Privacy Notice

1. About this notice

Magic Assembly runs two online services: our website at magicassembly.co (the “Website”) and the Software Ownership Assessment at assess.magicassembly.co (the “Assessment”). This notice explains what information we collect through each, how we use and share it, how long we keep it, and the choices you have.

It is organized in three parts:

• Both services: cookies, analytics, hosting, service providers, retention and security.
• Website: the contact form and other practices specific to magicassembly.co.
• Assessment: practices specific to assess.magicassembly.co.

We don’t sell personal information or share it for advertising.

2. Cookies, analytics and technical information

• Cookie. Both services use one first-party cookie, __Host-ms_visitor, set by our hosting platform. It holds a random visitor ID, lasts up to one year, and is used for session security, abuse prevention and counting unique visitors. It’s set on every visit. It isn’t used for advertising or to track you on other websites.
• Usage analytics. Both services use our hosting platform’s built-in analytics, which record page views, referring sites, browser and device type, and approximate location derived from your connection by our network provider. IP addresses aren’t stored in our analytics. For the Assessment, location is approximate to city level and analytics records are kept for about 90 days. Website analytics records are kept for a limited period under the platform’s standard settings. The Website also records three events, described in section 7.
• No advertising trackers. Neither service uses Google Analytics, advertising pixels, remarketing or social-media pixels.
• Error reports. If a page fails, an error report records technical details such as the page address and browser details. For the Assessment, error reports exclude query strings and IP addresses.
• Network connections. Like any website, your browser connects to our content delivery network, which receives your IP address and browser information to deliver the page.
• Fonts. Both services serve their fonts from our hosting platform, not from a third-party font service.
• Browser storage. The Website doesn’t use local storage or session storage. The Assessment saves your answers in your browser while you fill it in, as described in section 8.

3. Hosting and service providers

Both services run on a managed hosting platform. We share information only with providers that help us run them:

We may also disclose information if required by law, to protect rights and safety, or as part of a business transfer such as a merger or acquisition.

4. How long we keep information

Active records

• Website contact messages are deleted automatically 24 months after they are received.
• Assessment records, including your answers, report and any name and email, are deleted automatically 24 months after submission. When an assessment is deleted, its report link stops working.
• If you ask us to delete a record sooner, we’ll process the request once we’ve verified it.

Copies that remain for a time

Deleting a record removes it from the active database. Copies of its information remain in our providers’ systems for limited periods and aren’t deleted individually on request:

• Request logs, which contain the full content of each request, including Assessment answers and Website contact messages. For the Assessment the standard retention period is about 90 days. Website request logs are kept for a limited period under the platform’s standard retention.
• Database backups. For the Assessment: up to 7 days, and up to 28 days for encrypted backups in a second US region. The Website’s database is backed up by the same platform for a limited period.
• Website and pricing pages read by Scrapfly for the Assessment: about four weeks.
• Email delivery records (recipient, subject and status): about 90 days for Assessment emails. Our sending provider doesn’t keep Assessment message content. Website contact notifications use a fixed subject line that contains no details about you.
• Error reports: about 90 days for the Assessment, and a limited period for the Website.
• AI providers: as described in section 12.

Historical release snapshots

Our hosting platform keeps a copy of each service’s database every time we release a new version of that service. These snapshots are kept until the service’s application itself is deleted. Individual snapshots can’t be selectively purged, and individual records can’t be removed from them. If your assessment or contact message existed when a version was released, a copy of it may remain in that snapshot after the active record is deleted. Snapshots aren’t used to show reports or messages and aren’t restored when we roll back a release.

Development copies

When we work on either service, working copies of its database used for building and testing may include existing records. They are used only to develop and test the service.

Emails

Emails remain in the recipients’ inboxes, including ours, until they’re deleted. Messages you send us are kept for as long as needed to respond and to keep business records.

5. Security

Both services are served over HTTPS. Our hosting platform encrypts stored data and backups. Access to Website contact messages and Assessment records is limited to Magic Assembly and the providers that run the services. No internet service can guarantee absolute security.

6. The contact form

• What we collect. Your name, email address and message, which are required, and your company, which is optional.
• Where it goes. Your message is stored in the Website’s own database, separate from Assessment records, and emailed to Magic Assembly with your name, email, company, message and the time it was received. Our replies go to the email address you give us.
• Why. To read and reply to your message and keep a record of the conversation.
• Spam protection. To limit repeated messages, the form checks how many recent messages came from the same email address, using messages already stored. We don’t store your IP address with your message.
• How long. Contact messages are deleted automatically 24 months after they are received. Copies may remain for a time as described in section 4.
• Sending a message doesn’t add you to a mailing list.

