Privacy Policy

• We collect the information needed to host pages, deliver emails, run selected integrations, and keep the service secure.
• We do not sell personal data, use it for advertising, or use it to train AI models.
• Signup data belongs to the account holder whose page collected it.
• Secrets such as API keys and webhook URLs are encrypted at rest when stored by Magnets.
• Custom domains and custom sender domains are optional. A page can be hosted and sent from Magnets by default.

For account data, Magnets is the controller. For signup data collected through a page created by an account holder, the account holder is normally the controller and Magnets acts as a processor on that account holder's behalf. The account holder is responsible for their privacy notice, lawful basis, permissions, and the content of messages they send to their audience.

When you create or use an account, we may process:

• Your name, email address, authentication details, and account timestamps. Passwords are stored as hashes, not plaintext.
• Your chosen Magnets username, custom-domain settings, brand settings, sender settings, and page configuration.
• The copy, images, resource links, email content, and follow-up sequences you create.
• Integration settings and credentials you choose to add, including email, newsletter, calendar, Slack, and Pipedrive connections.
• Technical and security information, including IP address information used for abuse prevention and rate limiting, request metadata, and error logs.

When a person submits a Magnets form, we process the name and email address they provide, the page they signed up on, and the submission time. When a follow-up sequence is enabled, we also keep the information needed to track whether that sequence is active, completed, stopped, or failed for that email address.

Forms can appear on a Magnets-hosted URL or an account holder's custom domain. The host does not change which account owns the signup data.

We use information to:

• Provide, secure, and improve the service, including account authentication and abuse prevention.
• Host and serve lead-magnet pages, uploaded images, and the resource email requested by a subscriber.
• Run follow-up email sequences configured by an account holder and honour a recipient's request to stop those follow-ups.
• Stop a configured follow-up sequence when a connected calendar provider reports that the same person booked a call, if the account holder has enabled that option.
• Send signup data to the optional integrations selected by the account holder, such as Beehiiv, Substack, Slack, or Pipedrive.
• Send account holders product updates and important service notices. You can unsubscribe from product marketing emails without deleting your account.
• Respond to support requests and enforce our Terms.

Magnets can deliver resource emails from a Magnets-managed sender address. An account holder may instead use a sender address on a domain they have verified. Email delivery is provided through Resend. We only use an account holder's own sender address after its domain has been verified for that account's sending setup.

Optional integrations are activated by the account holder. Depending on what they connect, signup information may be sent to Beehiiv or Substack for newsletter subscription, Slack for a notification, Pipedrive to create or update a person, or Calendly or Cal.com to stop an enabled follow-up sequence after a booking. Each third party processes information under its own terms and privacy notice.

We use service providers to operate Magnets. Depending on which features are used, these include:

• Vercel for application hosting, content delivery, and file storage.
• Neon for hosted database and authentication infrastructure.
• Resend for email delivery and follow-up automation.
• Beehiiv, Substack, Slack, Pipedrive, Calendly, and Cal.com when an account holder elects to connect those services.

We may also disclose information where required by law, to protect the rights and safety of Magnets and others, or in connection with a reorganisation, merger, or sale of the service.

We retain account data while an account is active. Deleting an account removes the active account record and its associated Magnets pages, signup records, and follow-up records from our application database. Copies may remain in provider backups for a limited period under their normal backup-retention processes. We may retain limited information where necessary for legal obligations, security, dispute resolution, or enforcement.

We use reasonable technical and organisational measures to protect information, including HTTPS in transit, password hashing, encrypted storage for supported integration secrets, access controls, and rate limiting. No service can guarantee absolute security. If a security incident requires notice, we will provide it as required by applicable law.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data. Account holders can update much of their account information in the dashboard. To make a request, email hello@magnets.so.

If you submitted your details through an account holder's page, contact that account holder first. They control the purpose of that collection and any messages sent to you. You can also use the stop link in an eligible follow-up email to stop that sequence.

Magnets and our providers may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for international transfers.

Magnets is not intended for children under 16, and we do not knowingly collect personal information from children under 16. Contact us if you believe this has happened.

We may update this Policy as Magnets changes. For material changes, we will provide reasonable notice before they take effect. Questions can be sent to hello@magnets.so.