Legal

Magic Labs, Inc. ("Magic," "we" and "us") operates websites and services including magic.link and related platforms. This Privacy Policy explains how personal information is handled across these services. This Privacy Policy does not apply to the information we collect in any employment context.

For privacy inquiries, contact us at:

• Email: privacy@magic.link
• Phone: +1 (707) 653-5739
• Data Subject Request Form: Available online
• Mail: 3739 Balboa St #1088, San Francisco, CA 94121-2605

Users acknowledge acceptance of practices outlined by accessing services. The policy references the Terms of Service and Developer API & SDK License Agreement as governing documents.

I. What this Privacy Policy Covers

Magic Labs, Inc. ("Magic," "we" and "us") operates websites and services including magic.link and related platforms. The policy explains how personal information is handled across these services. However, this Privacy Policy does not apply to the information we collect in any employment context.

II. Personal Data We Collect and Share

Magic collects multiple categories of personal information:

Profile or Contact Data

Includes email addresses, phone numbers, IP addresses, device IDs, public wallet addresses, purchased products/assets, blockchain transaction history, authentication metadata, and social login information.

Billing Data

Credit/debit card numbers, billing addresses, card expiration dates, and security codes.

Financial Data or AI Data

Virtual currency balances, session keys, AI trading activity data, agent interaction logs, and contextual metadata like timestamps.

Device/IP Data

IP addresses, device identifiers, operating systems, and web browsers used.

Geolocation Data

IP-address-based location information.

III. Sources of Personal Data

1. Information You Provide to Us

Users provide information when:

• Creating accounts or using interactive tools
• Providing free-form text through services
• Sending emails or contacting Magic
• Responding to surveys or questionnaires

2. Information We Collect Automatically

Magic receives standard technical information including:

• Cookie-based data collection
• Computing device information when using software
• Network connection details like IP addresses

3. Information Obtained From Third-Party Analytics Services

We use third-party analytics services (such as Google Analytics and X) to evaluate usage and compile activity reports. Users may opt out through the "Do Not Sell or Share My Personal Information" link or Google's opt-out tools.

4. Information Obtained Through Inferences

Magic creates profiles reflecting consumer preferences, characteristics, psychological trends, and behavioral patterns from collected data.

5. Information Obtained From Other Sources

Information comes from third-party services, marketplaces, business partners, app stores, and social networking sites based on user privacy settings.

IV. Why We Collect, Use and Share Your Data

1. Business Purposes

Magic uses data for:

• Account creation and management
• Providing requested services and information
• Support and assistance
• Service improvement through testing and research
• Personalization based on preferences
• Fraud and bot protection
• Site security and incident detection
• New service development
• Usage trend identification

2. Corresponding With You

Magic responds to correspondence, provides support, contacts users when necessary, and sends information about services.

3. Cooperation With Service Providers and Other Related Companies

These other companies will have access to Your Data as necessary to perform their functions, including hosting providers, security vendors, customer service representatives, payment processors, and analytics partners.

4. Marketing

Magic may send marketing communications where permitted by law. Users receive targeted advertising about products and services. Opting-out does not mean that you will stop receiving advertisements from us.

5. Developers

Magic may disclose user data to third-party developers whose applications integrate Magic's services.

6. Blockchain Purposes

Your Data may be disclosed to third parties, made publicly visible and/or appear as part of any applicable blockchain network during Virtual Currency transactions, with users assuming all associated risks.

7. Meeting Legal Requirements and Enforcing Legal Terms

Magic discloses data to fulfill legal obligations, protect rights, enforce agreements, respond to subpoenas, and support compliance functions.

8. Aggregated Information

We might analyze Your Data in aggregate, de-identified or anonymized form and may share this information with affiliates and third parties.

9. Business Transfers

Personal data may transfer as part of asset sales, mergers, reorganizations, or similar events.

10. Otherwise With Your Consent

Magic discloses data for purposes you authorize or that are disclosed when providing information.

V. Accessing and Modifying Information and Communication Preferences

1. Your Account

Users may access, review, delete, and modify submitted information through the Data Subject Request Form or by contacting privacy@magic.link.

2. Marketing Communications

Users can unsubscribe from marketing emails by clicking "Unsubscribe" links in messages.

3. Tracking Technologies

Cookies

Magic uses cookies — small pieces of data, usually text files — placed on devices. Three types are employed:

Strictly Necessary Cookies: Required for service functionality in response to user actions like logging in. These don't store personal data.

Targeting Cookies: Set by advertising partners to build interest profiles and display relevant ads on external sites.

Performance Cookies: Enable visit and traffic counting to measure service performance. All collected data is aggregated and anonymous.

Users control cookies through browser settings. More information is available at allaboutcookies.org, ico.org.uk, or european-union.europa.eu.

Web Beacons and Pixels

A pixel is an HTML code snippet embedded in a website or email that collects user behavior information. Magic uses pixels to measure marketing campaign success and track activities.

