Privacy Policy

Last updated: March 22, 2026

1. General Information

Magic CRM is a product operated under the Mind2Magic brand by Matías Carvajal García, a natural person domiciled in Cali, Valle del Cauca, Colombia, identified with Cédula de Ciudadanía No. 14.467.474 and Número de Identificación Tributaria (NIT) 14.467.474-3 ("we", "our", "us"). For purposes of Colombian Law 1581 of 2012, Matías Carvajal García is the Data Controller (Responsable del Tratamiento).

This Privacy Policy describes how we collect, use, store, and protect information when you use our CRM platform, including integrations with WhatsApp, Facebook Messenger, Instagram, and other Meta services.

By using Magic CRM, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Company or organization name
• Industry or sector
• Phone number (optional)
• Billing and payment information (processed by Stripe)

2.2 Your Business Data

Within the platform, you store:

• Contacts and leads (names, emails, phone numbers, notes)
• Communication history with your customers
• Pipelines, stages, and sales statuses
• Attachments and documents
• Tasks, reminders, and activities

2.3 Meta Platform Data

When you connect your Meta accounts (Facebook, Instagram, WhatsApp Business), we may access:

• Messages received from your customers through Facebook Messenger, Instagram Direct, and WhatsApp Business
• Basic information from your Facebook Page and Instagram Business profile
• Lead data generated by Facebook/Instagram Ads (Lead Ads)
• Basic campaign metrics

This data is obtained exclusively through Meta's official APIs, with your explicit authorization, and is used only for the CRM functions you activate.

2.4 Usage Data

We automatically collect:

• IP address and browser type
• Pages visited and features used within the platform
• Date and time of access
• Device type

3. How We Use Your Information

We use the collected information to:

• Operate and maintain the Magic CRM platform
• Manage your account and process payments
• Centralize your customer communications from multiple channels (WhatsApp, Messenger, Instagram) in one place
• Provide AI features to suggest responses to customer messages (AI Suggester)
• Generate sales analytics and reports for your business
• Capture leads from Facebook/Instagram forms and ads
• Manage and optimize advertising campaigns on Meta
• Send service notifications (never spam)
• Improve the platform and develop new features
• Comply with legal obligations

We never sell, rent, or share your personal data or your customers' data with third parties for marketing purposes.

4. Meta Data - Specific Usage

4.1 Messages (WhatsApp, Messenger, Instagram)

Messages received from your customers are stored in your CRM workspace so you can manage them. We do not read, analyze, or use these messages for any purpose beyond displaying them to you and, if you enable the feature, generating AI response suggestions.

4.2 Facebook Pages & Instagram Data

We access your page information solely to enable you to manage messages and leads. We do not post content on your behalf without your explicit action.

4.3 Ad Lead Data

Leads captured through Meta Lead Ads are imported into your CRM pipeline. This data belongs to your business and is handled according to this policy.

4.4 Advertising Campaign Data

We access campaign metrics to show you reports within the CRM. We do not modify or create campaigns without your direct action.

4.5 Meta Data Deletion

When you disconnect your Meta account from Magic CRM, we delete all data obtained through Meta's APIs within 30 days. You may also request immediate deletion by contacting us.

4.6 Meta Compliance

We comply with Meta's Platform Terms, including:

• We do not share Meta data with third parties without authorization
• We do not use Meta data for targeted advertising without consent
• We do not store Meta data beyond what is necessary for the service
• We respond to Meta's data deletion requests (Data Deletion Request Callback)

5. Artificial Intelligence

Magic CRM uses artificial intelligence to:

• Suggest responses to customer messages (AI Suggester)
• Learn your business's communication tone and style (Voice Learning)
• Automatically classify leads

How it works:

• We use language models provided by Anthropic (Claude) to generate suggestions
• Your communication history is used as context to personalize suggestions
• Data sent to the AI model is not used to train models
• AI suggestions always go through your approval before being sent to customers (except in autonomous mode, which requires explicit activation)

You control:

• You can disable AI features at any time
• You can choose between suggestion mode (requires approval) and autonomous mode
• You can define a list of contacts that AI should never contact (Safe List)

6. Third-Party Services

To operate Magic CRM, we use the following providers:

Each provider is subject to their own privacy policies. We only share the minimum information necessary for each service to function.

7. Data Security

We protect your information with:

• Encryption in transit (HTTPS/TLS on all connections)
• Encryption at rest in the database
• Secure authentication with JWT tokens
• Role-based access control (Row Level Security)
• Meta access tokens stored in encrypted form
• Regular backups
• Access monitoring and unusual activity detection

No system is 100% secure. If we detect a security breach, we will notify you within 72 hours.

8. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of cancellation.
• Business data (leads, messages, pipelines): Retained while your account is active. You can export or request deletion at any time.
• Meta data: Deleted within 30 days if you disconnect your Meta account, or immediately upon request.
• Payment data: Stripe retains transaction data per their own policies. We do not store card numbers.
• Usage logs: Retained for a maximum of 90 days.

9. Your Rights

Depending on your location, you have the right to:

For all users:

• Access your personal data
• Correct inaccurate information
• Delete your account and associated data
• Export your data in a portable format
• Disable AI features
• Disconnect Meta integrations

Users in Colombia (Law 1581 of 2012):

• Know, update, and rectify your personal data
• Request proof of consent granted
• Revoke consent and/or request data deletion
• File complaints with the Superintendence of Industry and Commerce (SIC)

Users in the European Union (GDPR):

• Right of access, rectification, erasure, and portability
• Right to restrict or object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a data protection authority

Users in the United States (CCPA/CPRA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt out of the sale of data (we do not sell data)
• Right to non-discrimination for exercising these rights

To exercise any right, contact us at privacy@magiccrm.app.

10. International Transfers

Your information may be processed on servers located outside your country of residence, including the United States. We use providers that comply with international data protection standards and maintain contractual clauses that protect your information.

11. Children

Magic CRM is a service for businesses and professionals. It is not directed at individuals under 18 years of age. We do not knowingly collect data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

12. Cookies and Similar Technologies

Magic CRM uses:

• Essential cookies: To keep your session active and remember your preferences (theme, language)
• Local storage: To save interface preferences

We do not use tracking cookies, advertising cookies, or third-party analytics. We do not track your activity outside the platform.

13. Changes to This Policy

We may update this policy periodically. If we make material changes, we will notify you by email or through a notice on the platform at least 30 days in advance. Continued use after changes constitutes acceptance.

14. Data Deletion - Meta Data Deletion

If you want us to delete all data that Magic CRM has obtained from Meta about you or your business, you can:

1. Go to Settings → Integrations → Disconnect Meta
2. Send an email to privacy@magiccrm.app with the subject "Data Deletion Request"
3. Use the data deletion link provided by Meta in your Facebook/Instagram account settings

We will confirm deletion within 5 business days.

15. Contact

For privacy questions, data requests, or any concerns:

Email: privacy@magiccrm.app
Data Controller: Matías Carvajal García (operating under the Mind2Magic brand)
Address: Cali, Valle del Cauca, Colombia
Response time: Maximum 15 business days (10 days for requests under Colombian Law 1581 of 2012)