Privacy notice
What we do with your data.
This notice covers magicops.co.uk, the early-access list and the demo phone line. It is written to meet Articles 13 and 14 of the UK GDPR, and it describes what actually happens — not what a template says.
Version 1.0
Last updated 25 July 2026
Controller: a private individual (named here on incorporation)
The short version
We ask for two things: your email and your business name. Everything else is optional.
There are no tracking cookies, no analytics, no advertising pixels and no third-party trackers on this site. Nothing to consent to, so we don't ask.
We don't sell, rent or share your data for anyone else's marketing. Ever.
If we haven't spoken for 30 days, your request is deleted. Nothing is kept beyond 12 months.
01
Who is responsible for your data
The data controller is a private individual (named here on incorporation), a sole trader trading as Magic. A limited company is being registered; until that is done and the business is transferred to it, the person legally responsible for your data is that individual — not a company.
Controllera private individual (named here on incorporation), trading as Magic
AddressManchester, United Kingdom (address for service published here on incorporation)
ICO registerRegistration and the data protection fee are being dealt with now, and the reference will be published here as soon as it is issued. Registration does not change any of the obligations described in this notice, which apply already.
Data protection officerNone appointed. The business is not required to appoint one, and does not process data at a scale that would require it. Data protection questions go to the email above.
02
What we collect, why, and on what legal basis
Each row is one purpose, with the lawful basis under Article 6 that applies to it and how long the data survives. Nothing we collect is special category data, and we do not ask for it.
| What we collect |
Why |
Lawful basis |
How long |
| Your email address and business name, from the early-access form |
To reply to the request you made, and to decide whether we can offer you a place in the founding cohort |
Legitimate interests — you asked us to contact you about a service, and replying is the obvious consequence. Our interest is running a pre-launch waiting list; the impact on you is minimal and you can object at any time |
Deleted 30 days after our last contact with you; 12 months maximum in any case |
| Optional details you choose to add: trade or sector, rough monthly call volume, mobile number |
To script the demo recording for your trade rather than a generic one, and to ring you instead of emailing if you gave us a number for that reason |
Legitimate interests — you volunteered these to get a better demo. Leaving them blank changes nothing about your place on the list |
Same as above |
| Your email address, plus the fact that you ticked the box |
To email you when Magic opens, and occasional founding-cohort news. Only if you ticked the box — it is never ticked for you |
Consent. You can withdraw it at any time, by unsubscribe link or one email, and it is as easy to withdraw as it was to give |
Until you withdraw consent or unsubscribe. We keep a record that you opted out so we don't contact you again by mistake |
| If you ring the demo number: your phone number, your voice, and whatever you say to the agent |
To let you hear the agent answer a real call, and to keep the line working |
Legitimate interests — you rang a number advertised as a demo line, and the agent tells you it is recorded at the start of the call. Hang up and nothing is kept |
The recording and transcript are deleted straight after the call ends. Basic call metadata (number, time, duration) sits in our telephony supplier's logs for a short period under their retention policy |
| Emails you send us and our replies |
To answer you and keep a record of what was agreed |
Legitimate interests — corresponding with someone who wrote to us |
12 months from the last message, unless you ask us to delete it sooner |
| Technical request data: IP address, browser and device type, the page requested, time of request |
To serve the page to you at all, and to block attacks and abuse. We do not use this to build any profile of you and we do not read it in the ordinary course of things |
Legitimate interests — delivering and securing the site |
Held by our hosting provider (Cloudflare) as edge and security logs under their retention policy, typically days rather than months. We keep no copy |
03
Cookies and what we store on your device
This site sets no cookies at all. No analytics, no advertising or social pixels, no session cookies, no third-party tracking of any kind. That is why you are not asked to accept anything: under regulation 6 of the Privacy and Electronic Communications Regulations, consent is needed for storage that is not strictly necessary for the service you asked for — and we don't use any.
Two pieces of first-party browser storage are used, both purely functional, both readable only by this site:
magic.earlyAccess.leads.v2
Local storage. If you submit the form, a copy of what you typed stays in your own browser so that a failed send never silently loses your request. It never leaves your device on its own, and clearing your browser data removes it.
magic.legalNotice.dismissed.v1
Local storage. Remembers that you closed the privacy bar, so it doesn't reappear on every page load. Contains one value: true.
