Privacy Policy

1. Introduction

This Privacy Policy explains how Magicdraft ("we," "us," "our"), operated by Arcane Digital Limited, collects, uses, stores, and protects your personal data when you use our website at magicdraft.io and related services (the "Service"). We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR), the Hong Kong Personal Data (Privacy) Ordinance (PDPO), and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

3. Data We Collect

3.1 Account Information

• Full name
• Email address
• Password (stored in hashed form)
• Company or website name (optional)

3.2 Payment Information

• Payment card type and last four digits
• Billing address
• Transaction history

Payment details are collected and processed directly by our payment processor, Airwallex. We do not store your full card number, CVV, or other sensitive payment data on our servers.

3.3 WordPress Connection Data

• WordPress site URL
• Application password (encrypted at rest)

3.4 Usage Data

• Pages visited and features used
• Articles generated and published
• Content gap analysis results
• IP address, browser type, device type, and operating system
• Referring URL and session duration

3.5 Content Data

• Reference articles you provide for style learning
• Content from your WordPress site that we crawl for gap analysis and internal linking
• Generated articles

3.6 Cookies and Tracking Technologies

We use cookies and similar technologies for essential functionality (authentication, session management), analytics (understanding how the Service is used), and preferences (remembering your settings). You can manage cookie preferences through your browser settings. Essential cookies cannot be disabled as they are necessary for the Service to function.

4. How We Use Your Data

We process your personal data for the following purposes:

• Service Delivery: To provide, operate, and maintain the Service, including connecting to your WordPress site, analyzing content, and generating articles.
• Account Management: To create and manage your account, authenticate your identity, and provide customer support.
• Payment Processing: To process subscription payments and manage billing through Airwallex.
• Service Improvement: To analyze usage patterns, diagnose technical issues, and improve the Service.
• Communications: To send you transactional emails (e.g., billing receipts, account notifications) and, with your consent, marketing communications.
• Legal Compliance: To comply with legal obligations, resolve disputes, and enforce our agreements.

5. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases:

• Contract Performance: Processing necessary to provide the Service you have subscribed to (Article 6(1)(b) GDPR).
• Legitimate Interests: Processing for our legitimate interests in improving the Service, preventing fraud, and ensuring security, where these interests are not overridden by your rights (Article 6(1)(f) GDPR).
• Consent: Where you have given explicit consent, such as for marketing communications (Article 6(1)(a) GDPR).
• Legal Obligation: Processing necessary to comply with applicable laws (Article 6(1)(c) GDPR).

6. Data Sharing

We may share your personal data with the following categories of recipients:

• Airwallex: Our payment processor, which handles all payment transactions. Airwallex processes your payment data in accordance with its own privacy policy and PCI DSS standards.
• Hosting and Infrastructure Providers: Cloud hosting services that store and process data on our behalf.
• Analytics Providers: Tools that help us understand usage patterns (data is aggregated and anonymized where possible).
• Legal and Regulatory Authorities: When required by law, regulation, or legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

We do not sell your personal data to third parties.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries recognized as providing an adequate level of data protection.

8. Data Retention

We retain your personal data for as long as your account is active and as needed to provide the Service. After account deletion, we retain data for a limited period as follows:

• Account and usage data: Deleted within 90 days of account closure.
• Payment records: Retained for up to 7 years as required by tax and accounting regulations.
• Generated content: Removed from our systems within 30 days of account closure. Content already published to your WordPress site remains on your site.
• WordPress credentials: Deleted immediately upon disconnection or account closure.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption of data in transit (TLS) and at rest, secure hashing of passwords, access controls and role-based permissions, regular security assessments, and encrypted storage of WordPress application passwords.

10. Your Rights

Under the GDPR and applicable laws, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

11. Automated Decision-Making

The Service uses automated processing (including AI) to analyze your website content and generate articles. This automated processing does not produce legal effects or similarly significant effects on you. You may request human review of any automated decisions that affect your account or subscription.

12. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

13. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last Updated" date at the top reflects the most recent revision.

15. Supervisory Authority

If you are located in Hong Kong and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) — www.pcpd.org.hk.

16. Contact Us

For any questions or requests regarding this Privacy Policy: