Privacy Policy

Who operates MagicFlux

MagicFlux is currently built and operated directly by its founders, Brahim Beldjilali and Mohamed Nassim, from Algeria. MagicFlux is not currently organized as a separate registered company, and this policy does not state a company registration number, registered office, or VAT/tax identifier, because none exists yet. This will be addressed before any paid or general-availability launch — see “A note on legal review” at the end of this page.

What we collect

• Account information. Your email address and authentication credentials are managed by our authentication provider, Supabase — we never see or store your plaintext password.
• Automation prompts and descriptions. The text you write describing the automation you want, whether in the guided builder or the AI chat.
• Workflow configuration. The workflows you build — their name, description, node structure, and which integrations they use.
• Execution data and logs. When a workflow runs (as a test or live), we store its status, timestamps, retry count, error messages, and the input/output data for that run. Because this reflects what your automation actually did, it can include data that passed through a connected third-party service (for example, the contents of a Shopify order or a Slack message your workflow processed).
• Integration credentials. API keys or tokens you connect via Settings → Integrations are encrypted at rest (AES-256-GCM) before storage and are used only to run your own workflows.
• Feedback. If you submit feedback, we store its category, optional 1–5 rating, optional comment, the page you were on, and the app version — tied to your account.
• Aggregate Beta usage metrics. Our founders can see Beta-wide counts (signups, workflows created, executions, feedback volume/average rating) to understand how the Beta is going. These are counts only — this dashboard does not expose your individual prompts, workflow contents, or credentials.
• Session cookie and browser storage. One first-party cookie (mf_access_token) keeps you signed in; our authentication library also keeps a session token in your browser's local storage. A couple of interface preferences (like your last-used builder mode) are stored locally in your browser and are never sent to us. We do not use third-party analytics, advertising, or tracking scripts on MagicFlux today.
• Webhook request logs. If a workflow you build has a webhook trigger, we log the source IP address of requests made to that webhook (not your own browsing activity) to detect abuse and enforce any IP allowlist you configure.
• Security event logs. We log security-relevant events (for example, a suspected prompt injection attempt or repeated rate-limit violations) tied to your account, to protect the platform from abuse.

How AI generation works

When you describe an automation, MagicFlux sends your prompt text — along with a structured summary of the detected intent and, for the conversational builder, the current workflow structure — to OpenAI (currently GPT-4o family models) to generate or refine the workflow plan. This is necessary for the AI generation feature to work at all. OpenAI processes this under its own terms and privacy policy as our AI infrastructure provider.

Please don't paste real API keys, passwords, or other secrets directly into the AI chat. If you do, that text is sent to OpenAI as part of the conversation, because the assistant can ask to validate a credential you've typed there. Connecting an integration through Settings → Integrations instead keeps the value encrypted and out of any AI prompt entirely — that is the path we recommend.

How workflows and executions are stored

Workflows and their execution history are stored in our Postgres database (hosted by Supabase), scoped to your account. Access to this data is enforced both at the database level (row-level security) and in every API route that reads or writes it (explicit ownership checks) — including for our own founders, whose administrative access does not extend to reading other users' private workflow or execution data.

Integrations and credentials

Credentials for third-party integrations (for example Shopify, Slack, Airtable, Gmail, or Google Drive) are encrypted at rest and used exclusively to run automations you configure, on your behalf. We do not use your connected credentials for any purpose other than running the workflow you built, and we do not share them between accounts.

Feedback and Beta metrics

Feedback you submit is visible to our founders so we can act on it, and its rating (if any) feeds into an aggregate average shown on an internal Beta dashboard. It is not shared outside MagicFlux and is not linked to any public profile.

Third-party service providers we use

• Supabase — database, authentication, and file storage infrastructure.
• OpenAI — AI generation, as described above.
• Vercel — application hosting.
• Whichever integrations you connect yourself (Shopify, Slack, Airtable, Gmail, Google Drive, or a custom API) — your automation exchanges data directly with those services according to how you configure it.
• Stripe is integrated in our codebase for potential future billing but is not active today — no payment information is collected or processed, because paid plans are not currently purchasable.

Security practices we actually have in place

• Integration credentials are encrypted at rest with AES-256-GCM.
• An automated redaction layer strips secret-looking fields (API keys, tokens, passwords, authorization headers) from logs and error records before they are stored or displayed.
• Row-level security and explicit per-account ownership checks isolate your data from other accounts, including administrative accounts.
• Rate limiting on feedback submission and on AI/automation actions to reduce abuse.
• Custom code execution (a “Code”/“Function” node) is not offered — it is blocked at every layer, not merely hidden in the interface.

We do not claim certifications (such as SOC 2 or ISO 27001) or formal regulatory compliance (such as GDPR) at this stage — none has been obtained or independently verified, and we won't claim one until it has been.

Your choices and rights

You can review, edit, and delete your own workflows directly in the product today. For anything without a self-service control yet — including full account deletion, correcting a specific stored record, or requesting an export of your data — email hello@magicflux.ai and we will handle it manually. We do not yet have an automatic self-service data export or account-deletion button; we're telling you that plainly rather than implying one exists.

Contact

Questions about this policy or your data: hello@magicflux.ai.

Changes to this policy

We'll update the “Last updated” date at the top of this page whenever this policy changes. If we make a material change, we'll make a reasonable effort to bring it to your attention (for example, a notice on the site) before it takes effect — we don't currently have a guaranteed email-notification mechanism for policy changes, so we won't promise one.