Privacy policy

1. Who we are

The website and the Magic platform are operated by MAGICAI LTD, a company registered in Israel ("Magic", "we", "us"). Magic is the controller of the personal data described in this policy, which means we decide why and how it is processed.

You can reach us about anything in this policy through the Contact page. Your message goes to the person responsible for data protection at Magic.

2. Who this policy covers

This policy applies to visitors of the website, people who contact us, users at pilot partner companies (Magic issues platform accounts to pilot partners after the pilot launches; there is no public registration on the website), and people at manufacturers, banks, logistics companies, inspection companies and other partners we work with or approach.

Magic is a service for businesses. Most of the data we handle is business data about companies; this policy is about the part of it that identifies a person, such as a name, a work email address or a phone number.

3. What we collect

Depending on how you use Magic, we collect:

• Website form details: your name, your company, and a phone number or email address; for job applications, optionally a link to your profile. The form has no other fields and does not accept files.
• Account and company details (platform users at pilot partners): your name, work email address, password (stored only as a one-way hash), role, company name, company type, country, purchasing categories, delivery locations and the settings you choose.
• Purchasing requests: the products you need, quantities, purchase frequency, technical requirements, delivery addresses, notes and, if you choose to give it, the price you pay today and what it covers.
• Documents shared on the platform during a pilot: specifications, tender documents, drawings or invoices, and the information the platform reads from them to fill in a request.
• Offers and decisions: the offers we present to you, whether you accept or decline them, and the reasons you give.
• Communications: the details you send through the website form, what you write to us by email or on the platform, and our replies.
• Manufacturer and partner information: business contact details of manufacturers and partners, taken from their public websites and business directories or given to us in an application, together with the quotes and messages they send us.
• Technical data: the pages you request, the time of the request, your browser type and the network address it came from, kept in server logs for security and to keep the service running. Where we use a network address to limit abuse of a form, we store it only in scrambled (hashed) form.

4. What we do not collect

Magic does not take payments and does not store card or bank account details: settlement in a deal runs between the buyer, its bank and the seller. We do not collect data about health, religion, political opinions or other special categories, and we ask you not to include such data in documents or messages. The service is not directed at children and is not meant for anyone under 18.

5. How we use it and why

We use personal data only for these purposes, each with its legal basis:

• To provide the service to pilot partners: creating and securing the accounts Magic issues to them, recording your requests, combining compatible demand, finding and qualifying manufacturers, requesting quotes, preparing and presenting offers, and supporting the deal. Basis: performing our contract with your company.
• To answer you: a Magic manager contacting you after you send the form, and answering your questions. Basis: taking the steps you asked for, and our legitimate interest in running our business.
• To keep the service safe and working: preventing fraud and misuse, limiting automated submissions, investigating faults and keeping records of changes. Basis: our legitimate interest and our legal obligations.
• To meet legal duties: keeping business and tax records and answering lawful requests from authorities. Basis: legal obligation.
• To send you news about Magic, only where you agreed or where the law allows it for existing customers, and always with a way to stop. Basis: consent or our legitimate interest.

6. Artificial intelligence and automated processing

Magic uses artificial intelligence to read the documents you upload and fill in a request, to find and assess manufacturers, to draft requests for quotes and to read the replies manufacturers send. The AI suggests; people decide. You check every request before you submit it, and a member of the Magic team approves every request for a quote before it is sent and every offer before it is presented to you.

No decision that has a legal or similarly significant effect on you is taken by automated means alone. The AI providers we use process the content only to give us the result we ask for, under terms that do not allow them to use it to train their models.

7. Pooling and confidentiality between buyers

Combining demand is the heart of Magic, and it is designed so that buyers stay invisible to each other. Other buyers never see your company's name, your quantities, your prices or your documents. Manufacturers asked to quote receive the product specification and the combined volume, not the identity of the companies behind it. Your company is named to a supplier only when you decide to go ahead with an offer and a deal contract is prepared.

8. Who we share it with

We share personal data only with those who need it, and never sell it or give it to advertisers:

• Service providers who work for us under contract and confidentiality: cloud hosting and database services, the email service we send and receive mail with, and the AI providers described above.
• Manufacturers, as described in the section on pooling: specifications and volumes while quotes are requested, and the details needed for the deal contract once you decide to go ahead.
• Banks, logistics, customs and inspection companies involved in a deal you go ahead with, to the extent they need the information to do their part. Each of them handles the data under its own terms and the law.
• Professional advisers such as lawyers, accountants and auditors, under a duty of confidentiality.
• Authorities, courts or regulators, when the law requires it or to protect our rights, our users or the public.
• A buyer or successor of all or part of Magic's business, bound by this policy.

9. Transfers outside Israel

Some of our service providers store or process data outside Israel, for example in the European Union or the United States, and manufacturers we approach are located around the world. When data leaves Israel we make sure the transfer is permitted under the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations and, where the GDPR applies, that appropriate safeguards such as standard contractual clauses are in place.

10. How long we keep it

We keep personal data only as long as we need it for the purposes above:

• Account, company and request data: for as long as your company's account is open, and then for up to seven years where tax, accounting or contract law requires records of deals to be kept.
• Documents you upload: with the request they belong to; they are deleted with a draft request you discard, and with the account when it is closed, subject to the record-keeping duties above for requests that led to a deal.
• Website form requests that did not lead to a business relationship: up to 24 months.
• Server logs: up to 12 months, unless needed longer to investigate a security incident.

11. How we protect it

We protect personal data with measures suited to its sensitivity, in line with the Protection of Privacy (Data Security) Regulations: encrypted connections, passwords stored only as one-way hashes, changing your password signs out every other session, access limited to the staff who need it, separation of each company's data, and logs of changes. No system is perfectly secure; if an incident affects your personal data, we will notify you and the authorities as the law requires.

12. Your rights

Under the Israeli Protection of Privacy Law you may ask to see the personal data we hold about you and ask us to correct or delete data that is wrong, incomplete, unclear or out of date. Where the GDPR applies to you, you may also ask us to restrict or stop processing, to object to processing based on our legitimate interests, to receive your data in a portable format, and to withdraw consent at any time without affecting what was done before.

To exercise a right, write to us through the Contact page. We will answer within 30 days, and may ask you to confirm your identity first. If you are not satisfied, you can complain to the Privacy Protection Authority in Israel or, in the European Union, to the data protection authority where you live or work.

13. Cookies

Magic uses only cookies that are strictly necessary for the service: one that keeps you signed in to the platform and one that remembers the language you chose. We do not use analytics, advertising or tracking cookies, and we do not allow third parties to place such cookies through our site. Because these cookies are necessary, they do not require consent; blocking them in your browser will stop sign-in from working.

14. Messages we send

We send service messages that are part of using Magic, such as email confirmation, password resets and messages about your requests and offers. We send marketing messages only with your consent, or to existing customers where the Communications Law allows it, and every such message includes a way to unsubscribe.

15. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell platform users by email or on the platform before it takes effect.

16. Law and language

This policy is governed by the law of Israel, including the Protection of Privacy Law, 5741-1981, and its regulations, and, where they apply, by the EU General Data Protection Regulation and other applicable data protection laws. It is published in English, Hebrew and Russian; if the versions differ, the English text prevails.