Privacy Policy

01Overview

MagicWorks IT Solutions Private Limited ("MagicFlow AI", "we", "us", or "our"), operating the MagicFlow AI service at https://www.magicflowai.io/, is committed to protecting your personal data and respecting your privacy. This Privacy Policy describes how we collect, use, store, disclose, and protect personal data, and your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian laws.

Effective Date: 17th June 2026 | Last Updated: 17th June 2026

By using our website or the Service, you acknowledge that you have read and understood this Privacy Policy.

02Scope and Application

This Privacy Policy applies to:

• Visitors to our website at https://www.magicflowai.io/
• Customers who subscribe to and use the MagicFlow AI service
• Prospective customers who interact with our sales, marketing, or support teams
• Partners enrolled in our Agency, Affiliate, or Brand Ambassador programmes

This Privacy Policy does NOT cover personal data of End Users (visitors to our Customers' websites) collected through the MagicFlow AI chatbot. For that data, our Customer is the Data Fiduciary under the DPDP Act, and we act as a Data Processor. The Customer's own privacy policy governs that data, and our role is set out in our Data Processing Agreement at https://www.magicflowai.io/dpa.

03Identity and Contact Details of the Data Fiduciary

For the purposes of the DPDP Act, the Data Fiduciary for personal data we collect about you is:

• MagicWorks IT Solutions Private Limited
• Registered Office: 201, Vasant Bahawa, Survey No. 20, Near La Valle Casa, Bavdhan, Pune, Maharashtra 411021, India
• CIN: U72200PN2012PTC144846
• GSTIN: 27AAICM2623C1Z
• Email: support@magicflowai.io
• Phone: +91 8806430505

04Data Protection Officer

In accordance with the DPDP Act, we have designated a Data Protection Officer who is responsible for overseeing our compliance with this Privacy Policy and the DPDP Act:

• Data Protection Officer: Mr. Mohan Chute
• Email: info@magicflowai.io
• Postal address: 201, Vasant Bahawa, Survey No. 20, Near La Valle Casa, Bavdhan, Pune, Maharashtra 411021, India

05Grievance Officer

Per the DPDP Act and the IT Rules 2011, we have appointed a Grievance Officer to address concerns or complaints about how we handle your personal data:

• Grievance Officer: Mr. Sudhir Dixit
• Email: grievance@magicflowai.io
• Postal address: 201, Vasant Bahawa, Survey No. 20, Near La Valle Casa, Bavdhan, Pune, Maharashtra 411021, India

We will acknowledge your grievance within seven (7) days of receipt and resolve it within thirty (30) days, in accordance with the IT Rules 2011.

06What Personal Data We Collect

Personal data you provide to us:

• Account information: name, work email address, company name, designation, phone number, password (hashed).
• Billing information: billing name, billing address, GSTIN (for tax invoicing). Card details are NOT stored by us; they are processed and stored by Razorpay.
• Communications: support tickets, emails, chat messages, feedback submissions.
• Marketing preferences: subscription status for newsletters, webinars, product updates.
• Partner programme data: applications, performance data, commission information.

Personal data collected automatically:

• Device and browser information: IP address, browser type, operating system, device type, screen resolution.
• Usage data: pages visited, features used, time spent, clicks, navigation patterns.
• Log data: server logs, error logs, security logs.
• Cookies and similar technologies: see our Cookie Policy at https://www.magicflowai.io/cookie-policy.

Personal data from third parties:

• Social media login providers (if used): name, email, profile picture.
• Payment processor: payment confirmation, transaction reference (no card data).
• Analytics tools (e.g., Google Analytics, Microsoft Clarity, and similar platforms): aggregated and individual usage data.

Most personal data we collect is general personal data. We do not intentionally collect data relating to children. We do not collect sensitive personal data unless absolutely necessary and with explicit consent.

07Why We Process Your Personal Data

Under the DPDP Act, we process personal data only when we have a lawful basis:

• Providing the Service (account creation, authentication, feature access): Account info, usage data — Lawful basis: Performance of contract.
• Processing payments and issuing invoices: Billing info, GSTIN — Lawful basis: Performance of contract; Legal compliance (GST law).
• Customer support: Communications, account info, usage data — Lawful basis: Performance of contract; Legitimate interest.
• Service improvement and analytics: Usage data, device info — Lawful basis: Legitimate interest.
• Marketing communications (where you have opted in): Email, name, marketing preferences — Lawful basis: Consent.
• Fraud prevention and security: Log data, device info, usage data — Lawful basis: Legitimate interest; Legal compliance.
• Legal and regulatory compliance: All categories as required — Lawful basis: Legal compliance.
• Partner programme administration: Partner application data, commission data — Lawful basis: Performance of contract.

08How We Use Your Personal Data

We use your personal data to:

• Create, maintain, and authenticate your Account.
• Provide the Service, including features you purchased.
• Process payments, issue invoices, and provide tax documents.
• Respond to support requests and provide customer service.
• Send service announcements, updates, and security alerts (these are not optional marketing communications).
• Send marketing communications where you have opted in (you can opt out at any time).
• Analyse Service usage to improve features, performance, and user experience.
• Detect, prevent, and respond to fraud, abuse, security threats, and illegal activity.
• Comply with our legal obligations, including under the DPDP Act, IT Act, GST law, and tax laws.
• Enforce our Terms of Use, Acceptable Use Policy, and other agreements.
• Administer our Partner Programmes (Agency, Affiliate, Brand Ambassador).