7. Other Website practices

• Usage events. In addition to page views, the Website records three events: clicks on buttons that open the Assessment (which page and which button), clicks on example reports (which example and which page), and successful contact-form submissions (only that a message was sent). These events don’t contain anything you type into the contact form.
• Links to the Assessment. Links from the Website into the Assessment include labels showing which Website page you came from. They don’t identify you.
• No marketing. The Website has no newsletter, mailing list or email marketing, and no advertising pixels, remarketing or social-media pixels.
• No embedded services. The Website doesn’t embed chat, maps, video or scheduling tools.

8. Information the Assessment collects

• Assessment answers. Your company name, website, industry and number of employees; the software your business pays for, including what each tool is used for, prices, user counts, add-ons and extras, and implementation and support costs; the workarounds your team relies on and the time they take; and anything you write in the open text fields, such as frustrations, features you rely on or don’t use, integrations you need and your ideal workflow.
• Name and email. Only if you ask us to email you a copy of your assessment.
• Messages and requests. Information you choose to send us by email about your assessment, including privacy requests.
• Browser storage. While you fill in the Assessment, your answers are saved in your own browser so you don’t lose your work. They’re removed when your assessment completes or when you choose “Start over”.

The Assessment doesn’t ask for passwords, payment card details, government ID numbers or health information. Please don’t include passwords, personal financial information, confidential customer data or other sensitive information in your answers.

9. Information the Assessment creates

• Your report: calculated costs and projections, published software prices looked up for any cost you marked “Not sure” (with their sources), and an AI-generated verdict, confidence level and findings. Findings may quote short passages from your answers.
• Website content: if you give us a website address, the Assessment automatically reads publicly available text from that site. Up to 1,500 characters are stored with your assessment. If the site can’t be read, for example because it’s unavailable or blocks automated visits, nothing from it is used and the Assessment continues with your answers.
• Record details: submission and completion times, a reference number, your report’s unique link, and whether a copy was emailed.

10. How we use Assessment information

• To produce your assessment and report, and to email it to you when you ask.
• To review completed assessments. Magic Assembly receives every completed assessment, including your company details, answers and findings, whether or not you give us your name or email.
• To respond to your inquiries.
• To schedule meetings you book with us.
• To operate, secure and improve the Assessment, and to prevent abuse.

11. Assessment emails and follow-up

• Your copy. If you ask for an emailed copy, we send your assessment to the address you give us. It’s sent from noreply@assess.magicassembly.co, and replies go to info@magicassembly.co.
• Our notifications. Magic Assembly is notified by email of every completed assessment, with your company details, answers and findings, even if you don’t give us your name or email. If you request a copy, we’re also notified of your name and email.
• Follow-up. If you give us your contact details, Magic Assembly may follow up with you once about your assessment findings. Requesting a copy doesn’t add you to a marketing mailing list.

12. AI-assisted analysis

The Assessment calculates costs with fixed formulas and uses AI to evaluate your answers and write the verdict and findings.

• Anthropic (Claude) receives your assessment answers, including your company name and open-text answers, the calculated results and the text read from your website. Anthropic may keep these requests for up to 30 days for trust and safety purposes.
• Google Cloud (Gemini on Vertex AI) receives product names and the text of public software pricing pages, to look up published prices. These requests may be cached for up to 24 hours before being discarded.
• Your name and email address are not sent to AI models.
• Anthropic and Google provide these services under their commercial terms for business customers, which govern how they may use the information they receive.

AI-generated findings are informational. They may contain errors and don’t guarantee any financial or operational outcome.

13. Reports and shareable links

Each report has a unique, hard-to-guess link. Anyone with the link can view the report without signing in, including the business costs, operational details and findings it contains. Reports never show your name or email address.

Report links don’t expire automatically, and a single link can’t be switched off on its own. Deleting the underlying assessment disables its report. Report pages ask search engines not to index them, but that doesn’t make them private: anyone you share a link with, and anyone they forward it to, can open it. Share your link only with people you trust.

14. Booking a meeting

If you book a meeting through “Talk with Magic Assembly” in the Assessment, you use Google Calendar’s appointment scheduling. The booking calendar loads only when you open it. Google then receives your IP address and browser information, may set its own cookies, and collects the details you enter, under Google’s own privacy policy. We receive your booking in our calendar.

15. Your privacy rights and requests

You can ask us to access, correct or delete your information by emailing info@magicassembly.co. To help us find your records, tell us which service you used. For the Assessment, include your company name, the email you used (if any) and your report’s reference number or link. For a Website contact message, include the email address you sent it from. We may ask for information to verify your request.

When we receive a verified deletion request, we delete the record from our active database. Deleting an assessment also disables its report link. Copies in request logs, backups and historical release snapshots aren’t deleted on request; they remain for the periods described in section 4. Depending on where you live, you may have additional rights under applicable law, and we’ll respond to requests as that law requires.

16. Children

The Website and the Assessment are for businesses and aren’t directed to children under 16. We don’t knowingly collect information from children.

17. Changes to this notice

We may update this notice as our services change. We’ll post the updated notice here with a new effective date.

18. Contact

Magic Assembly
info@magicassembly.co
https://magicassembly.co