One honest caveat: the page loads its typeface from Google Fonts, so your browser makes a request to Google's servers and Google receives your IP address as part of that request. We do not control that and get nothing back from it. We are moving to self-hosted fonts to remove it.
04
Who else sees it
Only the suppliers we need to run the site and the demo, each acting on our instructions as a processor. Named, not hidden behind "trusted partners":
Google (Workspace, Sheets)
Our email and the spreadsheet the early-access list lives in. Access is limited to the controller named above, on an account with two-factor authentication.
Cloudflare
Hosting, DNS and protection against attacks. Sees the technical request data described above.
Telephony, speech and language-model suppliers
The demo agent is built on third-party telephony, speech-to-text and language-model services, configured to UK or EU processing regions where the supplier offers them. They process a call only for as long as it takes to handle it. We will name each one in writing before any live customer call is handled, and we will not use call content to train anyone's models.
Nobody else. We do not sell or rent personal data, we do not share it for anyone else's marketing, and there are no advertising or data-broker relationships. If we are ever legally required to disclose something — a court order, or a regulator with the power to demand it — we will comply, and tell you unless we are prohibited from doing so.
05
Where your data is held
We ask for UK or EU processing wherever a supplier offers it. Some of the suppliers above are US-headquartered and operate global infrastructure, so some data may be processed outside the UK. Where that happens, the transfer relies on the UK's adequacy regulations or on the International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, as set out in that supplier's data processing terms. Email us and we will tell you which mechanism applies to which supplier, and how to get a copy.
06
How long we keep it
While you are an active prospect — that is, while a conversation is actually going on. Once 30 days have passed with no contact either way, your request and the details attached to it are deleted. Nothing from the early-access list is kept longer than 12 months from the date you submitted it, whatever happens. If you become a customer, a separate notice will cover that relationship and its own retention periods, and we will give it to you before anything goes live.
Two deliberate exceptions: demo-call recordings and transcripts are deleted straight after the call, and if you unsubscribe or object we keep the minimum record needed to make sure we don't contact you again by accident.
07
Your rights
One email to hello@magicops.co.uk exercises any of these. We will respond within one month, and it is free. We may ask a question to confirm you are who you say you are, and nothing more.
AccessGet a copy of everything we hold about you.
RectificationHave anything wrong corrected.
ErasureHave it deleted. For a waiting-list entry there is no reason we would refuse.
RestrictionHave us pause using it while something is disputed.
PortabilityGet what you gave us in a machine-readable file.
Withdraw consentStop the launch emails, without affecting anything else.
Your right to object
You have the right to object to any processing we base on legitimate interests, and an absolute right to object to direct marketing — meaning that if you tell us to stop marketing to you, we must stop, with no balancing test and no argument. Say the word "stop" in an email to hello@magicops.co.uk and that is enough.
We make no decisions about you by automated means that have a legal or similarly significant effect on you, and we do no profiling. A human reads every early-access request.
08
Complaints
If you think we have handled your data badly, complain to us first — since 19 June 2026 that is how the law is set up, and we would rather fix it than have it escalated. Email hello@magicops.co.uk with "data protection complaint" in the subject line, in any form you like.
01We acknowledge it within 30 days of receiving it — in practice, within two working days.
02We look into it, keep you posted while we do, and tell you the outcome in plain language — normally inside a month, and within three at the outside.
03If you are not satisfied, you can take it to the Information Commissioner's Office. Complaining to us does not remove that right.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
09
Security, children, and changes
The site is served over HTTPS. The early-access list sits in an account protected by two-factor authentication, and only the controller named above has access to it. We hold no passwords and no card details, and we never will on this site. If a breach ever puts your rights at risk, we will report it to the ICO within 72 hours and tell you directly.
Magic is sold to businesses. The site is not aimed at children and we do not knowingly collect data about anyone under 18.
When this notice changes we update the version and date at the top. If a change materially affects you — a new purpose, a new recipient, a longer retention period — we will email everyone on the list rather than quietly editing the page.