Privacy Policy

Who this policy covers

• Shops — the businesses that sign up for Magga and connect a Facebook Page (“Customer” in the terms below).
• Customers of a shop — people who message a shop’s Page and are answered by its assistant (“End User”).
• Staff a shop invites to its account.
• Visitors to magga.app, including people who fill in our contact form.

Who is responsible for what

A shop that uses Magga decides what it sells and what its assistant says. Magga processes that shop’s data on its instructions — in data-protection terms, the shop is the controller of its customers’ data and Magga is the processor. For a customer messaging a shop, the shop is the business you are dealing with; Magga is the software it uses. The shop is responsible for telling its customers how it uses their data and for answering their requests about it; we help it do so.

What we collect from a shop

• The account email and password used to sign in. Passwords are stored hashed by our authentication provider; we never see them.
• The shop name, business type, phone number and how it currently records orders — asked once at sign-up or during setup.
• Products, services, prices, stock levels, promotions and any columns the shop chooses to keep, including files it uploads.
• The instructions the shop writes for its assistant, and the knowledge it adds.
• Payment records — the plan or top-up bought, the amount, the payment method (KBZPay, Wave, bank transfer) and a transaction reference. We do not store card numbers.
• A Facebook Page access token, when the shop connects a Page. It is stored in a table no browser can read and is used only to receive and send that Page’s messages.
• A Telegram chat ID, if the shop chooses to receive notifications there.
• Usage and error logs — which features were used, when a reply was sent, how many credits it cost, and errors we need to fix.

What we collect from a customer messaging a shop

• The message text you send to the shop, and any photo or file you attach.
• Your Facebook page-scoped ID (PSID) and the name shown on your Facebook profile. A PSID is specific to that one Page and cannot be used to identify you elsewhere.
• The replies the assistant sends you, and the time each message was sent.
• Delivery details you give the shop — name, phone, address — when you place an order or ask the shop to call you back.

We do not read your Facebook profile beyond your name, we do not access your friends, posts or photos, and we do not use your messages to advertise to you.

Why we use it

• To answer your message with the shop’s real prices and stock.
• To record the shop’s orders, leads and its credit usage.
• To show the shop its own conversations so a person can take over when needed, and to notify the shop when the assistant hands over.
• To bill the shop and keep payment records.
• To keep the service working — error logs, abuse prevention, and security.
• To contact a shop about its account, and — only if it asked us to — about new features.

Our legal bases are the contract with the shop, the shop’s and Magga’s legitimate interest in running the service securely, legal obligations such as tax records, and consent where we ask for it.

The AI models we use

• DeepSeek — writes the reply. The message text, the recent conversation and the matching catalogue and knowledge rows are sent to generate an answer.
• Google Gemini — reads photos a customer sends (for example a payment slip or a product photo) and describes them to the assistant.

We send only what a reply needs; never a shop’s whole database. We do not use a shop’s data, or its customers’ messages, to train any AI model, and we do not share one shop’s data with another. If we change providers we will update this list. AI replies can be wrong; the shop remains responsible for the orders it accepts and can correct the assistant at any time.

Who we share it with (sub-processors)

We do not sell data. We share only what a step requires, with:

• Supabase — database, authentication and file storage (Singapore region).
• Vercel — application hosting.
• DeepSeek and Google — the AI models described above.
• Meta — to receive and send Messenger messages.
• Resend — to send account and invitation emails to shops.
• Telegram — to send notifications to a shop that connected it.

Magga staff do not read a shop’s conversations or orders except to fix a problem the shop asked us to look at. Any use of shop data beyond running that shop’s own service requires the shop to opt in, and produces only aggregated, anonymised output covering many shops — never one shop’s numbers and never a customer’s identity.

We may also disclose data when Myanmar law or a lawful order requires it, limited to what is required, and we will tell the shop when we are permitted to.

How long we keep it

• Messages and conversations: kept while the shop’s account is active, so it can serve you and answer questions about your order.
• Orders and leads: kept for as long as the shop needs them for its own records and tax obligations.
• A shop that stops paying: its data and unused credits are held for 60 days so it can restart, after which the credits expire.
• A closed shop account: its data is deleted within 90 days, except payment records we must keep for tax purposes.
• Website contact-form enquiries: kept for 12 months.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Deletion is self-serve and immediate — see Delete my data. When an order exists, we keep the order but remove your name, phone and address from it, because a shop is entitled to its own sales record. For anything else, email us; we answer within 30 days.

Security

• Each shop’s data is separated inside the database itself, not only in application code.
• Facebook Page tokens and service keys are stored where no browser request can reach them.
• Every Messenger webhook is verified against Meta’s signature before it is accepted.
• Connections are encrypted in transit; data is encrypted at rest by our hosting providers.
• If a breach affects personal data, we will tell affected shops within 72 hours of confirming it, with what was affected and what we did.

What a shop agrees to

• Tell your customers they are talking to an AI assistant where the law or Meta’s policies require it. The assistant says so itself in its first message.
• Follow Meta’s Platform Terms and Messenger policies — no messaging people who did not write to your Page first.
• Only upload data you are entitled to use.
• Answer your customers’ requests about their data, and tell us promptly if your account is compromised.

International transfers

Magga is based in Myanmar. Data is stored in Singapore and processed by the providers above, some of which operate in other countries. Each is bound by its own data processing terms and encrypts data in transit.

Children

Magga is a business tool and is not directed at children under 13.

Governing law

This policy is governed by the laws of the Republic of the Union of Myanmar. Disputes are handled as set out in our Terms of Service.

Changes

If this policy changes materially we will tell shop owners in the dashboard at least 14 days before the change takes effect. The version and date at the top show the current revision.

Contact

Questions or requests: hello@magga.app. Complaints or anything that needs a person: min@magga.app · Magga AI, Yangon, Myanmar · Monday–Saturday 9:00–18:00 (MMT)