Notice to California Residents
This notice supplements our Privacy Notice for California residents, and uses the terms defined in the California Consumer Privacy Act as amended by the CPRA.
On this page 12 sections
Who this covers
This applies if you are a California resident. It covers personal information we handle as a business, your account, your billing details, what you send us through the website.
It does not cover business data a customer puts into their own Magemcy workspace. For that we act as a service provider, and the customer is the business you should ask. If your details are in a company’s private vendor registry, tell us and we will point you to them.
What we collect
In the last twelve months we have collected these statutory categories:
| Category | Collected? | Examples |
|---|---|---|
| Identifiers | Yes | Name, email address, account identifier, IP address |
| Customer records (Civ. Code § 1798.80) | Yes | Company name, business phone, business address |
| Protected classifications | No | - |
| Commercial information | Yes | Subscription and plan, billing history held by our payment processor |
| Biometric information | No | - |
| Internet or network activity | Yes | Pages you visited on our site, browser and device, referring page |
| Geolocation data | Yes (approximate) | City or region inferred from IP address. We do not collect precise location |
| Sensory data | No | - |
| Professional or employment information | Yes | Job title or role where you give it, your role in a workspace |
| Education information | No | - |
| Inferences | No | We do not build profiles or make inferences about you |
| Sensitive personal information | Limited | Account credentials, handled by our authentication provider. See below |
Where it comes from
- Directly from you, when you sign up, register as a vendor, contact us, or use the website assistant.
- Automatically, from your device and browser when you use the site.
- From our customers, if a business adds you to their vendor registry.
- From service providers, our payment processor confirms a subscription; our email provider reports delivery.
Why we use it
To provide and secure the service, take payment, answer you, prevent fraud and abuse, comply with the law, and understand in aggregate how the product is used. The full basis-by-basis table is in our Privacy Notice. We do not use it for cross-context behavioural advertising or to build profiles.
Who receives it
We disclose personal information to service providers for a business purpose, hosting, database, email delivery, payments and AI processing. Each is listed on subprocessors, and each is bound by contract to use it only to perform services for us.
Sale and sharing
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. We do not sell or share the personal information of anyone under 16.
Because there is nothing to opt out of, the “Do Not Sell or Share” right has no practical effect here. We still publish Your Privacy Choices and still honour Global Privacy Control signals, so your preference is recorded and respected regardless.
Sensitive personal information
The only sensitive personal information involved is your account credential, which is held and verified by our authentication provider, we never see your password. We use it solely to sign you in and secure your account, which is one of the permitted purposes under § 1798.121(a), so the right to limit its use does not apply. We do not use or disclose sensitive personal information to infer characteristics about you.
Retention
We keep each category only as long as needed for the purpose we collected it. Specific periods, including 24 months for website enquiries and 30 days for assistant conversations, are listed in our Privacy Notice and enforced automatically.
Your rights
- Know: what we collect, why, where it came from, and who receives it.
- Access: a copy of the specific pieces we hold about you.
- Delete: subject to exceptions such as completing a transaction or meeting a legal obligation.
- Correct: anything inaccurate.
- Opt out of sale or sharing, we do neither, but the mechanism exists.
- Limit use of sensitive personal information, as above, not applicable.
- Non-discrimination: we will not deny service, change prices or degrade quality because you exercised a right. We offer no financial incentives for your data.
- Appeal: if we refuse, you can ask us to reconsider.
How to exercise them
Use Your Privacy Choices, or email our privacy contact.
We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 where we tell you why. We will verify your identity before acting, usually by confirming control of the email address on the account, and asking for more only where the request is higher-risk.
Some things you can do immediately without asking anyone: export your data or delete your account from Settings, and delete a website chat from inside the chat.
Authorised agents
An agent may submit a request for you with written permission signed by you. We may still contact you to confirm it, and to verify your identity directly.
Request metrics
Businesses handling the personal information of 10 million or more California residents in a calendar year must publish request statistics. We are well below that threshold, so we do not publish metrics. If that changes, this section will change with it.
Questions about this policy?
A person reads every message. Get in touch and we’ll answer. Or ask Gero, our AI assistant, to walk you through what this page says - the answers explain, they don’t bind.