Privacy Policy

MagicMoon is a print-on-demand platform that lets you generate AI designs, manage your shops and publish products to sales channels. For questions about this policy or your data, contact us at contact@magicmoon.ai.

The data controller is MAGICMOON, a French société par actions simplifiée (SAS) with its registered office at 59 rue de Ponthieu, 75008 Paris, France, SIREN 100 511 690, VAT FR09 100 511 690. Full company details are available in our legal notice.

Account data: your email address and authentication identifiers, managed through our authentication provider, and, if you sign up with Google, the name and profile picture of your Google account.

Content you create: the designs and prompts you generate, your shop and channel configuration, and the connection tokens for the stores and suppliers you link (e.g. Shopify, Etsy, Printify, Gelato).

Payment data: payments are processed by our payment provider Stripe, through its Managed Payments service. With this service, you deal with Link (Sold through Link, LLC) when you pay, on your receipts, invoices and refund notifications, and for payment support: your purchases appear as sold through Link, and the charge appears on your bank statement under LINK.COM*. Stripe and Link receive the payment details you enter (such as your name, email address, billing address and payment method) and use them as described in their own privacy notices. We never store your full card number. If you ask for the deletion of your data related to these payments, Stripe cancels any subscription bought through this service.

Referral data: if you arrive through a partner’s link or enter a creator code, the partner reference and the time of the referral, so that your sign-up can be attributed to the partner who recommended MagicMoon.

Waitlist data: if you join our waitlist, your first name, your email address, your language and how you found us (source, campaign and referring page). If you later create an account with the same email address, we note on your account that you joined from the waitlist.

Sign-up origin data: if you create an account, where your first visit came from (campaign parameters, the name of the website you came from without the page address, and the page you landed on), as recorded by the mm_src cookie described below, so that we know where our sign-ups come from.

Technical and usage data: IP address, device and browser information, pages visited and interactions with the interface, including session recordings and heatmaps (see the next section).

We use Microsoft Clarity to understand how the product is used and to improve it. Clarity records anonymized interaction data such as clicks, scrolls, navigation and session replays, and produces heatmaps. By default, Clarity masks text and form inputs in recordings, so the content you type is not captured.

We use Google Analytics 4 (provided by Google) to measure traffic and understand where our visitors come from. Google Analytics runs with Google Consent Mode v2: until you accept, it stays in a denied state and does not write its cookies (such as _ga). We do not use it for advertising or remarketing.

We use PostHog for product analytics, for example conversion funnels and feature usage. PostHog is hosted on its European Cloud, so this data is stored in the European Union.

Microsoft Clarity only starts once you have accepted audience measurement in our consent banner. Google Analytics and PostHog are loaded on every page, but stay restricted until you accept: the Google tag sets no Google Analytics cookie and only sends Google cookieless signals, used for aggregate modeling; PostHog sends no event, but may contact its servers to load its settings and may keep a technical identifier in your browser. When you are signed in, your choice is also saved in your account, so that the events our servers send to PostHog follow it. You can change or withdraw your choice at any time through the "Manage cookies" link in the footer. Microsoft, Google and PostHog act as processors and may combine this data per their own terms; you can also opt out of cross-site tracking via your browser settings.

Essential cookies: required for authentication and to keep you signed in. These are always active.

Audience measurement cookies: Google Analytics and Microsoft Clarity set their cookies only after you consent. PostHog may keep a technical identifier in your browser before you choose, but measures nothing until you accept. You can withdraw your consent at any time via "Manage cookies" in the footer.

We also store your cookie choice itself in your browser (an entry named mm_consent, copied into a cookie of the same name so that our servers can respect it) so we can remember it; this is strictly necessary and not used for tracking.

Referral cookies: when you arrive through a partner’s link (an address carrying ?via=) or enter a creator code, we store the partner reference in a cookie named mm_aff and its origin (link or code) in a cookie named mm_aff_src, for 60 days after your last visit through such a link. They are used only to attribute your account to the partner who recommended MagicMoon, never for advertising, and are treated as necessary for the operation of our partner program.

Short link cookie: our own short links (addresses starting with /go/) set a cookie named mm_ref, for 90 days, to measure which of our campaign links led to a sign-up. It identifies no partner and is never used for advertising.

