Privacy Policy

Data controller

Magic Payments España SL, registered in Spain, contact email hola@mgic.app, is the entity responsible for processing your personal data through this platform.

Data we collect

We collect the following information when you create an account or use our services:

• Full name
• Email address
• Phone number
• Date of birth (optional)
• Booking and attendance history
• Payment information (processed by Stripe, we do not store card data)
• Technical browsing data (IP address, device type, browser language)

Legal basis for processing

We process your data based on:

• Contract performance: to manage your account, bookings, payments and subscriptions.
• Consent: for sending push notifications and optional marketing communications.
• Legitimate interest: to improve the platform, prevent fraud and ensure service security.
• Legal obligation: to comply with applicable tax and legal obligations.

Purpose of processing

We use your information to:

• Manage your class bookings and packages
• Send you confirmations, reminders and studio notifications
• Process payments and issue receipts
• Improve the platform experience and develop new features
• Respond to your inquiries and provide technical support

Data sharing with studios

When you register at a studio through the platform, your profile data (name, email, phone, booking and attendance history) is shared with that studio so they can manage your relationship as a client: contact you, manage your bookings, handle check-in and provide a personalized service. Each studio only has access to the data of its own clients.

Data processors

We share data with the following service providers who act as data processors under our instructions:

• Stripe Inc. (USA) — payment processing
• Resend Inc. (USA) — transactional email delivery
• Supabase Inc. (USA) — file and image storage

We do not sell or transfer your personal information to third parties for commercial purposes.

International transfers

Some of our service providers (Stripe, Resend, Supabase) are located in the United States. These transfers are carried out under the safeguards established by the GDPR, including Standard Contractual Clauses approved by the European Commission and/or the EU-US Data Privacy Framework.

Data retention

We retain your personal data for as long as you maintain an active account on the platform. Once you request account deletion, your data will be deleted or anonymized within a maximum of 30 days, unless there is a legal obligation to retain it (e.g., tax data for the legally established period).

Cookies

We use only essential cookies to keep your session active, remember your language preferences and ensure the platform functions properly. We do not use advertising tracking cookies or third-party analytics.

Your rights

Under the GDPR and LOPDGDD, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data.
• Portability: receive your data in a structured, commonly used format.
• Object: object to the processing of your data for reasons related to your particular situation.
• Restriction: request the restriction of processing in certain circumstances.

You can exercise these rights by contacting us at hola@mgic.app or from the profile section of the platform.

Supervisory authority

If you consider that the processing of your data does not comply with regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Contact

For any privacy inquiries, contact Magic Payments España SL at hola@mgic.app.