LEGAL DOCUMENT

Privacy Policy

Effective date: 2 June 2026 · Last updated: 2 June 2026

1. Who We Are

MAGMAS ("we", "us", "our") operates the platform available at https://www.magmasv.co.uk. MAGMAS is a UK-based skills verification and employment platform. We are the Data Controller for personal data collected through this platform.

For all data protection enquiries, contact us at: noreply@magmasv.co.uk

2. What Personal Data We Collect

We collect personal data in the following categories:

Identity data: your name, email address, and profile photograph (if uploaded).
Account credentials: email and hashed password (we never store passwords in plain text).
Onboarding responses: your answers to the clarity session questions (career goals, experience, barriers, aspirations).
Career data: your chosen career field, MAGMAS Score, progress through training sections, and portfolio items you upload.
Profile data: biography, location (country), job preferences, availability status.
Usage data: pages visited, actions taken on the platform, section completion events, session duration.
Communications: messages sent through the in-platform messaging system, feedback submitted.
Recruiter data (if applicable): company name, work email, company website, and hiring pipeline activity.
Technical data: IP address, browser type, device type, referring URL, and cookies.

3. How We Collect Your Data

Directly from you: when you create an account, complete onboarding questions, fill in your profile, upload portfolio items, or send messages.
Automatically: through standard web server logs, Supabase session tokens, and Vercel analytics when you use the platform.
Third parties: if you sign in using Google OAuth, we receive your name and email from Google in accordance with Google's Privacy Policy.

4. Why We Process Your Data (Lawful Bases)

Under UK GDPR Article 6, we process your data on the following lawful bases:

Purpose	Lawful Basis
Creating and managing your account	Contract (Art. 6(1)(b))
Generating your personalised AI reflection	Contract (Art. 6(1)(b))
Delivering your training track and portfolio	Contract (Art. 6(1)(b))
Sending transactional emails (confirmation, password reset, completion)	Contract (Art. 6(1)(b))
Making your portfolio visible to recruiters you have enabled	Consent (Art. 6(1)(a))
Improving the platform through aggregated analytics	Legitimate interests (Art. 6(1)(f))
Complying with legal obligations	Legal obligation (Art. 6(1)(c))
Fraud prevention and platform security	Legitimate interests (Art. 6(1)(f))

5. Who We Share Your Data With

We do not sell your personal data. We share data only in the following circumstances:

Supabase (Ireland/EU): our database and authentication provider. Data is stored in the eu-west-1 region. Supabase is GDPR-compliant.
Vercel (USA): our hosting provider. Vercel is certified under the EU-U.S. Data Privacy Framework.
Resend (USA): our transactional email provider. Used only to send emails you trigger (confirmations, resets, notifications).
Anthropic (USA): your onboarding answers are sent to Anthropic's API to generate your personalised reflection. No personally identifying information beyond your answers is sent. Anthropic processes this data under its own privacy policy.
Adzuna (UK): we display job listings from Adzuna's API. We do not share your personal data with Adzuna.
Recruiters on the platform: if you set your status to 'Open to Opportunities', your portfolio and profile are visible to approved recruiters. You can disable this at any time from your profile settings.
Law enforcement or regulatory bodies: where we are required to do so by law or court order.

6. International Data Transfers

Some of our third-party providers (Vercel, Resend, Anthropic) are based in the USA. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO), or reliance on adequacy decisions where applicable.

7. How Long We Keep Your Data

Data Type	Retention Period
Account and profile data	Until account deletion
Onboarding responses and reflection	Until account deletion
Portfolio items and progress	Until account deletion
Messages and notifications	Until account deletion
Usage and analytics data	24 months, then anonymised
Deleted account data	Permanently deleted within 30 days of deletion request

8. Your Rights Under UK GDPR

You have the following rights. To exercise any of them, contact us at noreply@magmasv.co.uk:

Right of access: you can request a copy of all personal data we hold about you.
Right to rectification: you can correct inaccurate data through your profile settings or by contacting us.
Right to erasure: you can delete your account from your profile page, which permanently deletes all your data.
Right to restrict processing: you can ask us to pause processing of your data in certain circumstances.
Right to data portability: you can request your data in a machine-readable format.
Right to object: you can object to processing based on legitimate interests.
Rights related to automated decision-making: the AI reflection is advisory only, not a legally binding decision. You may request human review.
Right to withdraw consent: where processing is based on consent (e.g. recruiter visibility), you can withdraw it at any time.

We will respond to all requests within 30 days. You also have the right to lodge a complaint with the UK ICO at ico.org.uk.

9. Cookies

Authentication cookies: set by Supabase to maintain your logged-in session. Strictly necessary, cannot be disabled.
Preference storage: we use localStorage and sessionStorage to temporarily store your onboarding answers. Cleared on account completion or logout.
Analytics: anonymised analytics to understand platform usage. No personally identifying data used.

We do not use advertising cookies or third-party tracking cookies.

10. Children

MAGMAS is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a person under 16 has provided us with personal data, contact us at noreply@magmasv.co.uk and we will delete it promptly.

11. Data Security

All data in transit is encrypted using TLS (HTTPS enforced across all pages).
Passwords are hashed using bcrypt via Supabase Auth — we never store plain-text passwords.
Database access is restricted by row-level security (RLS) policies.
Email confirmation is required before account activation.
Regular deletion of unused and anonymous accounts.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance.

13. Contact Us

📧 noreply@magmasv.co.uk
🌐 https://www.magmasv.co.uk