Privacy Policy
Effective July 22, 2026 · Questions: support@magiecrm.com
The short version
- Your CRM data belongs to you. We store it to run your CRM — nothing else.
- We don't sell data. We don't run ads. We don't let anyone train AI models on your data.
- If you connect Gmail or Google Calendar, we can only send what you approve and create events you asked for. We cannot read your inbox.
- You can export everything to a spreadsheet anytime — including after you cancel — and ask us to delete it all.
Who we are
MagieCRM ("MagieCRM," "we," "us") provides a CRM service for small businesses at magiecrm.com and app.magiecrm.com (the "Service"). This policy explains what information we handle and how. It's written to be read; if anything is unclear, email support@magiecrm.com and a person will answer.
Two kinds of data
A CRM holds two different things, and we treat them differently:
Your account data — what we know about you: your name, email address, business name, login credentials (stored by Firebase Authentication; we never see your password), billing status, and support conversations. We're the "controller" of this data.
Your customer data — what you store about your customers and work: contacts, jobs, notes, files, form responses, emails, invoices. This is yours. We process it only on your instructions, to provide the Service. You're responsible for having the right to store it, and for how you use it (for example, having consent to email or text your customers).
What we collect
- Account information — name, email, business name, and what you tell Magie about your business during setup.
- Content you add — records, fields, notes, photos you snap, files you upload, emails you forward to your CRM's ingest address, form submissions from your public forms, and signatures collected on those forms.
- Billing information — handled by Stripe. Card numbers go directly to Stripe and never touch our servers. We store only your subscription status and Stripe's reference IDs.
- Usage and log data — standard technical logs (IP address, browser type, timestamps, error reports) used for security and to keep the Service working.
The marketing site at magiecrm.com does not use advertising trackers or third-party analytics cookies. It loads fonts from Google Fonts, which means Google receives your IP address when the page loads.
How we use it
- To run your CRM — store, display, back up, and export your data.
- To do the "reading and typing": when you snap a photo, forward an email, or ask Magie for a change, the content is processed by an AI model to extract fields, draft the change, and show it to you for approval.
- To send the messages you set up — invoice emails, form notifications, automations you approved.
- To bill you, support you, and tell you about important changes to the Service.
- To keep the Service secure and debug problems.
What we don't do: we don't sell your data, rent it, use it for advertising, or use your data — account or customer — to train AI models. Our AI provider (Anthropic) is contractually barred from training models on the data we send it.
If you connect Google (Gmail or Calendar)
Connecting Google is optional. If you do, we request the narrowest scopes that make the feature work:
- Send email (gmail.send) — lets MagieCRM send email from your address when you write or approve a message in your CRM. This scope cannot read, browse, or search your inbox.
- Calendar events (calendar.events) — lets MagieCRM create and update events for bookings and meetings you schedule through the CRM.
- Your email address (userinfo.email) — so we can show you which account is connected.
Your Google tokens are encrypted (AES-256-GCM) and stored in a server-only location that client code cannot read. You can disconnect at any time in Settings → Integrations, or revoke access from your Google Account permissions page, and we delete the stored tokens.
MagieCRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Google user data is used only to provide the features described above — never for advertising, never sold, never used to train generalized AI models, and never read by a human except with your permission, for security purposes, or where the law requires it.
Who else touches the data (subprocessors)
We use a small set of service providers to run MagieCRM. Each receives only what it needs to do its job:
| Provider | What for |
|---|---|
| Google Cloud / Firebase | Hosting, database, file storage, and login (data stored in the United States) |
| Anthropic | AI processing — the reading, extracting, and drafting. No model training on your data. |
| Stripe | Subscription billing, and invoicing/payments if you connect your own Stripe account |
| Square | Payments, only if you connect your own Square account |
| Twilio SendGrid | Delivering email your CRM sends and receiving email you forward to it |
| Twilio | Text messages, only if you connect a business phone number |
| Gmail sending and Calendar events, only if you connect Google |
We may disclose data if the law genuinely requires it, or to protect the Service from abuse. We'll tell you when we're allowed to.
Security
Data is encrypted in transit (TLS) and at rest. Each business's data is walled off at the database level — access rules are enforced on the server, not just in the app. OAuth tokens and payment-provider credentials are additionally encrypted at the application layer. No system is perfectly secure, but if we learn of a breach affecting your data, we will notify you without undue delay.
Retention, export, and deletion
- While you're a customer: we keep your data so your CRM works.
- Export: you can export all your records to spreadsheets in one click, on any plan, at any time — including after you cancel.
- After you cancel: your data stays exportable for 90 days, then we may delete it. Ask sooner and we'll delete it sooner.
- On request: email support@magiecrm.com and we'll delete your account and its data within 30 days, except records we're legally required to keep (like billing history).
Your rights
Wherever you are, you can ask us what we hold about you, correct it, export it, or delete it — email support@magiecrm.com. If you're in a place with specific privacy laws (like the EU/UK GDPR or the California CCPA), those rights apply and we honor them; we don't "sell" or "share" personal information as those laws define it. If your customers contact us about data you've stored in your CRM, we'll refer them to you, since it's your data.
Children
MagieCRM is a business tool, not directed to children, and we don't knowingly collect personal information from anyone under 16.
Changes
If we change this policy, we'll update the date at the top. If the change is material, we'll email you before it takes effect. We won't quietly get worse.
Contact
support@magiecrm.com — a person reads it.