MagOneAI Community Edition — Privacy Policy

1. Introduction

This Privacy Policy explains how Magure Tech Middle East Ltd ("Magure", "we", "us") collects, uses, shares, and protects personal data when you use MagOneAI Community Edition ("Service"). It applies to the free Community Edition only. Enterprise customers are governed by their Master Services Agreement and Data Processing Addendum.

2. Who We Are (Controller)

Magure Tech Middle East Ltd, Dubai, UAE, is the data controller for personal data processed under this policy.

Contact: privacy@magureinc.com

Data Protection Officer: dpo@magureinc.com

3. Data We Collect

Account data you provide

• Name, email address, password (hashed)
• Optional: organization name, role, country
• Profile: display name, avatar, bio
• Authentication identifiers from Google/GitHub if you use SSO

Content you create

• Workflows, agents, prompts, knowledge base files, MCP tool configurations
• Conversations with agents and generated outputs
• Community forum posts, Discord messages linked to your account

Usage data (automatic)

• IP address, device type, browser, operating system
• Pages visited, features used, clicks, timestamps
• Workflow execution logs, token usage, errors
• Referrer URLs and UTM parameters

Cookies and similar technologies

• Strictly necessary (session, auth, security) — always on
• Functional (preferences, language) — opt-in
• Analytics (product usage) — opt-in; when granted we set Google Analytics cookies (_ga, _ga_<STREAM_ID>, 2-year lifespan) to measure pseudonymous usage
• Marketing (advertising attribution) — opt-in

Payment data

Community Edition is free. If you upgrade, payment is handled by our payment processor; we never see full card numbers.

4. Data We Do NOT Collect

• We do not knowingly collect data from anyone under 18
• We do not collect biometric data, government IDs, or health records
• We do not purchase enriched profile data from third-party data brokers

5. How We Use Your Data (Purposes & Legal Bases — GDPR)

• Create and operate your account — Contract (Art. 6(1)(b))
• Deliver the Service and run your workflows — Contract
• Security, fraud prevention, abuse detection — Legitimate interest (Art. 6(1)(f))
• Product analytics and improvement — Legitimate interest + consent for non-essential cookies
• Training and improving MagOneAI features using aggregated, de-identified usage data — Legitimate interest; you can opt out in settings
• Customer support — Contract
• Marketing emails and newsletters — Consent (Art. 6(1)(a)); opt-in only, unsubscribe anytime
• Legal compliance (tax, sanctions, court orders) — Legal obligation (Art. 6(1)(c))
• Community forum / Discord moderation — Legitimate interest

6. AI Training and Your Content — Important

In Community Edition, we may use your prompts, outputs, and workflow metadata in aggregated, de-identified form to improve MagOneAI features (e.g. recommendation quality, error classification, template suggestions).

We do not:

• Use your content to train third-party foundation models (Anthropic, OpenAI, etc.) — those providers' terms apply separately
• Share identifiable content with other users
• Sell your data

For zero data use in training and full tenancy isolation, upgrade to MagOneAI Enterprise.

7. Who We Share Data With

Hosting and infrastructure

MagOneAI Community Edition is hosted exclusively on Oracle Cloud Infrastructure (OCI) in the UAE region (Abu Dhabi / Dubai). Your account data, workflow content, logs, and backups are stored and processed in the UAE. We do not replicate Community Edition data outside the UAE except where you explicitly invoke a third-party model or tool (see below).

Sub-processors (service providers acting on our behalf)

• Cloud infrastructure: Oracle Cloud Infrastructure (OCI), UAE region — primary hosting, storage, compute, managed databases, object storage, backups
• Foundation model providers you invoke: Anthropic, OpenAI, Google, Cohere, Mistral, and others — only the content you explicitly send to the model you select; these calls may leave the UAE depending on the provider's region
• Email delivery: transactional and marketing email provider
• Web analytics: Google Analytics (Google LLC) — pseudonymous usage data; Google signals and ad personalization disabled
• Error monitoring: self-hosted on OCI UAE
• Customer support: our support platform
• Chat: Discord (subject to Discord's own policy)
• Authentication: Google, GitHub (if you use SSO)

Full list with jurisdictions and data categories: magureinc.com/legal/subprocessors. We notify users 30 days before adding material new sub-processors.

Other disclosures

• Legal requests: when required by UAE law, court order, or to protect rights, safety, or property
• Corporate transactions: in connection with a merger, acquisition, or sale of assets, with notice
• With your consent: e.g. if you publish a workflow to the public showcase

We do not sell your personal data. We do not share personal data with advertisers for targeted advertising.

