Privacy policy
Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim
Privacy Policy
Last updated: 11 July 2025
Thank you for choosing AI Black Magic ("Company", "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit aiblackmagic.com and any related sub‑domains (collectively, the "Site"), or use any of our digital products, memberships or services (together, the "Services").
We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and other privacy laws that apply to us worldwide. (See §14 regarding U.S. California law.)
1 Who We Are (Data Controller)
- Legal entity: Wawa Llama Ltd. (Company No. 10740635)
- Registered address: 6 Norfolk Street, Whitstable, Kent CT5 4HB, United Kingdom
- VAT numbers: GB 447 3405 93 (UK) | EU 372 0730 01 (EU OSS)
- Contact email: hello@aiblackmagic.com
- Phone: +44 773 203 4305
2 Scope of This Policy
This policy applies to anyone, anywhere in the world, who:
- visits our publicly available Site;
- creates a free or paid membership account via Memberstack;
- purchases one‑off digital products or subscriptions processed by Stripe (including Apple Pay, iDEAL and other local methods);
- receives transactional or marketing emails from us;
- interacts with advertising, analytics or social‑media pixels embedded in the Site.
3 The Data We Collect
| Category | Examples | Purpose | Lawful basis* |
|---|---|---|---|
| Account Data | email address, full name, password, social‑login ID | Create & manage your Memberstack account | Contract |
| Profile Data | optional avatar, bio, social links | Display in your member profile | Consent / Legitimate interest |
| Purchase Data | Stripe customer ID, last 4 card digits, billing country, VAT ID, Stripe Tax calculations | Process payments & issue invoices | Contract / Legal obligation |
| Support Data | messages via contact form or email | Respond to enquiries | Legitimate interest |
| Log & Usage Data | IP, browser, device IDs, pages visited, events (login, purchase) | Security, analytics, fraud prevention | Legitimate interest |
| Marketing & Analytics Data | Google Analytics 4, Meta Pixel, TikTok Pixel | Measure marketing performance | Legitimate interest† |
* See §7 for details.
† We rely on our legitimate interests to set these cookies/pixels; continuing to use the Site signifies agreement.
4 How We Collect Data
- Directly from you – when you create an account, purchase, fill a form, upload profile info or communicate with us.
- Automatically – via cookies, pixels, SDKs, server logs and similar technologies (see §6).
- From third‑party integrations – e.g. Zapier or Make automations that add your email to our marketing list when you tick the optional newsletter checkbox during account sign‑up.
- AI‑assisted replies – incoming customer‑support emails may be summarised and draft replies generated using the ChatGPT API (OpenAI, USA) via Make. A human agent reviews every AI draft before sending.
We do not buy personal data from brokers nor enrich profiles from external marketing databases.
5 Why We Use Your Data
- To register you as a member and give you access to gated content or downloads.
- To process payments, subscriptions and statutory taxes.
- To send transactional emails (receipts, password resets) via Memberstack and/or Mailgun.
- To send optional marketing emails and newsletters via Omnisend (only after you opt in).
- To deliver, measure and improve advertising campaigns on Meta/Facebook, TikTok and Google.
- To maintain the security and performance of our Site (fraud detection, abuse prevention, debugging).
- To comply with legal obligations (book‑keeping, tax, consumer protection, dispute resolution).
- To draft and improve customer‑support replies with AI assistance (ChatGPT API).
6 Cookies & Similar Technologies
Our Site uses first‑ and third‑party cookies, web beacons and server‑to‑server APIs for analytics, advertising and personalisation.
6.1 Consent Banner & Choices
Visitors from the United Kingdom and European Economic Area (EEA) see a banner powered by Hu‑manity Cookie Compliance that presents three equal options:
- Accept all – analytics and marketing cookies load immediately.
- Reject non‑essential cookies – we block and delete Google Analytics, Meta/Facebook, TikTok and any other non‑essential tags.
- Customise – granular toggles for Analytics, Marketing, Personalisation, etc.
Your choice is stored in a first‑party cookie (humanityConsent). You can withdraw or change consent at any time by clicking the floating cookie‑icon badge that appears on every page.
Visitors outside the UK/EEA continue without the banner, but may still disable cookies via their browser (§6.3).
6.2 Key Cookies / SDKs
| Service | Purpose | Provider country | Opt‑out |
|---|---|---|---|
| Google Analytics 4 | Traffic analytics | US | Via banner or browser settings |
| Meta/Facebook Pixel & Conversions API (via Stape) | Ad attribution | US | Via banner |
| TikTok Pixel | Ad attribution | US | Via banner |
| Memberstack SDK | Secure login sessions (essential) | US | Cannot be disabled |
6.3 Other Ways to Control Cookies
In addition to the banner, you can delete or block cookies in your browser settings, use privacy‑focused browsers (e.g. Brave) or install extensions such as uBlock Origin. Disabling cookies may affect Site functionality.
