Privacy policy

Magicus keeps a company's contracts and rate cards current, as one set of terms, and checks invoices and other documents against it. It's operated from the United Kingdom. This policy covers the people who sign in to Magicus, and the documents their company gives it to check.

For those documents, we act on your company's behalf: your company decides what goes in, and we only use it to run Magicus for them.

• Your account. When you sign in with Google we receive your name and email address. We never see your Google password.
• Your company's documents. Contracts, rate cards, invoices and other files your team uploads, or that Magicus reads from a Google Drive folder or file your company shares with it.
• What your team does in Magicus. Findings, decisions, notes, disputes drafted, rule changes and approvals, each with who made it and when.
• Slack. If your company adds Magicus to Slack, we keep the workspace's name and the token Slack gives us, so Magicus can post and update its run messages, and list channel names so you can pick one. It doesn't read your Slack messages.
• Technical data. Standard server logs (IP address, browser, pages requested) kept by our hosting provider for security and reliability.

• To sign you in. and to know your role in your company's workspace.
• To check documents. against your company's rates and contracts, and show your team what needs a person.
• To keep a record. of every run, version and decision, so anyone can see later why a document was passed or flagged.
• To fix problems. and keep the service running.

We don't sell your data, share it with advertisers, or use it to train AI models. We don't set marketing or advertising cookies; the only cookies keep you signed in.

Magicus reads Drive as its own Google service account, read only, and only sees the folders and files your company shares with it. It never changes, moves or deletes anything in Drive. To stop access, remove the service account from the folder or file's sharing.

We use these providers to run Magicus. Each gets only what its job needs:

• Google. Sign-in, and Google Drive for the folders and files shared with Magicus.
• Supabase. Stores accounts, workspaces, documents, runs and decisions. Our database is in the EU (Stockholm).
• Vercel. Hosts the application.
• Anthropic (Claude) and Google (Gemini). AI models that read documents such as PDFs and rate cards, and make the judgement checks. They receive the document being checked and the relevant rates and contract terms, through their APIs.
• Slack. Receives the run messages, if your company adds Magicus to Slack.

• Your company's workspace. Documents, versions of rates and contracts, runs and decisions are kept for as long as your company uses Magicus. They're an audit record, so they aren't edited after the fact. When your company stops using Magicus, we delete the workspace on request.
• Your account. Until you're removed from the team, or your company's workspace is deleted.
• Slack token. Until an owner disconnects Slack in Magicus, or removes the app in Slack.
• Server logs. Kept by our hosting provider for a limited period, typically up to 30 days.

Under UK data protection law you can ask to see the personal data we hold about you, have it corrected or deleted, or object to how it's used. Email team@netlearn.io. For documents your company put into Magicus, we'll usually work with your company to respond. You can also complain to the Information Commissioner's Office (ico.org.uk).

If this policy changes, we'll update the date at the top. For significant changes, we'll tell workspace owners first.

Questions about privacy: team@netlearn.io.