8. International Data Transfers

Your account data, workflow content, and logs stay within the UAE on OCI UAE region infrastructure.

Transfers outside the UAE occur only when:

• You explicitly invoke a foundation model or MCP tool hosted elsewhere — the content you send to that provider leaves the UAE
• A sub-processor for a specific function (e.g. email delivery, Discord) is located outside the UAE
• Anonymous usage analytics (Google Analytics) is sent to Google infrastructure outside the UAE

For these transfers we rely on:

• UAE PDPL (Federal Decree-Law No. 45 of 2021) cross-border transfer mechanisms, including adequacy decisions and appropriate safeguards
• EU Standard Contractual Clauses where EU personal data is transferred out of the EEA
• Adequacy decisions where available

You can request a copy of the safeguards at privacy@magureinc.com.

9. Data Retention

• Account data: kept while your account is active, plus 30 days after deletion
• Workflow content and logs: 90 days after creation by default; you can delete earlier
• Billing records (if you upgrade): 7 years (UAE tax law)
• Aggregated, de-identified analytics: indefinitely
• Raw Google Analytics event data is retained by Google for up to 14 months
• Community forum posts: remain published unless you request deletion; they may be anonymized instead of removed to preserve thread context
• Backups (OCI UAE region): up to 35 days after deletion in primary systems

10. Your Rights

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), GDPR, UK GDPR, and similar laws, you have the right to:

• Access — get a copy of your data
• Rectify — correct inaccurate data
• Delete — "right to be forgotten"
• Restrict — limit how we process your data
• Portability — export your data in a machine-readable format
• Object — to processing based on legitimate interest, including profiling
• Withdraw consent — for anything we process on consent (e.g. marketing)
• Not be subject to solely automated decisions that produce legal or similarly significant effects
• Lodge a complaint — with the UAE Data Office, your EU national DPA, the UK ICO, or another competent supervisory authority

Exercise your rights: most rights are available via Account Settings → Privacy → self-serve buttons, or email privacy@magureinc.com.

We respond within 30 days (extendable by 60 days for complex requests). We may verify your identity before acting.

11. California Residents (CCPA/CPRA)

In the past 12 months we have collected the categories in Section 3 for the purposes in Section 5. We do not "sell" or "share" personal information as those terms are defined under CCPA/CPRA. California residents have rights to know, delete, correct, and opt out; exercise them via privacy@magureinc.com. We do not discriminate against users who exercise their rights.

12. Children

Community Edition is not for anyone under 18. If we learn we have collected data from someone under 18, we will delete it. Parents or guardians can contact privacy@magureinc.com.

13. Security

We implement technical and organizational measures including:

• UAE-resident infrastructure on Oracle Cloud Infrastructure (OCI), benefiting from OCI's physical, network, and platform-level security controls and UAE data residency
• Encryption in transit (TLS 1.2+) and at rest (AES-256), with customer-managed keys available via OCI Vault for Enterprise
• Role-based access control, MFA for Magure staff, just-in-time privileged access
• Logical tenant isolation between users
• Annual penetration testing; SOC 2 Type II in progress; alignment with ISR v2 and UAE IA controls
• Security incident response plan with 72-hour breach notification where required under UAE PDPL, GDPR, or equivalent

No system is perfectly secure. If you suspect unauthorized access to your account, email security@magureinc.com immediately.

14. Automated Decision-Making and AI Transparency

Community Edition does not make solely automated decisions with legal or similarly significant effects about you. AI outputs you generate in your own workflows are your responsibility; you should review them before acting. We do not use AI to make hiring, lending, insurance, or eligibility decisions about you.

15. Community Spaces

Posts you make on the community forum, Discord, GitHub, or in public showcases are public by design. Do not post personal data you don't want to be public. We moderate according to our Community Code of Conduct.

16. Third-Party Links and Integrations

The Service links to and integrates with third-party tools (MCP connectors, foundation models, GitHub, Slack, etc.). Their privacy practices are governed by their own policies. Review them before connecting.

17. Changes to This Policy

We may update this policy. Material changes will be notified by email or in-product notice at least 30 days before they take effect. The "Last updated" date above shows the current version. Previous versions are archived at magureinc.com/legal/privacy/archive.

18. Contact

• Data privacy inquiries: privacy@magureinc.com
• Data Protection Officer: dpo@magureinc.com
• Security incidents: security@magureinc.com

Mail: Magure Tech Middle East Ltd, Dubai, UAE

For general support or product questions, please submit a request.