Privacy Policy

1. Who this policy covers

This policy applies to magisystems.ai and describes how MAGI Systems handles personal information collected through this website.

The effective date above is the date magisystems.ai became publicly available. This policy document was published on July 25, 2026, and describes the practices that have been in place since the site launched — we have never run analytics, advertising, or tracking on it, and have never sold or shared personal information.

It does not govern data we process on behalf of clients under a services agreement. When we perform security assessments, remediation, or engineering work inside a client environment, that data is handled under the terms of that contract and the client's own policies — we act as a service provider, and the client remains the controller of their data. Ask us for the applicable agreement if you need those specifics.

2. What we collect

This site has no analytics, no advertising tags, no tracking pixels, and no cookies set by us. The list below is complete.

We do not collect Social Security numbers, financial account details, government identifiers, precise geolocation, biometric data, or any category the CCPA classifies as sensitive personal information. We do not knowingly collect information from anyone under 16.

3. Why we collect it

• To answer you. Contact-form details are used to respond to your inquiry and, if it becomes a business conversation, to continue it.
• To keep the site running and secure. Server and CDN logs support availability, troubleshooting, and abuse prevention — including detecting automated submission attempts.

That is the complete list of purposes. We do not use your information for advertising, profiling, behavioral targeting, or automated decision-making, and we do not use it to train machine-learning models.

4. Who we share it with

We disclose personal information only to the service providers below, only for the operational purposes described, and only under contracts that bar them from using it for their own purposes.

We may also disclose information where legally required — in response to valid legal process, or to protect our rights, safety, or property. We will not disclose your information to any other third party without your consent.

5. We do not sell or share your personal information

6. How long we keep it

• Contact-form submissions: retained while we are in active conversation and for up to 24 months afterward, so we have context if you return. Then deleted.
• Server and CDN logs: retained on our providers' standard schedules, generally 30 days or less, then rotated out automatically.

We do not retain personal information longer than necessary for the purpose it was collected for. You can ask us to delete yours sooner at any time.

7. Your California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the following rights:

• Right to know. Request the specific pieces of personal information we hold about you, the categories collected, the sources, the business purpose, and the categories of third parties we disclosed it to — covering at least the preceding 12 months.
• Right to delete. Request deletion of personal information we collected from you, subject to the narrow exceptions the statute allows.
• Right to correct. Request correction of inaccurate personal information we hold about you.
• Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of — but the right stands, and our practice will not change without notice to you.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information, so this right has no application here.
• Right to non-discrimination. We will never deny service, charge a different price, or provide a different quality of service because you exercised a privacy right.
• Right to appeal. If we decline a request, you may ask us to reconsider, and we will respond in writing with our reasoning.

8. How to exercise your rights

Email jake@magisystems.ai with the subject line "Privacy Request" and tell us which right you are exercising. There is no form to fill out and no account to create.

What happens next

• We confirm receipt within 10 business days.
• We respond substantively within 45 calendar days. If we need longer, we will tell you why and take no more than 90 days total.
• Exercising these rights is free. We may decline requests that are manifestly unfounded or excessive, and if we do, we will explain why.

Verifying your identity

To protect you, we must verify a request before acting on it. Because the only information we hold is what you sent us, verification is usually straightforward: we ask you to send the request from the same email address used in your original submission. If we cannot verify you to a reasonable degree of certainty, we will tell you rather than release information to the wrong person.

Authorized agents

You may use an authorized agent. We will ask for written proof of authorization signed by you, and we may still ask you to verify your own identity directly with us.

9. Rights outside California

We apply the same process to everyone. If you are covered by another privacy law — the GDPR or UK GDPR, or a US state law such as Virginia's VCDPA, Colorado's CPA, or Connecticut's CTDPA — send the same request to the same address and we will handle it under the standard that applies to you. We do not maintain a lesser tier of privacy practice for people the statute happens not to cover.

10. How we protect your information

This site is served over HTTPS. Contact-form submissions travel over an encrypted connection and land in a mailbox protected by multi-factor authentication. Access is limited to the people who need it to respond to you.

The most effective control we apply is collecting almost nothing: there is no user database, no stored credentials, and no payment data on this website, so there is very little to lose. No system is perfectly secure, and we will not claim otherwise — but we would rather reduce the blast radius than describe it in stronger language than it deserves.

11. Changes to this policy

If we change this policy we will update the "Last updated" date at the top. For material changes — a new category of collection, a new recipient, or any change to the no-sale commitment above — we will say so prominently on this page rather than quietly revising the text.

12. Contact us

Questions about this policy, or about how we handle your information: