Privacy Policy

• Controller: Esther Jimenez Ramos.
• Spanish tax identification number (NIF): 75899745K.
• Email: info@magicalproxy.com.

Data Protection Officer: none appointed, unless this becomes a legal requirement in the future.

• Account and authentication: name, email and login identifier to create and maintain your account. Legal basis: performance of the requested relationship.
• Purchase and delivery: products, amounts, addresses, telephone number, NIF when provided and payment references needed to process your order. Legal basis: performance of a contract.
• Billing, accounting and consumer-law obligations: order and invoice data. Legal basis: compliance with legal obligations.
• Contact, support, returns and complaints: identity, contact details, message content and supporting evidence. Legal basis: performance of a contract, legal obligations and our legitimate interest in handling and defending claims.
• Security and fraud prevention: technical data, IP address or identifiers needed to limit abuse and protect the service. Legal basis: legitimate interests and, where applicable, legal obligations.
• Browsing analytics: analytics session, pages, products, basket activity, approximate country, language, time zone and device. Legal basis: prior consent.

We do not make decisions that have legal effects based solely on automated processing. Data marked as required is needed to create an account, answer a request or complete an order. Without it, we cannot provide that part of the service.

• Information you enter when creating an account, placing an order, saving an address or contacting support.
• Order, payment-status and delivery information generated while providing the service.
• Authentication details returned by Google or another sign-in provider only when you choose that method.
• Technical and analytics information generated by your device or browser, with consent where it is required.

Payment card details are entered directly into Stripe's payment environment. Magical Proxy receives payment references and status information, not the complete card number.

Please keep account, billing and delivery information accurate and up to date. If you provide another person's details as a recipient or contact, you must be authorized to do so and inform them that their data will be used to fulfil and deliver the order. We may ask you to correct or verify information where this is reasonably necessary for payment, fraud prevention, delivery or compliance with law.

Depending on the service used, data may be processed by:

• Supabase, for database, authentication and storage services (EU region: Ireland).
• Stripe, for payment processing and fraud prevention.
• Resend, for transactional and support emails (sending region: Ireland).
• Vercel, to host and serve the application (server functions in Ireland; static content cached worldwide).
• Upstash, for request rate limiting and protection against abuse (EU region: Ireland).
• Cloudflare, for domain DNS, forwarding emails sent to our addresses and bot protection (Turnstile) on sign-in, registration and contact forms.
• Google or Meta/Facebook, only when a user chooses to sign in through that provider.
• Carriers, advisers, financial institutions and public authorities when necessary for delivery or required by law.

We do not sell personal data. We use EU (Ireland) regions wherever the provider offers them. Some providers are based in the United States or operate worldwide infrastructure, so personal data may be accessed from or transferred outside the EEA. In those cases we rely on the EU-US Data Privacy Framework where the provider is certified, the Standard Contractual Clauses in the provider's data-processing terms, or another valid safeguard.

If the business is reorganized, transferred or sold, relevant data may be disclosed to professional advisers and a potential successor only where lawful, necessary and subject to appropriate confidentiality. Any successor may use it only for compatible purposes or another valid legal basis.

Service messages about accounts, payments, security, deliveries, returns and support are sent because they are necessary to provide the requested service or comply with law. They are not promotional communications and cannot always be disabled while the relevant service is active.

Marketing messages will be sent only with consent or where the law permits contact with an existing customer about similar Magical Proxy products. Every marketing message will provide a simple and free way to opt out. Withdrawing from marketing does not affect transactional messages.

• Account data: while the account remains active and until deletion is requested, except for data retained to comply with legal obligations.
• Orders, invoices and commercial or tax records: for the periods required by applicable law and the limitation periods for potential liabilities.
• Enquiries, support and complaints: while they are handled and subsequently for as long as needed to address potential liabilities.
• Consent-based analytics: for a maximum of 14 months, unless anonymized sooner.
• Cookie preference: for up to 24 months, after which a new choice will be requested.
• Security logs: for a proportionate period needed to detect abuse or manage an incident.

We apply technical and organizational measures proportionate to the risks, including access controls, encrypted transport, restricted administrative access, backups and monitoring intended to protect confidentiality, integrity and availability. No internet service can guarantee absolute security. Please use a unique password, protect your sign-in method and notify us promptly if you suspect unauthorized access.

If a personal-data breach is likely to create a risk to individuals, we will assess, document and notify it to the competent authority and affected people where required by law.

The store is not directed at children under 14 and we do not knowingly rely on their own consent to process personal data. A minor must have any authorization required from a parent or legal guardian to create an account or place an order. A parent or guardian who believes that a child provided data without the required authorization may contact us to request its review or deletion.

You may request access, rectification, erasure, restriction, objection and data portability, or withdraw consent without affecting earlier lawful processing. Send your request to info@magicalproxy.com and state which right you wish to exercise. We may request reasonable information to verify your identity.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

We will update this policy when the purposes, providers or legal requirements change. If a change is material, we will provide appropriate notice before it takes effect.