Privacy Policy

Actual Magic, Inc. ("Actual Magic," "we," "us") builds an AI-assisted SEO and AI-visibility workspace at app.actualmagic.ai. This Privacy Policy explains what we collect, what we don't, how we use it, and your rights.

1. Data we collect

Account data

• Your email address and any name you provide.
• Authentication information from your Google account (via OAuth) when you sign in or connect Google Search Console.
• Billing information processed by our payment provider (Stripe) — we never store full card numbers; Stripe holds them.

Data accessed via Google APIs (with your authorization)

• Google Search Console: the properties you own or manage, search query and performance data (queries, clicks, impressions, position), and sitemap data — read-only, used to surface keyword opportunities and content gaps. We never modify your Search Console data.
• OAuth refresh tokens, encrypted at rest, used to call the Search Console API on your behalf only when you actively use the app.

Data you create in the app

• Target keywords, custom prompts, content briefs, and any drafts you produce.

Usage and diagnostic data

• Standard server logs (IP address, user-agent, request paths, timestamps) used to operate, secure, and debug the service.
• Analytics events on aggregate product usage (page views, feature interactions). We do not link analytics to identifiable end-users of your customers.

2. Data we do not collect

• We do not aggregate or compare one customer's Google Search Console data with another's.
• We do not sell, rent, or share your data with advertisers.
• We do not use Google API user data to train generalized ML/AI models.

3. How we use your data

• To operate the service: read your Google Search Console data when you actively use a feature; draft content for your review and approval; track rank and visibility metrics over time on your behalf.
• To bill you for paid plans.
• To communicate service notices (security, billing, material changes to this policy) and product updates you've opted into.
• To debug and improve the service in aggregate, anonymized form.

4. Limited Use of Google API data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google API data only to provide and improve user-facing features in Actual Magic.
• We do not transfer Google API data to third parties except as necessary to provide the service (e.g., infrastructure providers under contract), to comply with applicable law, or with your explicit consent.
• We do not use Google API data for serving ads.
• We do not allow humans to read Google API data unless we have your affirmative agreement for specific data or it is necessary for security, to comply with applicable law, or our use is for internal operations and the data has been aggregated and anonymized.

5. Read-only Google access; drafts, never auto-publish

Our Google Search Console access is read-only — we never write to, modify, or delete anything in your Search Console account. The app generates content drafts for your review; we never publish anything on your behalf without your explicit per-action approval.

6. Storage, retention, and deletion

• Account data is stored in our managed Postgres database (hosted on Supabase, US region) and encrypted at rest.
• OAuth tokens are encrypted at the application layer in addition to database-level encryption.
• Cached Google Search Console data is refreshed on use and not retained beyond 30 days, consistent with Google's API caching policy.
• You can delete your account at any time by emailing support@actualmagic.ai. We delete account and Google API data within 30 days of the request, except where retention is required by law (e.g., billing records).
• You can revoke Actual Magic's access to your Google account at any time at myaccount.google.com/permissions.

7. Sharing data with third parties

We share data only with infrastructure and tooling providers necessary to operate the service:

• Hosting and database: Railway, Supabase.
• Payments: Stripe.
• Email: our transactional email provider, only for service notices and product communications.
• AI processing: Anthropic (Claude), OpenAI, Google (Gemini), and Perplexity, used to generate drafts, classifications, and embeddings on the data you submit. These providers act as data processors and do not retain inputs for training in the configurations we use.

We do not sell, rent, or trade your data. We do not share your data with advertisers.

8. Security

We use industry-standard practices: encryption in transit (TLS), encryption at rest, scoped access tokens, least-privilege database roles, and audit logging. No system is perfectly secure; if we discover a breach affecting your data we will notify you promptly and consistent with applicable law.

9. Your rights

You can request access, correction, export, or deletion of your data by emailing support@actualmagic.ai. If you are in the EEA, UK, or California, you have additional rights under the GDPR, UK GDPR, and CCPA, respectively, including the right to object to certain processing and the right to lodge a complaint with a supervisory authority.

10. Children

Actual Magic is not directed to children under 13 (or under 16 in jurisdictions that require it). We do not knowingly collect data from children.

11. International transfers

We process and store data in the United States. If you access the service from outside the US, your data is transferred to and processed in the US.

12. Changes to this policy

We will update this page when our practices materially change and will notify you by email or in-app notice for substantive changes.

13. Contact

Questions or requests: support@actualmagic.ai.

Actual Magic is an independent tool. We are not affiliated with, endorsed by, or sponsored by Google. "Google Search Console" is a trademark of Google LLC.