Origin cookie: when you first arrive through a campaign link or from another website, we store the source of that visit (campaign parameters, the name of the referring site without the page address, the page you landed on and, if it exists, the visit identifier described below) in a cookie named mm_src for 90 days. If you create an account, this origin is attached to it so that we know where our sign-ups come from. It is never used for advertising.

Visit identifier: on our home page, we keep a random identifier named mm_visitor_id in your browser and record your visit (source, campaign, referring page and browser type, without your IP address), to measure where our visitors and sign-ups come from. It is never used for advertising.

Technical cookies: access_granted and mm_access remember, for 30 days, that you entered an access code while the site was in private access; mm_currency remembers, for one year, the currency you chose; and etsy_code_verifier secures the connection of your Etsy shop for 10 minutes. They are strictly necessary and not used for tracking.

We rely on trusted providers to operate the service, each acting as a processor: Supabase (database and authentication), Cloudflare, Vercel and Google Cloud (hosting, file storage, image processing and content delivery), Brevo (sending our emails, including the waitlist), Microsoft Clarity, Google Analytics and PostHog (analytics), OpenAI (writing product titles, descriptions and tags from your designs and product information, and analyzing the reference images of your styles), Ideogram (generating images from your prompts, and removing backgrounds), Picsart (upscaling, effects, filters, format conversion, logo generation from your text, and background replacement with a color), Replicate (backup processing for some AI features), FirstPromoter (Igil Webs SRL, Romania: our partner program; it receives your account identifier when a partner recommended you, and, through its Stripe integration, it has access to the account identifier we record on every Stripe customer, the email address and the amounts of the purchases of every paying customer, to calculate our partners’ commissions), Slack (internal operational alerts, which may include your account identifier), and the POD suppliers and sales channels you choose to connect (Printify, Gelato, Shopify, Etsy, WooCommerce).

For AI features, we only send these providers what the task requires: your prompt, the images concerned and, for descriptions, the product information.

These providers only process your data to deliver their part of the service.

Payments are handled by Stripe and Link, as described in the Data we collect section.

Your profile is private by default. If you make it public in your settings, anyone can see it at magicmoon.ai/u/ followed by your username, and search engines may index it. It shows your username, your avatar (the profile picture of your Google account, if you signed up with Google), your bio, website, social links and sign-up number, never your name or your email address. We count visits to your public profile without recording who visits it. You can make it private again at any time.

If you are one of our first hundred paying subscribers (the Founders), your seat appears as taken on the public Founders wall (magicmoon.ai/top/founders), without your username unless you choose to show it; your avatar never appears there. If you give us your shop’s name and link in your settings, we show them once we have reviewed them, with the preview image that your shop’s website publishes, whether or not you show your username. You can hide your username and remove your shop at any time in your settings.

We process your data to provide the service (contract), to improve and secure it (legitimate interest), to measure audience when you consent (consent), and to meet legal obligations.

How long we keep it: your account data and the content you create, for as long as your account is active; when your account is deleted, at your request to contact@magicmoon.ai, within 30 days, except what we must keep to meet a legal obligation or to prove a payment (payment records and our log of Stripe events: 10 years). Waitlist sign-ups: at most 3 years after you sign up; you can unsubscribe from our emails at any time through the link in each email, and ask us to delete your sign-up at the same address. Waitlist visit records: 13 months. Log of our team’s administrative actions on accounts (for example a bonus granted): 5 years. Data held by our providers is deleted on their own schedules, described in their policies.

We delete or anonymize your data on request, unless we are required to retain it.

Under the GDPR you can access, correct, delete, restrict or port your data, and object to certain processing. To exercise these rights, email contact@magicmoon.ai.

If you are in the EU, you also have the right to lodge a complaint with your supervisory authority (in France, the CNIL).

Some of our providers (such as Vercel, Cloudflare, Microsoft, Google, Stripe, Link, OpenAI, Ideogram, Picsart and Replicate) may process data outside the European Union, in particular in the United States. When that happens, we rely on the safeguards each provider offers in its data processing terms, such as the European Commission’s Standard Contractual Clauses. Our database is hosted in the European Union (Stockholm region), image composition runs in the Paris region, and PostHog keeps analytics data within the European Union.

We may update this policy as the product evolves; the date above reflects the latest version. For any question about your data, write to contact@magicmoon.ai.