4. Do Not Track

Magic does not currently monitor or honor "Do Not Track" browser settings or signals.

VI. Data Security and Retention

Magic implements appropriate physical, technical, organizational and administrative security measures based on data type and processing methods. Users should protect passwords and limit device access.

No method of transmitting data over the internet or storing data is completely secure.

Data is retained while accounts remain active or as necessary for service provision. Longer retention occurs when legally required, dispute resolution is needed, or fees are collectible. Anonymous or aggregated information may be retained indefinitely.

VII. Personal Data of Children

Magic does not knowingly collect personal data from children under 16 years old. If we learn that we have collected Personal Data from a child under 16 years of age, we will promptly take steps to delete such information.

VIII. Notice to California Residents

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act. Details appear in Addendum I below.

IX. Notice to Texas Residents

Texas residents can confirm data processing, access personal data, correct inaccuracies, delete information, obtain portable data copies, and opt out of targeted advertising, data sales, and certain profiling.

Requests may be made via:

• Email: privacy@magic.link
• Phone: +1 (707) 653-5739
• Data Subject Request Form
• Mail: 3739 Balboa St #1088, San Francisco, CA 94121-2605

Requests must provide sufficient verification information. Magic may require identity verification before responding.

X. Notice to Nevada Residents

Nevada residents may opt out of personal data sales to third parties by contacting privacy@magic.link with "Nevada Do Not Sell Request" in the subject line. However, we do not sell Personal Data as defined under Nevada law.

XI. Important Notice to Non-U.S. Residents

Services operate in the United States. International users should understand privacy laws may not be as protective as those in your jurisdiction.

EU, UK, Lichtenstein, Norway, Iceland, and Switzerland residents have additional rights under European Data Protection Laws detailed in Addendum II.

XII. Changes to this Privacy Policy

Magic may update the policy, with changes noted at the top. Updated effective dates indicate revisions. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.

XIII. Contact Information

For privacy questions and requests, contact:

• Email: privacy@magic.link
• Phone: +1 (707) 653-5739
• Data Subject Request Form: Available online
• Mail: 3739 Balboa St #1088, San Francisco, CA 94121-2605

---

Addendum I - CCPA Privacy Notice to California Residents

Last Update: October 1, 2024

California residents have rights under the California Consumer Privacy Act and California Privacy Rights Act. Service provider processing notes apply if Magic processes data on behalf of customers.

1. Information We Collect

Categories of Personal Data

Within 12 months, Magic collected:

• Identifiers
• Personal information (per California Customer Records statute)
• Commercial information
• Internet/electronic network activity information
• Geolocation data
• Sensitive Personal Data (financial account credentials)

Categories of Sources

Sources listed in Section III of the main Privacy Policy.

Purposes of Disclosure

Business purposes listed in Section IV of the main Privacy Policy.

Categories of Third Party Recipients

Third parties listed in Section IV of the main Privacy Policy.

Categories of Personal Data Sold or Shared

Over 12 months, the following were sold or shared:

• Identifiers
• Internet/electronic network activity information
• Geolocation data

These categories were shared with third-party website analytics and digital advertising service providers.

Purposes for Selling or Sharing

Magic sells or shares data to provide services, improve personalization, evaluate usage, provide fraud protection, improve security, develop new services, identify trends, provide personalized advertising, measure promotional effectiveness, and fulfill legal obligations.

Retention of Personal Data

Data is retained while accounts remain open or as necessary for service provision. Longer retention occurs when legally required, dispute resolution is needed, or fees are collectible.

2. Your Rights and Choices

a. Right to Know About Personal Data

Consumers may request disclosure of personal data collection, disclosure, sale, and use. Once we receive and verify your request, we will disclose to you specific data pieces, categories, disclosure purposes, recipient categories, sources, and business reasons for collection.

Requests may be made up to twice annually.

b. Right to Request Deletion

Consumers may request personal data deletion, though exceptions apply for transaction completion, security, debugging, and legal compliance.

c. Right to Opt-Out of the Sale of Personal Data

Consumers may direct businesses not to sell personal data. While Magic doesn't sell data for monetary consideration, tracking technologies for targeted advertising may qualify as "sale" or "sharing" under CCPA.

To opt out, click "Do Not Sell or Share My Personal Information" on the website footer.

We do not have actual knowledge that we sell or share Personal Data about minors under the age of 16.

d. Right to Correct Inaccurate Personal Data

Consumers may request correction of inaccurate personal data, considering its nature and processing purposes.

e. Right to Limit Use and Disclosure of Sensitive Personal Data

Consumers may direct use of sensitive data only for necessary services, specified business purposes, or as authorized. Magic limits sensitive data use to these purposes.

f. Right to Non-Discrimination

Magic will not discriminate against consumers exercising CCPA rights through denial of services, price/rate differences, quality differences, or different pricing suggestions.

g. Exercising Your Privacy Rights

Request methods:

• Call: +1 (707) 653-5739
• Email: privacy@magic.link
• Form: Data Subject Request Form
• Mail: 3739 Balboa St #1088, San Francisco, CA 94121-2605

What We Need to Know

Requests must provide sufficient verification information and describe requests with sufficient detail. Identity verification may be required.

How You Will Hear Back

Magic confirms receipt within 10 business days and responds within 45 calendar days. Extensions up to 90 days are permitted with explanation. Responses are delivered to account email or by mail/email preference.

Magic may charge reasonable fees for excessive, repetitive, or manifestly unfounded requests.

h. Right to Designate an Authorized Agent

Authorized agents may submit requests with signed written permission.

3. Changes to Our CCPA Notice

The CCPA Notice updates as needed. Changes become effective upon posting. Our use of your Personal Data is governed by the CCPA Notice in current effect.

4. Contact Information

For CCPA questions and requests:

• Email: privacy@magic.link
• Phone: +1 (707) 653-5739
• Form: Data Subject Request Form
• Mail: 3739 Balboa St #1088, San Francisco, CA 94121-2605

---

Addendum II - Privacy Notice to European Residents

Effective as of: October 1, 2024

EU, UK, Lichtenstein, Norway, Iceland, and Switzerland residents have additional rights under European Data Protection Laws. Magic generally acts as data controller but may be a processor for customer data.

1. Types of Personal Data We Collect

Categories listed in Section II of the main Privacy Policy.

2. How We Get the Personal Data and Why We Have It

a) Your Consent

Magic processes data based on expressed consent. You can remove your consent at any time by contacting privacy@magic.link with subject line "European Data Protection Request."

b) We Have a Contractual Obligation

Magic processes necessary data to fulfill service agreements. Failure to provide such data prevents service use. Categories include Profile/Contact, Billing, Financial, Device/IP, and Geolocation Data.

c) We Have a Legitimate Interest

Magic processes data when furthering legitimate interests unless overridden by user interests or fundamental rights. Interests include information security, service operation and improvement, audience measurement, business development, direct marketing, and rights protection.

d) We Have a Legal Obligation

Magic discloses data to fulfill legal obligations, comply with regulations, respond to court orders, and meet public authority requests.

3. How We Share Your Personal Data

Sharing practices are detailed in Sections I and IV of the main Privacy Policy.

4. How We Store and Protect Your Personal Data

Magic uses commercially reasonable administrative, technical, and physical safeguards to protect data from loss, misuse, and unauthorized access. No data transmission or storage system can be guaranteed to be secure at all times.

Data is retained as needed for stated purposes and as required by law.

5. Your Data Protection Rights

Users have one month to receive responses to requests. Magic may deny frivolous or impractical requests or those jeopardizing others' rights.

Right of Access: Users may request information about processed personal data and receive copies. Dashboard users can access certain data via account login.

Right to Rectification: Users may request correction or supplementation of incorrect or incomplete data. Dashboard users can directly correct some information.

Right to Erasure: Users may request personal data erasure under certain circumstances.

Right to Restriction of Processing: Users may request processing restrictions under certain circumstances.

Right to Object to Processing: Users may object to processing based on public interest or legitimate interests. Objection halts processing except where compelling grounds override user rights or legal claims exist. Users may object to direct marketing by clicking "Unsubscribe" in emails or submitting requests to privacy@magic.link.

Right to Data Portability: Users may request personal data copies in structured, machine-readable formats and request transmission to other controllers where technically feasible.

Right to Withdraw Consent: If processing is consent-based, users may withdraw consent at any time. Withdrawal doesn't affect previously-completed processing.

6. How to Complain

Users may complain to Magic at privacy@magic.link with subject line "European Data Protection Request."

Users may also lodge complaints with supervisory authorities of their European state. A list is available at the EU website.

7. Transfers of Personal Data

Services are hosted in the United States where laws in the U.S. may differ from the laws where you reside. By using services, users authorize data transfer, storage, and processing in the U.S. We transfer your Personal Data through the use of appropriate safeguards as required by European Data Protection Laws.

8. Updates to this European Addendum

Magic provides notice before processing data for purposes different from collection purposes. The relevant information relating to such processing activity will be revised or added appropriately within this European Addendum.

9. Our Contact Information

For European Addendum questions:

• Email: privacy@magic.link (subject: "European Data Protection Request")

EU/UK/related region representative:

• Dr. Axel Freiherr von dem Bussche, LL.M. (L.S.E.)
• Rechtsanwalt Fachanwalt für Informationstechnologierecht
• Email: a.bussche@taylorwessing.com

Taylor Wessing Partnerschaftsgesellschaft mbB

• Address: Hanseatic Trade Center, Am Sandtorkai 41, 20457 Hamburg