Privacy Policy

This Privacy Policy says what MagicTax holds about you and your business, where it is kept, who reads it, which outside services see it, how long it stays and what you can do about it. MagicTax is run by Mykolay Chelabchi, doing business as MC Soft Solution (“we”, “us”).

Other documents say some of the same things, and this policy quotes them rather than rewording them:

• the first-upload acknowledgment, which you confirm before a business’s first upload;
• the optional Help train permission;
• if you use MagicTax under the early-access agreement, that agreement.

The early-access agreement’s clause 1 says: “When MagicTax’s Terms of Service and Privacy Policy are published, we will ask you to accept them, and from then on they replace this agreement.”

• Your sign-in: your email, your name if you give one, the businesses you belong to and your role in each. (If you set up an authenticator, WorkOS holds it: clause 5.)
• Each business: its name and address, its type and industry, its members and, for a partnership or a corporation, its partners’ or shareholders’ names and shares.
• What you upload: bank statements, bills, lenders’ year-end statements and other documents, photos of them, and spreadsheet exports. We keep each file as you uploaded it, including any full bank account number printed on it.
• What MagicTax reads from them: each transaction, the bank, the period, the balances and a bank account’s last four digits. Outside the files themselves, we never store a full bank account number.
• What you type or choose in MagicTax: the account each transaction goes to and your corrections, accounts you add to the chart and your requests for new ones, bank account labels, customers and vendors, loans, the invoices you write, your conversations with Magi, the MagicTax AI agent, and problem reports (clause 7).
• Your answers: to the first-upload acknowledgment, to the Help train permission and to this policy. Each answer keeps who gave it, when, which version of the words and the address your device connected from, stored encrypted; a Help train answer also keeps where in MagicTax it was given.
• Orders and payments: what was ordered, for which business and tax year, any code used and, if you came to MagicTax through someone’s referral code, who referred you and any reward. MagicTax takes no card or bank details. You pay us outside MagicTax, and we record the payment by hand.
• Notifications in the bell, and counts of how you use MagicTax: how many requests you make each day, to which part of MagicTax and for which business, and how many times you opened a business, counted up to three.
• Service records: for each AI call, its cost, timing and outcome, with the business under a code that does not name it. They never hold the document’s text or who you are.
• Server logs: for each request, the address your device connected from, your browser’s details and the page asked for; when you sign in, a note of it with your user number; and error messages, which can include part of what MagicTax was working on when something failed.

MagicTax does not ask for your Social Security number or your EIN.

• To read your documents and build your business’s categorized transactions, reports and suggestions.
• To sign you in, to show each member what their role allows, and to keep your orders.
• To check how MagicTax categorizes (clause 6) and, only if your business gave the Help train permission, to train Magi as that permission says (clause 6).
• To answer the problem reports and messages you send us.
• To keep the records listed in clause 10.

We do not sell your information and do not use it for advertising.

MagicTax uses AI services to read documents, to categorize transactions, for the suggestions on your screens and to answer you as Magi. Before a business’s first upload, you confirm what they see. In those words:

• To read a statement, bill, invoice or other document, MagicTax sends each scanned or photographed page to Google Cloud Document AI, which turns it into text and sees everything printed there. That includes a page I photograph in MagicTax to check that it can be read, even one I then take again. From the copy it sends, MagicTax first removes a photo’s camera details, such as where it was taken, and a PDF’s file details, such as its author and any form fields filled in.
• Before any other AI service reads a page of a statement or document, as text or as an image, MagicTax looks for these and hides what it finds: the names of this business and of its members, partners and shareholders; the bank account holder’s name and address; full bank account, card and routing numbers, except their last four digits; Social Security numbers and employer ID numbers (EINs); phone numbers; and email addresses. Other names stay, such as the people and companies money went to or came from.
• It can miss some: a name printed differently from how it is entered in MagicTax; a name or address away from the usual address block; a short bank account or loan number; a Social Security number printed without dashes or a label, which keeps its last four digits like a bank account number; text a PDF draws as shapes rather than letters; a picture covering less than a tenth of a PDF page; and anything handwritten. A PDF page that is one whole picture is read as a scanned page. Any other PDF page where pictures cover a tenth of it or more, such as a page of check images, is not sent as an image at all.
• A spreadsheet export is different. MagicTax sends its column names as they are, except that it hides the names of this business and of its members, partners and shareholders; full bank account, card and routing numbers, except their last four digits; Social Security numbers and employer ID numbers (EINs); phone numbers; and email addresses. A column name can still carry another name, such as an account holder’s, or a number shorter than eight digits, and a Social Security number printed without dashes keeps its last four digits. Its first ten rows are sent as a pattern only: each letter becomes A and each digit becomes 9, so those services see how long each entry is and how it is written, but not its words or numbers. The exception is a short list of common bank words, such as Debit, Credit, Payment, ATM and Wire, which are sent as printed.
• To categorize a line, it sends my chart of accounts, including account names I typed, and for each line its merchant name, its amount, whether money came in or went out, and this business’s industry. A merchant name can be a person’s name. MagicTax does not add my name, the business’s name or an account number.
• For the suggestions on my screens, it sends my banks’ names, each account’s last four digits, dates and balances.
• When I ask Magi, the MagicTax AI agent, about my transactions, it sends my question, our earlier messages, my bank accounts’ labels and last four digits, and up to 40 of this year’s transactions at a time, including ones I am not looking at, as the bank printed them. MagicTax takes out the business’s name and my email address; other names in them stay.
• When I ask for a new account in the chart, it sends what I wrote, exactly as I wrote it, plus that line’s merchant name, amount and date, my chart of accounts and my earlier requests.

