storage access.
What the platform stores for a workspace
Entered by the business, or produced by conversations it has with its own customers:
| Business profile | Company name, description, industry, website, support email and phone, address, locale and currency. Read by the agents so their answers are accurate. |
| Contacts | Name, phone number, email and company of the people a workspace's agents talk to, plus a channel identifier such as a WhatsApp number. |
| Conversations and messages | The transcript of each conversation, which agent answered, and whether it was escalated to a person. |
| Orders | Order lines, quantities, specifications, customer contact details and totals recorded by an agent. |
| Knowledge base | Documents a workspace uploads, and the vector embeddings computed from them so agents can search their own material. |
| Usage records | Model, token counts and cost per call, so a workspace can see what it is spending. No message content. |
Who else processes it
We use these sub-processors. Each receives only what its function requires.
| Convex | Database, file storage and server functions. All workspace data is held here. |
| Vercel AI Gateway | Routes model calls. Message text and the retrieved context are sent for the model to answer. |
| Model providers via that gateway | DeepSeek for chat, OpenAI for embeddings and voice-note transcription, Fish Audio for spoken greetings. |
| Expo push service, then Google FCM and Apple APNs | Delivers notifications. Receives the push token and the notification's title and body — for example an order number or a contact's name. |
| Meta (WhatsApp Business Platform) | Carries WhatsApp messages, where a workspace has connected a number. |
We do not sell personal data and we do not share it for advertising.
How long it is kept
Workspace data is kept for as long as the workspace exists. Delete a workspace and its conversations, contacts, orders, knowledge base and files are deleted with it. Session tokens expire on their own. Aggregate usage and cost records may be retained for billing and accounting for 8 years.
Your rights
Depending on where you live, you may have the right to access, correct, export or erase your personal data, and to object to or restrict its processing. Write to privacy@magicwebs.ai and we will respond within 30 days.
If you are one of a business's customers rather than our customer, contact that business first — it controls the conversation and we act on its instructions. We will help it respond.
To delete an account and its data, see Delete your account.
Security
Data is encrypted in transit. Passwords are hashed with PBKDF2-SHA256 and are never recoverable. Sessions are opaque tokens that can be revoked immediately, and every workspace can only reach its own data — enforced on the server, on every request.
Children
Magic Agent is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
If this policy changes materially we will update the date above and, where the change affects you, tell you in the app or by email.
Governing law
This policy is governed by the laws of India.