7 Legal Bases for Processing (UK/EU GDPR)
| Purpose | Legal basis | Explanation |
|---|---|---|
| Account registration & paid access | Contract | We need your details to deliver the service you request. |
| Payment & tax processing | Contract / Legal obligation | Required to fulfil purchases and comply with tax laws. |
| Transactional emails | Legitimate interest | Essential to operate the service and prevent fraud. |
| Marketing emails | Consent | We send newsletters only if you actively subscribe (double opt‑in). |
| Analytics & ads tracking | Consent (UK/EEA) / Legitimate interest (elsewhere) | Non‑essential cookies and pixels load only after consent is given in the UK/EEA banner; outside those regions we rely on our legitimate interest to understand and grow our business. |
| Security & fraud prevention | Legitimate interest | Necessary to protect our Site and business. |
8 Who We Share Your Data With (Processors)
| Processor | Role | Safeguards |
|---|---|---|
| Webflow, Inc. | Website hosting (US) | SCCs + UK IDTA; EU–US DPF certified |
| Memberstack, Inc. | Authentication & membership DB (US) | SCCs; Transfer Impact Assessment |
| Stripe Payments UK Ltd & Stripe, Inc. | Payments & Stripe Tax | PCI‑DSS; SCCs; EU‑US DPF |
| Omnisend Ltd. | Email marketing | EU data centres; SCCs |
| Mailgun Technologies, Inc. | Transactional email (fallback) | SCCs; EU–US DPF |
| Zapier Inc. / Make s.r.o. | Automation (data routing) | SCCs |
| Stape LLC | Server‑side Meta CAPI | SCCs |
| Quaderno | Legacy VAT invoices | SCCs |
| OpenAI, L.L.C. | AI model (ChatGPT API) used to draft customer-support emails | SCCs; EU‑US / UK‑US Data Privacy Framework; API data not used for model training and retained ≤30 days |
We may also disclose data when required by law.
We never sell your personal data.
9 International Transfers
Because many providers are US‑based, your data may be transferred outside the UK/EEA. Transfers are protected by:
- Standard Contractual Clauses (SCCs);
- the UK International Data Transfer Addendum;
- vendor participation in the EU–US & UK–US Data Privacy Frameworks.
10 Data Retention
| Data category | Retention period |
|---|---|
| Active & dormant Memberstack accounts | Retained until you delete the account or request erasure. |
| Purchase & tax records | Minimum 6 years (HMRC statutory requirement). |
| Marketing email lists | Until you unsubscribe. |
| Server logs & analytics events | 26 months (Google Analytics default) or sooner if you clear cookies. |
11 Security Measures
- HTTPS/TLS 1.3 on all pages.
- Passwords hashed with bcrypt.
- Two‑factor authentication on admin dashboards.
- Access limited to the founder, lead developer and authorised staff.
- Formal breach‑response plan (notify ICO and affected users within 72 hours).
12 Your Rights
Depending on where you live, you may have the right to:
- Access the data we hold about you;
- Correct inaccuracies;
- Erase your data (“right to be forgotten”);
- Restrict or object to certain processing;
- Port your data to another provider;
- Withdraw consent for marketing emails at any time via the unsubscribe link or by emailing hello@aiblackmagic.com.
You can change or withdraw your cookie consent at any time via the floating banner icon or by clearing cookies in your browser.
To exercise any right, email hello@aiblackmagic.com.
13 Complaints
If you believe we have not handled your data properly, please contact us first. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local supervisory authority.
14 California Privacy Notice (CCPA/CPRA)
We are a UK company with global customers. At present we do not meet the revenue or data‑volume thresholds that make the CCPA/CPRA mandatory. Nevertheless, for transparency we:
- do not sell personal information for monetary consideration; and
- share certain identifiers (e.g. hashed email, IP) with advertising partners (Meta, TikTok) for cross‑context behavioural advertising.
California residents may request disclosure or deletion of personal information by emailing hello@aiblackmagic.com.
15 Children
Our Services are intended for adults aged 18 and over. We do not knowingly collect data from children under 13.
16 Changes to This Policy
We may update this policy from time to time. If changes are material, we will:
- post the new version here with a revised “Last updated” date; and
- display an in‑product notification to logged‑in members.
Continued use of the Site after any update constitutes acceptance of the revised policy.
17 Contact Us
Questions or requests? Email hello@aiblackmagic.com or write to the address in §1.
Thank you for choosing AI Black Magic.
