Privacy Policy
Effective date: June 20, 2026
1. Introduction
MaGGzin Marketplace ("MaGGzin", "we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use and share it, how long we keep it, and the choices you have. It applies to our website, mobile applications, and any other services we operate (collectively, the "Platform"). By using the Platform you acknowledge that you have read and understood this policy.
2. Information We Collect
We collect the following categories of personal information: • Identity & Contact: name, email address, phone number, and date of birth (age verification). • Account Credentials: hashed password (we never store plaintext passwords). • Profile: display name, profile photo, and — for sellers — business name, address, and government ID submitted for verification. • Transaction Data: order history, items purchased or sold, prices, fulfillment method, tracking numbers, and dispute records. • Payment Data: last 4 digits of card, card type, billing zip code, and Stripe payment method tokens. Full card numbers are processed and stored exclusively by Stripe (PCI-DSS Level 1 certified) and are never transmitted to or stored on MaGGzin servers. • Shipping Addresses: delivery addresses you add to your account. • Communications: messages sent via platform chat, support tickets, and product reviews. • Location: county/region you set for delivery matching. Precise GPS is not collected. • Usage & Device: pages visited, search queries, clicks, session duration, IP address, browser type, operating system, and device identifiers. • User-Generated Content: product listings, photos, videos, and reviews you post.
3. How We Use Your Information
We use personal information for the following purposes: • To operate the Platform: process orders, calculate shipping, match local delivery options, and facilitate buyer-seller transactions. • To communicate: send order confirmations, shipping notifications, return updates, and account security alerts (these are transactional and cannot be opted out of while your account is active). • To verify identity: screen sellers before activation and comply with anti-money-laundering (AML) and Know Your Customer (KYC) obligations. • To prevent fraud: detect suspicious activity, investigate disputes, and enforce our Terms. • To improve the Platform: analyze usage patterns, troubleshoot errors, and develop new features. • Marketing (with consent): send promotional emails about deals and platform updates — you can unsubscribe at any time. • Legal compliance: meet our obligations under applicable laws, respond to lawful government requests, and enforce our agreements.
4. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases: (a) Contract — processing necessary to fulfill your purchase or sale; (b) Legal Obligation — processing required by law (e.g., tax records, AML/KYC); (c) Legitimate Interests — fraud prevention, platform security, and service improvement, where those interests are not overridden by your rights; (d) Consent — marketing communications and optional location features, which you may withdraw at any time.
5. Information Sharing & Disclosure
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share information only as follows: • With sellers: your shipping name, delivery address, and order details necessary to fulfill your purchase. • With buyers (for sellers): your store name, contact channel, and necessary fulfillment data. • With service providers under data processing agreements: Stripe (payments and payouts), Shippo (shipping rates and label generation), TaxJar (sales-tax calculation, which receives the destination address of an order to compute the correct rate), Cloudinary (media hosting), Resend (transactional email), and analytics/monitoring services. These providers are contractually prohibited from using your data for their own purposes. • With law enforcement or regulators: when required by valid legal process (subpoena, court order) or when we believe disclosure is necessary to prevent imminent harm. • In a business transfer: if MaGGzin is merged, acquired, or sells all or substantially all its assets, your data may transfer to the successor entity. We will notify you before your data becomes subject to a different privacy policy. • With your consent: for any other purpose with your prior explicit consent.
6. Data Retention
We retain personal data for as long as necessary to fulfill the purposes described in this policy: • Account data: retained while your account is active and for 90 days after deletion, to allow account recovery and complete pending transactions. • Transaction and financial records: retained for 7 years to comply with tax, accounting, and legal requirements. • Support tickets and dispute records: retained for 3 years. • Marketing preferences and consent records: retained for 5 years. You may request deletion of your account at any time. We will honor such requests within 30 days, subject to our legal retention obligations.
7. Data Security
We implement industry-standard technical and organizational measures to protect your personal information, including: TLS 1.2+ encryption for all data in transit; AES-256 encryption for sensitive data at rest; bcrypt hashing with salt for passwords; short-lived JWT authentication tokens; role-based access controls limiting employee access to data; and regular security reviews. Payment card data is processed exclusively by Stripe, which is PCI-DSS Level 1 certified. Despite these precautions, no system is completely secure. In the event of a data breach that creates a material risk to your rights, we will notify affected users as required by applicable law.
8. Cookies & Local Storage
We use browser localStorage to store your authentication token, cart contents, and language preferences. We use sessionStorage for temporary navigation state. We do not use third-party advertising cookies or tracking pixels for behavioral advertising. If you enable Google Translate, Google may set cookies to remember your language preference — you can remove these by switching back to English or clearing browser cookies. Our Platform does not currently respond to "Do Not Track" browser signals, as there is no accepted industry standard for DNT.
9. Your Privacy Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data: • Access: request a copy of the personal data we hold about you. • Correction: update inaccurate or incomplete information (most can be done directly in Account Settings). • Deletion: request erasure of your personal data, subject to legal retention requirements. • Portability: receive your data in a structured, machine-readable format. • Objection: object to processing based on legitimate interests. • Restriction: request that we limit processing in certain circumstances. • Opt-out of marketing: unsubscribe from promotional emails at any time via the link in any marketing email or through Account Settings. California residents have additional rights under the CCPA, including the right to know what categories of personal information we collect and the right to opt out of sale (we do not sell personal information). EU/UK residents have rights under GDPR/UK GDPR. To exercise any right, submit a request through the Customer Service portal. We will respond within 30 days (or 45 days where permitted).
10. Children's Privacy
MaGGzin is intended for users who are 18 years of age or older. We do not knowingly collect personal information from minors under 18. If we learn that we have inadvertently collected information from a person under 18, we will promptly delete it. If you believe we have collected information from a minor, please contact us immediately at magofficial@maggzin.com.
11. International Data Transfers
MaGGzin is based in the United States. If you are located outside the United States, your personal data will be transferred to and processed in the United States, where data protection laws may differ from those in your country. For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable. Our service providers (Stripe, Cloudinary, Resend, Shippo) may also process data in countries outside your own; we ensure each has appropriate safeguards in place.
12. Third-Party Links
The Platform may contain links to third-party websites, social media platforms, or external services. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit. MaGGzin is not responsible for the privacy practices or content of third-party sites.
13. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 14 days' notice via email or a prominent Platform notice before the change takes effect. The "Effective date" at the top of this page reflects the date of the most recent revision. Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the changes.
14. Contact & Data Protection Officer
For privacy-related questions, data subject requests, or complaints, contact our Privacy Team through the Customer Service portal in your account or by email at magofficial@maggzin.com. EU/UK users may also lodge a complaint with their local data protection authority (e.g., the ICO in the UK or the relevant EU supervisory authority). We aim to resolve all privacy inquiries within 30 days.