Privacy notice

1. Who is responsible for your data

ChicMagnolia is the data controller for the personal data described in this notice. ChicMagnolia is currently operated as a private beta service from the United Kingdom.

Privacy questions and rights requests can be submitted through the secure support form. Please do not include passwords, full payment-card details or other unnecessary sensitive information.

2. Data we collect

• Account data: email address, name, account identifiers, authentication status and account dates.
• Purchase data: retailer, product name and URL, purchase price, purchase and return dates, saved size and colour, and tracking status.
• Monitoring data: price-check results, stock status, timestamps, errors and price-drop notification history.
• Billing data: subscription status, billing-period dates and Stripe customer or subscription references. ChicMagnolia does not receive or store your full card number.
• Support data: the name, email address, topic and message submitted through the support form, the account identifier when signed in, delivery status, timestamps and the internal reference used to handle the request.
• Service and security data: limited technical logs needed to operate, secure and troubleshoot the service.
• Anonymous analytics: aggregated page-view information such as route, referrer, country, browser and device category. ChicMagnolia strips query strings before sending analytics events.

3. Where the data comes from

Most data is provided directly by you when you create an account, add a purchase, manage billing or submit the support form. Current price and stock information comes from public retailer pages for the product URL you provide. Subscription status comes from Stripe after signed webhook verification.

4. Why we use the data

• To provide the service and perform our contract: authenticate you, store purchases, run price and stock checks, send requested alerts, provide data export, respond to support requests and manage the subscription.
• For legitimate interests: protect accounts, prevent abuse, diagnose failures, maintain reliability, keep an accountable support record and understand aggregated product use. These activities are limited to what is reasonably necessary for operating the service.
• To meet legal obligations: retain or disclose limited billing, tax, fraud-prevention or compliance records where the law requires it.

ChicMagnolia does not sell personal data, use it for behavioural advertising or make solely automated decisions that have legal or similarly significant effects.

5. Service providers and recipients

ChicMagnolia uses specialist providers to operate the service:

• Supabase for authentication, the application database and support records.
• Vercel for application hosting and privacy-focused web analytics.
• Stripe for Checkout, recurring billing, invoices and the Customer Portal.
• Resend for authentication messages, transactional price-drop emails and support notifications.
• Oxylabs and, for selected retailer routes, Browserless to retrieve the public retailer page associated with a saved product URL.
• GitHub Actions to initiate the protected daily-monitoring endpoint.

Providers receive only the information needed for their role. Product URLs, saved variant details and technical request data may be processed by scraping providers when a retailer check runs. ChicMagnolia may also disclose information where required by law, to protect users or to investigate misuse.

6. International processing

Some providers may process data outside the United Kingdom. Where this happens, ChicMagnolia relies on the provider's applicable transfer mechanism and contractual or organisational safeguards. Use the support form for more information about a particular provider or transfer.

7. Cookies and analytics

Supabase authentication uses cookies that are necessary to keep you signed in and protect dashboard access. Vercel Web Analytics is configured for aggregated analytics, does not use advertising cookies and is not used to follow you across other websites. ChicMagnolia does not currently use marketing or behavioural advertising cookies.

8. How long we keep data

• Account, purchase, monitoring and notification data is generally kept while the account exists and is deleted when the account is deleted.
• Support, privacy-rights and security-report records are kept for as long as reasonably needed to respond, prevent abuse and demonstrate how the request was handled. Deleting an account removes the account link but does not automatically erase an unresolved support record.
• Failed-request and security records are kept only for as long as reasonably needed to troubleshoot, protect the service and establish or defend legal claims.
• Stripe and other providers may retain billing or compliance records under their own legal obligations even after the ChicMagnolia account is deleted.
• Backups and provider recovery systems may take a limited period to cycle out deleted data, during which it is not used for normal service activity.

9. Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or object to processing and to receive portable data. The Settings page provides a JSON download and self-service account deletion. You can also submit a request through the support form if the self-service tools do not meet your request.

You may complain to the UK Information Commissioner's Office. Details are available at ico.org.uk. We would appreciate the opportunity to address the concern first.

10. Account deletion

Deleting an account removes the Supabase authentication user and cascades deletion through the user-owned ChicMagnolia profile, purchases, price checks, notifications and subscription-state record. If a Stripe customer is linked, ChicMagnolia first requests deletion of that Stripe customer, which immediately ends active Stripe subscriptions and removes saved payment details from future use. Historical records may remain where Stripe or ChicMagnolia must retain them for legal, accounting, fraud-prevention, support or dispute purposes.

11. Security

ChicMagnolia uses authenticated access, database row-level security, server-only credentials, signed Stripe webhooks, encrypted HTTPS transport and restricted security headers. No internet service can guarantee absolute security, so please use a unique password and submit a security report through the support form if you believe an account has been compromised.

12. Changes to this notice

The current notice version is 2026-08-01. Material changes will be shown in the service or communicated before a new use of personal data begins. Earlier versions may be retained for accountability records.