Each service handles what it receives under its own terms, which decide what it keeps and for how long. Deleting in MagicTax cannot reach what they keep.

These services do work for us. Each one sees what is listed here.

• Hostinger runs our server in Boston, Massachusetts, which runs MagicTax and its database. Everything in the database is on it, together with the keys MagicTax uses to open what is encrypted.
• Cloudflare (R2) stores the files you upload and some of the reports MagicTax builds, in the United States. Each file is encrypted before it reaches Cloudflare, which sees only its size, its timing and a storage name made of a code and a fingerprint.
• Backblaze (B2) stores our database backups, in the eastern United States. They are encrypted before they reach Backblaze.
• WorkOS signs you in. It holds your sign-in email, your name if you give one, your sign-in sessions and any authenticator you set up. It sends your sign-in emails. Its sign-in pages see your device’s address and browser.
• OpenRouter passes each AI call in clause 4 to the company that runs the model, and sees what that call sends. OpenRouter keeps its own records on Google Cloud in the United States.

The companies that run the models, reached through OpenRouter, each see what the calls they serve send:

• Amazon Web Services: Anthropic’s Claude on Amazon Bedrock;
• Microsoft Azure: OpenAI’s GPT models;
• DeepInfra: Google’s Gemma.

• Google Cloud Document AI reads the text of scanned and photographed pages, including a page photographed in MagicTax to check that it can be read. It receives each page without a photo’s camera details or a PDF’s file details, and sees everything printed on it.
• Anthropic (Claude) is an AI tool the MagicTax founders use to work through problem reports (clause 7), our service records, and the orders and payments we record, which show people and businesses only by number. MagicTax adds no statement, transaction or file to what it reads; a problem report holds whatever you typed in it.
• Google (Gmail) holds the founders’ email. If you write to us, or accept an agreement by email, your message is kept there.

We choose which model does each task and which companies may serve it, and we update this list when that changes. Until 2026-10-15, other companies on OpenRouter’s list could also serve these calls, among them NextBit. Until 2026-10-18, Google also served them, with Gemini and with Anthropic’s Claude on Google Cloud.

Other members of a business see what their role in it allows. We may also disclose information when the law requires it, for example under a court order. If a company takes over MagicTax, what we hold goes to it under this policy, and we tell you.

While Magi is being trained, the MagicTax team may check how MagicTax categorizes. Before a business’s first upload, you confirm what the team sees. In those words:

The MagicTax team reads my requests for new accounts in the chart, to decide them, and may read this business’s categorized transactions to check how MagicTax categorizes them: each line’s date, amount, direction, merchant name, account and the model’s note. The team sees this business only as a short code — never its name, who I am, an account’s label or the statement itself — and my words in a request reach it with the business’s name and my email address taken out. A merchant name as the bank printed it can still name a person. The team can correct a line, and this business’s Settings shows when the team last read.

That is what the team sees in this review. Each time the team reads a business, MagicTax records it. Apart from this review, the team sees orders and payments, which carry the business’s name, whether a business gave the Help train permission (by business, not by name), and problem reports (clause 7).

Your conversations with Magi show for 30 days; older ones are deleted when you next open Magi, when you clear them, or when the business is removed. Only the person who had them can see them: not another member, and not the MagicTax team.

The Help train permission is separate and optional. A business’s owner can give it, or turn it off in Settings. With it on, here is what is kept from the business that gave it, and what it is for, in the permission’s own words:

Each time someone picks or confirms an account for one of this business’s transactions: the merchant name as MagicTax cleans it, the amount, whether money came in or went out, the account picked, the industry set for the business (trucking when none is set), and the day. Business and merchant names on transactions are kept as they appear, which can include a person’s name when a line does not look like a payment to a person. A payment to or from a person through a payment app is kept only as, for example, “Zelle payment to a person” or “Zelle payment from a person”; checks and transfers are not kept. We do not store your name, your business or any bank account identifier with it, and nothing in MagicTax looks it up by you. Even without your name, the MagicTax team may still be able to work out which business a line came from.

