Privacy Policy

1. Our role

The Service is used by businesses (our "customers") to talk to the visitors of their websites and to their own customers.

• Visitor and customer data. When we process information about a business's website visitors, enquirers or customers (for example chat messages, form entries, calls and messages), we do so on behalf of that business and on its instructions. The business is the controller of that information and we act as its processor (or "service provider"). If you are a visitor or customer of a business that uses Commagic, that business's own privacy notice applies, and requests about your information should go to the business first.
• Business account data. For information about our customers' own accounts and users (for example names, email addresses and sign-in details of people who use the Commagic dashboard), Commagic is the controller.

2. Information we process

Website chat (WordPress and Wix)

• The messages a visitor types into the chat and the replies the assistant gives.
• The address of the page the visitor is on when they use the chat.
• Technical information that any browser sends when it loads a file from another website, including IP address and browser details, when the chat script is loaded.
• A conversation identifier kept in the browser's session storage for that tab. The chat does not set cookies.

Form submissions that become leads

When a business connects its site and has lead capture switched on, entries submitted through supported forms are sent to Commagic and become leads in the business's account.

• WordPress: Contact Form 7, Elementor Forms, WPForms, Fluent Forms, Gravity Forms and Ninja Forms. For each entry: the form plugin, form ID and title; each filled-in field's name, label, type and value; the page the form was sent from (without its query string); the time and an entry ID; and, only when the visitor ticked a box whose wording mentions SMS or WhatsApp, the fact that they agreed, the wording of the box and the time. Passwords, hidden fields, captcha and security tokens, uploaded files, cookies and IP addresses are not sent.
• Wix: Wix Forms submissions, received from Wix through its webhooks, with the submitted fields and the form's name.

WordPress plugin

• When the plugin is connected: the connection code, the site's addresses (Site Address and WordPress Address), site title, WordPress, PHP and plugin versions, site language and timezone. While connecting, Commagic makes one request to the site's REST API to confirm the code is being used on that site.
• Once a day while connected, and when an administrator clicks "Check connection": the list of forms in the supported form plugins, with each form's fields' names, labels and types (never what anybody typed), together with the same site details.
• Form entries as described above, and the consent ticks they carry.
• When an administrator clicks Disconnect: one request, carrying only the site's connection credential, asking Commagic to revoke the connection.

Wix app

• The Wix site ID, the app's instance ID, the site's name and its published addresses.
• The names and field labels of the site's Wix Forms, and Wix Forms submissions.
• Events telling us that the app was installed on or removed from a site.

Messaging, calls and voicemail

If a business uses these features, we process the phone numbers, message contents, delivery status and timestamps of the WhatsApp messages and SMS messages it sends and receives through the Service, and the details of phone and voice calls (numbers, times, duration). If voice features are used, calls and voicemails may be recorded and transcribed, and speech is converted to and from text by AI speech providers. We record opt-out (STOP) and opt-in (START) replies.

Calendar and job-management integrations

If a business connects them, we access its Google Calendar (through an OAuth integrations broker) or Outlook calendar to check availability and book appointments, and its job-management software (Jobber, Housecall Pro, Workiz) to create or look up customers, jobs and appointments. We access only what the business authorises when it connects the integration.

Business accounts

• Names, email addresses and sign-in details of the people who use the Commagic dashboard, and the business's settings, projects, assistant instructions and connected integrations.
• Messages we send to a business's users, such as notification emails about new leads and conversations.
• Messages a business sends us, for example to support.

3. How we use information

• To provide the Service: answering website visitors with AI on the business's behalf, turning form entries and conversations into leads, sending and receiving messages and calls, booking appointments and keeping the business's records in its account.
• To notify a business's users by email about new leads, conversations and account events.
• To keep the Service secure, prevent abuse and fix problems.
• To provide support and to communicate with our customers about the Service.
• To comply with legal obligations.

We do not sell personal information, we do not use visitor or customer data processed for a business for our own advertising, and we do not use it to train AI models.

Legal bases (where EU/UK data protection law applies to data for which we are controller): performance of our contract with the business, our legitimate interests in running and securing the Service, compliance with legal obligations, and consent where required.

4. Service providers (subprocessors)

We use the following categories of service providers to run the Service. They process personal information only to provide their services to us.

• Cloud hosting and content delivery: Railway, Cloudflare.
• AI model providers: Anthropic, OpenAI.
• Messaging and telephony: Green API (WhatsApp), Twilio (SMS, phone and voice calls).
• Speech (voice calls and voicemail): Deepgram, ElevenLabs, Microsoft Azure Speech.
• Reading a business's own website to build its assistant's knowledge, when the business asks: Firecrawl.
• Integrations broker (calendar and job-management connections): Nango.
• Email: Namecheap Private Email (emails we send), Google Workspace (emails we receive).

When a business connects a third-party platform (such as WordPress, Wix, WhatsApp, Google Calendar, Outlook, Jobber, Housecall Pro or Workiz), information also flows to and from that platform under its own terms and privacy policy.

5. Retention and deletion

• A business can delete leads and projects from its Commagic dashboard.
• Disconnecting the WordPress plugin revokes that site's connection and website key in Commagic; the plugin then stops sending form entries and removes the chat. Information already received stays in the business's account until the business deletes it.
• Removing the Commagic Chat Wix app from a site (or clicking Disconnect in the app) disconnects that site. Information already received stays in the business's account until the business deletes it.
• Deletion and access requests can be sent to [email protected].

We keep information only as long as we need it for the purposes above:

• Conversations, leads, messages, call recordings, voicemails and transcripts: in the business's account for as long as the account is open, unless the business deletes them sooner.
• Business account data: for as long as the account is open, and then for up to seven years where tax, accounting or contract law requires records to be kept.
• Server logs: up to 12 months, unless needed longer to investigate a security incident.

6. Your rights and data requests

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to withdraw consent.

• Visitors and customers of a business: please contact that business first, because it controls your information. We will help the business respond. If you contact us directly, we will pass your request to the business where we can identify it.
• Businesses and their users: contact [email protected].

We will respond within 30 days, and may ask you to confirm your identity first. Messages to [email protected] reach the person responsible for data protection at Commagic. You may also complain to the Privacy Protection Authority in Israel or, in the European Union, to the data protection authority where you live or work.

7. Responsibilities of businesses using Commagic

• Have a lawful basis, and the consent required by law, before sending SMS or WhatsApp messages or making calls to anyone through the Service.
• Honour opt-outs. The Service records STOP and START replies; a business must not message people who have opted out.
• Give its own website visitors and customers a privacy notice that explains its use of Commagic, including the chat, form capture and any call recording.

8. Security

We use technical and organisational measures designed to protect personal information, including encrypted connections, passwords stored only as one-way hashes, integration credentials encrypted at rest, separation of each business's data, access limited to the staff who need it, and per-site connection credentials that can be revoked. No service can be completely secure.

9. International transfers

The Service is hosted in the European Union (the Netherlands). Some of our service providers process information in other countries, including the United States. When information leaves Israel we make sure the transfer is permitted under the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations and, where the GDPR applies, that appropriate safeguards such as standard contractual clauses are in place.

10. Children

The Service is for businesses and is not directed to children. You must be at least 18 to use a Commagic account. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy. We will post the new version on this page with a new date and, for material changes, notify businesses by email or in the dashboard.

12. Contact

MAGICAI LTD, Israel. Privacy questions and requests: [email protected]. Other questions: [email protected].

This policy is governed by the law of Israel, including the Protection of Privacy Law, 5741-1981, and its regulations, and, where they apply, by the EU General Data Protection Regulation and other applicable data protection laws.