Legal
GDPR & Data Protection
Effective 6 July 2026 · Version 1.1
Magwise is committed to the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and to Romanian data-protection law (Law no. 190/2018). This page sets out your rights, the legal bases on which we process personal data, our subprocessors, and how to reach us. It complements our Privacy Policy.
Data controller
[registered company name], reg. no. [trade register no. J../..], VAT [CUI / VAT ID], [registered address, Romania]. Data-protection contact: calin@magwise.ro. We have determined that appointing a Data Protection Officer is not mandatory for us under Article 37 GDPR; the contact above handles all data-protection requests.
Legal bases for processing
| Activity | Legal basis |
|---|---|
| Operating your account & generating listings | Contract — Art. 6(1)(b) |
| Billing, invoicing & fraud prevention | Contract & legal obligation — Art. 6(1)(b), (c) |
| Security, abuse prevention & product improvement | Legitimate interests — Art. 6(1)(f) |
| Statutory record-keeping (e.g. tax) | Legal obligation — Art. 6(1)(c) |
| Optional marketing communications | Consent — Art. 6(1)(a) |
Your rights
Subject to the conditions in the GDPR, you have the right to:
- Access — obtain confirmation of and a copy of the personal data we hold about you (Art. 15).
- Rectification — have inaccurate or incomplete data corrected (Art. 16).
- Erasure — have your data deleted where there is no overriding legal ground to keep it (Art. 17).
- Restriction — limit how we process your data in certain circumstances (Art. 18).
- Portability — receive data you provided in a structured, machine-readable format, or have it transmitted to another controller (Art. 20).
- Object — object to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
- Withdraw consent — where processing is based on consent, withdraw it at any time, without affecting prior processing (Art. 7(3)).
- Not be subject to solely automated decisions that produce legal or similarly significant effects (Art. 22). We do not make such decisions about you.
How to exercise your rights
Email calin@magwise.ro from the address on your account. We respond free of charge within one month, extendable by two further months for complex requests (we will tell you if so). We may need to verify your identity before acting.
Automated content generation (AI Act)
The Service uses third-party AI models to generate images and text from your inputs. This is content generation, not automated decision-making about you. In line with Article 50 of the AI Act (Regulation (EU) 2024/1689), AI-generated output is or will be marked, where technically feasible, in a machine-readable format as artificially generated. When you publish that output, you are responsible for any transparency obligations that apply to you. See the Terms of Service for detail.
Subprocessors
We engage the following processors, each under a data-processing agreement and appropriate transfer safeguards:
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| PlanetScale | Database hosting (accounts, listings, credits, orders) | European Union | EU-based — no transfer |
| Cloudflare R2 | File/image storage (generated images and uploaded product photos) | European Union | EU-based — no transfer |
| Google (Gemini API) | AI generation of listing images and copy from your inputs | United States | EU SCCs |
| Stripe | Payment processing for credit packs (card, Apple Pay, Google Pay, Link) | EU / United States | EU SCCs |
| Oblio Software SRL | Issuing fiscal invoices from completed Stripe payments | European Union (Romania) | EU-based — no transfer |
| European Commission (VIES / TEDB) | Validating EU VAT numbers and retrieving official VAT rates for invoicing | European Union | EU-based — no transfer |
| Vercel | Application hosting and content delivery | United States | EU SCCs |
| Meta Platforms Ireland | Advertising measurement (Meta Pixel): page views, sign-ups, first use and purchases, to measure which adverts work | European Union / United States | EU SCCs |
| Google (Analytics & Ads) | Website analytics and advertising measurement: page views, sign-ups, first use and purchases | European Union / United States | EU SCCs |
International transfers
Where personal data is transferred outside the European Economic Area, we rely, under Chapter V GDPR, on the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, additional technical and organisational measures, to ensure an adequate level of protection.
Data retention
| Data | Retention |
|---|---|
| Account & content data | For the life of your account; deleted or anonymised after closure |
| Generated listings & images | Until you delete them or close your account |
| Invoices & tax records | As required by Romania law |
| Security & diagnostic logs | A limited period proportionate to the purpose |
Data Processing Agreement
If you are a business customer processing personal data of your own end users through the Service, we act as your processor and will enter into a Data Processing Agreement (DPA) under Article 28 GDPR on request. Contact calin@magwise.ro.
Data breaches
In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required (Art. 33), and affected users without undue delay where the risk is high (Art. 34).
Complaints
You have the right to lodge a complaint with a supervisory authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro. You may also complain to the authority in your EU country of residence. We would appreciate the chance to address your concern first at calin@magwise.ro.