Privacy Policy
Last updated: October 12, 2026
This policy explains how MagicAI, operated from Hong Kong (“MagicAI”, “we”, “us”), handles personal data when you visit magicai.lol, use the dashboard, or call the API. We are the data user (controller) for the data described here. We aim to collect as little as we need to run a prepaid API gateway, and we comply with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) and, where they apply to you, other data protection laws such as the GDPR.
Contents
1. Data we collect
| Category | What it includes | Source |
|---|---|---|
| Account | Username, password (stored only as a hash), and an email address only if you choose to add one. Sign-up does not require an email. | You |
| API keys | The keys you create, their names, status and usage totals. | You / the Service |
| Billing | Top-up amounts, dates, Stripe payment and customer identifiers, and payment status. Stripe collects your card details, billing name, email and country on its own checkout page; we do not receive or store your full card number. | Stripe |
| Usage records | For each API request: time, model, key name, prompt and completion token counts, cost, duration, whether it streamed, routing and error status, and a request ID. Your client IP address is added only if you turn on IP recording in your account settings. | The Service |
| Technical logs | Web server access logs (IP address, time, URL path, method, status, response size, user agent and other request headers; authorisation headers and cookies are redacted), and application logs containing system events and errors. | Your browser or client |
| Security checks | Cloudflare Turnstile signals collected on sign-up and login forms, and the resulting pass/fail token. | Cloudflare |
| Support | The content of emails you send us and any details you give to verify your account. | You |
2. Prompts and outputs
Your prompts and the model's responses pass through our gateway to the Upstream Provider and back to you. We do not store the content of prompts or completions in our database or usage logs; we record only the metadata listed above. Content may be held briefly in memory while a request is processed. An error message returned by an Upstream Provider may be written to our application logs, and in rare cases such messages can quote part of a request.
We do not use your prompts or outputs to train AI models. Upstream Providers receive the content needed to answer your request and process it under their own terms and privacy policies, which may include temporary retention for abuse monitoring. Review the policies of the providers whose models you use.
3. Cookies and local storage
We do not use advertising or third-party analytics cookies. We use:
- Session cookie set by the gateway when you sign in, to keep you logged in to the dashboard.
- Browser local storage for your access token, user ID and username (to call the dashboard API) and your light/dark theme preference. You can clear these by signing out or clearing site data.
- Cloudflare may set strictly necessary cookies for security and bot protection, including for Turnstile.
- Stripe sets its own cookies on its checkout pages for payment processing and fraud prevention.
4. How we use data
- Provide the Service: authenticate requests, route them to Upstream Providers, and return responses.
- Bill usage: deduct credit, show your balance and usage history, process top-ups and refunds.
- Keep the Service secure: prevent bot sign-ups and abuse, enforce rate limits, investigate misuse and chargebacks.
- Operate and improve reliability: diagnose errors and measure latency and success rates.
- Publish aggregated performance statistics (per-model request counts, success rates, latency and throughput). These contain no usernames, keys, IP addresses or content and cannot identify you.
- Communicate with you about support requests, and about important changes if you have given us an email.
- Comply with legal obligations, such as accounting, tax and lawful requests from authorities.
We do not sell personal data or use it for advertising.
5. Legal bases
Where laws such as the GDPR apply, we rely on: contract (to provide the Service and process payments you request); legitimate interests (security, fraud and abuse prevention, rate limiting, troubleshooting and aggregated statistics, balanced against your rights); legal obligation (record-keeping and responding to lawful requests); and consent where we ask for it, such as for an optional email address, which you can withdraw at any time. Under the PDPO, we collect personal data for purposes directly related to providing the Service and use it only for those or directly related purposes unless you consent otherwise.
6. Who we share data with
| Recipient | Purpose | Data |
|---|---|---|
| Stripe | Payment processing, fraud prevention, refunds and disputes | Payment details collected by Stripe; amount, account reference |
| Cloudflare | DNS, network proxy and DDoS protection, Turnstile bot checks | IP address, request metadata, Turnstile signals |
| Upstream model providers | Generating the response to each API request | Prompt content and request parameters (not your username, password or payment data) |
| Hosting provider | Running our servers (currently in Japan) | All data stored on our servers, under the provider's security obligations |
| Authorities and advisers | Where required by law, to protect rights and safety, or to professional advisers under confidentiality | As necessary |
If MagicAI is reorganised, merged or sold, data may transfer to the successor, which must honour this policy.
7. International transfers
We operate from Hong Kong and our servers are hosted in Japan. Stripe, Cloudflare and Upstream Providers may process data in the United States and other countries. Where we transfer personal data outside the place it was collected, we rely on the recipients' contractual and security commitments and, where required, appropriate safeguards such as standard contractual clauses.
8. How long we keep data
| Data | Retention |
|---|---|
| Account data and API keys | While your account is open. After you ask us to delete your account, we delete or anonymise it within 30 days, except data we must keep as below. |
| Usage records | While your account is open, so you can review your history; deleted or anonymised within 30 days of account deletion. |
| Billing and payment records | Up to 7 years, to meet accounting and tax obligations and to handle refunds and disputes. |
| Web server access logs | Rotated automatically and kept for up to 30 days. |
| Application and container logs | Rotated by size; generally kept for no more than 90 days. |
| Aggregated statistics | Computed over rolling 24-hour and 7-day windows; contain no personal data. |
| Support emails | Up to 2 years after the issue is resolved. |
9. Security
We use HTTPS for all traffic, store passwords as one-way hashes, show full API keys only to the account owner, restrict server access to administrators, rate-limit sign-up and login, and use Cloudflare Turnstile to block automated abuse. No system is perfectly secure; please use a strong unique password and keep your keys secret. If we become aware of a data breach affecting you, we will notify you and authorities where required by law.
10. Your rights
Under the PDPO you may request access to, and correction of, your personal data. Depending on where you live, you may also have rights to deletion, restriction, objection, data portability and to withdraw consent. To make a request, email support@magicai.lol from the email linked to your account if any, or include your username and enough detail for us to verify you (for example a recent payment date and amount). We will respond within 40 days as required by the PDPO, or sooner where other laws require. We may charge a reasonable fee for data access requests where the PDPO permits. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, or your local data protection authority.
11. Children
The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the Service changes. The date at the top shows the current version. For material changes we will post a notice on the site, and email you if you have provided an address.
13. Contact
MagicAI, Hong Kong. For privacy questions or requests, email support@magicai.lol.