09Sharing and Disclosure of Personal Data

With sub-processors: We engage trusted third-party service providers to support our Service. These sub-processors process personal data only on our instructions and under written contracts ensuring appropriate data protection. Our current sub-processors include:

• Google Cloud Platform: Application infrastructure, AI processing — Account data, usage data, logs.
• Vercel: Frontend application hosting, edge delivery — Limited account data, page-view data.
• MongoDB Atlas: Database — Account data, application data.
• Razorpay Software Pvt. Ltd.: Payment processing — Billing info, payment details (India).
• Email service provider (e.g., Amazon SES, Brevo): Marketing and transactional emails — Email, name, marketing preferences.
• Analytics providers (e.g., Google Analytics, Microsoft Clarity): Usage analytics — Anonymised/aggregated usage data.
• Customer support platform (e.g., HubSpot, Zoho Desk): Support ticketing — Communications, account info.

The above list is indicative and not exhaustive. We may also use other similar platforms for the purposes described, including additional or alternative providers not specifically listed here. As our product evolves and new capabilities are added, our list of service providers may change. Material changes will be reflected through updates to this Privacy Policy.

With Indian authorities: We may disclose your personal data to government, regulatory, or law enforcement authorities when legally required. Where legally permitted, we will notify you before disclosure.

In business transactions: If MagicWorks IT Solutions Pvt. Ltd. or the MagicFlow AI business is involved in a merger, acquisition, or sale of assets, personal data may be transferred. The acquiring entity will be bound by this Privacy Policy or will offer materially equivalent protection. We will notify you of any such transfer.

With your consent: We may disclose personal data to third parties for purposes not described above when you have given us your explicit consent.

We never sell your personal data to third parties for monetary consideration.

10Data Storage Location and International Transfers

Our infrastructure is primarily provided by Razorpay, Google Cloud Platform, Vercel, and MongoDB. The specific data centre regions used by these providers are determined by the providers themselves and may include India or other countries. Payments processed by Razorpay are handled within India.

Some incidental processing may occur outside India where required for the functioning of underlying services (for example, AI model inference, edge caching, or third-party tools). Under the DPDP Act 2023, cross-border transfers of personal data are permitted except to countries specifically restricted by the Central Government. As of the effective date of this Privacy Policy, no specific country restrictions have been notified that affect our transfers. We will update this Policy if such restrictions are imposed.

Where data crosses borders, we apply appropriate safeguards including contractual data protection commitments from our sub-processors, security measures, and access controls.

11Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements:

• Account information (while account is active): Duration of Subscription.
• Account information (after account closure): 30 days for data export, then 90 days in soft-delete; permanent deletion thereafter unless legal hold applies.
• Billing and tax records: 8 years (per Indian GST law and Income Tax Act).
• Support communications: 3 years from last interaction.
• Marketing data (where you have opted out): Suppression list maintained indefinitely to honour opt-out.
• Server and security logs: 12 months.
• Analytics data (aggregated): 24 months.
• Backup data: 30 days, then deleted in line with backup rotation.

After the retention period expires, personal data is either deleted permanently or anonymised so that it can no longer be associated with you.

12Your Rights Under the DPDP Act

The DPDP Act 2023 gives you, as a Data Principal, the following rights:

Right to access information: You have the right to receive a summary of the personal data we process about you, the processing activities undertaken, and the identities of any sub-processors with whom we have shared your personal data.

Right to correction and erasure: You have the right to request correction of inaccurate or misleading personal data, completion of incomplete data, updating of out-of-date data, and erasure of personal data that is no longer necessary for the purpose for which it was processed (subject to legal retention requirements).

Right to grievance redressal: You have the right to a readily available means of grievance redressal. You can contact our Grievance Officer at grievance@magicflowai.io. If unsatisfied with our response, you have the right to escalate to the Data Protection Board of India.

Right to nominate: You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.

Right to withdraw consent: Where we process your personal data on the basis of consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

How to exercise your rights: Contact our Data Protection Officer at info@magicflowai.io with the subject line "DPDP Data Principal Request". We will acknowledge your request within seven (7) days, verify your identity, respond within thirty (30) days, and provide our response free of charge for the first request in any twelve-month period.

13Children's Privacy

The Service is intended for businesses and is not directed at children under the age of eighteen (18). Under the DPDP Act, we may not process personal data of children except with the verifiable consent of a parent or lawful guardian, and we may not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

We do not knowingly collect personal data from children. If we discover that we have inadvertently collected such data, we will delete it promptly. If you believe we have collected personal data of a child, please contact our DPO at info@magicflowai.io.

14Security Measures

We implement reasonable security practices and procedures in accordance with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and industry standards. Our measures include:

• Reliance on the security controls of our infrastructure providers, including encryption in transit and at rest, with periodic review of provider security practices.
• Access controls and the principle of least privilege.
• Regular security audits and vulnerability assessments.
• Employee training on data protection.
• Secure software development practices.
• Incident response procedures.
• Sub-processor due diligence and contractual safeguards.

Despite our best efforts, no system is completely secure. If we become aware of a personal data breach, we will notify affected Data Principals and the Data Protection Board of India in accordance with the DPDP Act and applicable regulations.

15Cookies and Similar Technologies

We use cookies and similar tracking technologies on our website. For full details, please see our Cookie Policy at https://www.magicflowai.io/cookie-policy.

16Third-Party Links

Our website may contain links to third-party websites, services, and resources. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing personal data.

17Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. The most current version will always be available at https://www.magicflowai.io/privacy-policy. We will notify you of material changes by email or through the Service at least thirty (30) days before they take effect.

18How to Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data:

• Data Protection Officer: Mr. Mohan Chute | info@magicflowai.io
• Grievance Officer: Mr. Sudhir Dixit | grievance@magicflowai.io
• Postal address: MagicWorks IT Solutions Pvt. Ltd., 201, Vasant Bahawa, Survey No. 20, Near La Valle Casa, Bavdhan, Pune, Maharashtra 411021, India
• Phone: +91 8806430505