Privacy Policy & Data Protection Standards

Version 2.0 • Effective Date: January 1, 2026 • MagicFolder AI

1. Non-Custodial Storage Your files reside exclusively inside your QuickBooks, Xero, Drive, or Dropbox accounts. We do not store document copies.

2. Zero Model Training Your confidential financial transactions, bills, and client data are NEVER used to train public AI models.

3. Official Scoped OAuth Encrypted 256-bit TLS/AES API connections. We never request or store your account passwords.

4. Air-Gapped Option Dedicated on-premise local server appliances available for 100% offline HIPAA, ITAR, and CPA compliance.

1. Information We Process

MagicFolder AI processes data strictly to perform automated document sorting, data extraction, and accounting reconciliation on your behalf:

Commercial Account Data: Business name, administrative contact email, billing details, and phone number collected via Stripe.
Document Content Data: Information contained within uploaded invoices, receipts, and contracts (e.g. vendor names, amounts, line items, job references).
Integration Metadata: OAuth authorization tokens and folder identifiers necessary to route files to your designated cloud storage and accounting tools.

2. How Document Data Is Handled (In-Memory Processing)

We believe data minimization is the strongest security guarantee. Document data is processed in temporary, encrypted memory strictly during OCR extraction and pipeline routing. Once a file is successfully filed into your destination repository (e.g. Google Drive, Dropbox) and drafted in your accounting software (e.g. QuickBooks Online, Xero), the in-memory payload is purged. We do not retain copies of your underlying documents on our servers.

3. Subprocessors & Technical Infrastructure

MagicFolder AI utilizes industry-standard infrastructure providers adhering to rigorous enterprise security frameworks:

Cloudflare: Edge routing, DDoS mitigation, and SSL/TLS encryption.
Stripe: PCI-DSS Level 1 certified subscription billing and payment handling.
Authorized LLM / OCR Endpoints: Dedicated enterprise API instances (Anthropic / OpenAI / Google Cloud Vertex) operating under strict Business Associate Agreements (BAA) and Zero Data Retention (ZDR) clauses ensuring customer data is never trained upon.

4. Data Rights & Deletion

You retain full ownership and copyright of all your documents and extracted data. You may revoke MagicFolder AI's API access at any time directly through your QuickBooks, Google Workspace, or Microsoft 365 administrative settings. Upon written notice to info@magicfolder.ai, any operational configuration records will be permanently expunged.

5. Contact & Data Protection Officer

For inquiries regarding data governance, enterprise compliance, or HIPAA/ITAR air-gapped on-premise deployments, contact our architecture team at: info@magicfolder.ai.