The MagicTax team may read this business’s categorized transactions in its own review whether or not this permission is on. With it on, a pattern the team confirms in them may become a shared rule that categorizes transactions for other businesses in the same industry; a shared rule keeps the vendor, the account, the industry, sometimes an amount range, and the version of these words — not your business. What is kept may also be used to test the AI models that categorize transactions. We do not sell it or give it to anyone for their own use.

A problem report holds:

• the kind of problem you pick;
• your own words, up to 2,000 characters, with email addresses and runs of six or more digits taken out;
• whether you asked to be told when it is fixed;
• what MagicTax adds: the page and the page before it, with the tax year and tab shown; the MagicTax version; your browser, system and device, the window size and screen sharpness, the theme, the language, the time zone and whether you were online; recent errors and failed requests on the page; and which business it is about, by number, and your role in it.

MagicTax adds no name, email, business name, file or transaction. Whatever you type in your own words is kept as you typed it, names included.

Everyone on the business a report is about can read your words, its status and our answer, with your name and role, including members who join later. Among members, a problem report about your sign-in is yours alone. The MagicTax team reads problem reports whole, and so does the founders’ AI tool, with you and your business shown only by number. Problem reports are never used to categorize transactions, and never reach Magi.

A closed problem report is deleted at the first daily clean-up 5 days after it closes, and our encrypted backups keep a copy for about 8 days more. Open problem reports are kept until they close. A business’s problem reports go when the business is removed.

Our server, the storage for your files and our backups are in the United States: the server in Boston, Massachusetts, the files with Cloudflare in the United States, the backups with Backblaze in the eastern United States.

The other services in clause 5 may handle what they receive outside the United States. We cannot see or guarantee where each request runs.

• Each business’s data is kept apart from every other business’s, in the database itself.
• Files are encrypted before they reach storage.
• Database backups are encrypted, and we have tested restoring them.
• In the database, among what is encrypted: your sign-in email and name, a business’s name and address, the descriptions your bank printed on transactions, your conversations with Magi, bank account labels, file names and the words of your requests for new accounts. Some things stay unencrypted so MagicTax and the team can work with them: the cleaned merchant names used to sort transactions, account names in the chart, the words of problem reports, and the business’s name as typed on order and payment records.
• Outside the uploaded files, a full bank account number is never stored.

The keys that open what is encrypted are on our server, so MagicTax can do its work and the team can read what clause 6 says. No system is perfectly secure. We work to prevent a breach, but cannot promise one will never happen. If one affects your information, we will tell you as the law requires.

While you use MagicTax, we keep what you upload and what MagicTax builds from it. In MagicTax you can delete a statement, or archive a business. Before you confirm, MagicTax lists the main things that go and stay; this clause is the full list.

After a grace period (10 days today; MagicTax shows the number when you confirm), MagicTax removes the file, its transactions, corrections and reports, and what Magi learned for your business from them. Archiving a business does this for every statement in it. Copies in our encrypted backups are gone about 8 days after that, as the backups roll over. Deleting cannot reach what the AI services that read your documents keep under their own rules.

These stay:

• With no end date: the record of each order and payment, and of each plan, add-on and report bought, with the business name printed on it, the business’s bank accounts (label, bank, last four digits and type), the months covered and any code used.
• With no end date: a record of each statement: its file name, the bank, last four digits and period read from it, a fingerprint of the file, its size and pages, the dates, and who uploaded and who deleted it. The file itself and its transactions are gone.
• With no end date: a record that the business existed: its name and address, stored encrypted, who could reach it, and who archived it and when.
• With no end date: every upload attempt, the months marked as cleared, counts of your requests to MagicTax, and records of how much MagicTax read and categorized for the business under a code that does not name it.
• With no end date: your account — your sign-in email and name.
• With no end date: your answers to the Help train permission and to this policy, and, if you accepted the early-access agreement by email, that email.
• When you delete one statement: your list of customers and vendors, including any first named on it, and your requests for a new account; these go when the business is archived and removed. Your conversations with Magi lose the turns about that statement; the rest show for 30 days and go when you clear them or the business is removed.
• For up to 90 days: notifications about your payments, news from us, and notifications about the business a deleted statement belonged to. Notifications about an archived business go when it is removed.

Problem reports go as clause 7 says. How many times you opened a business stays with your sign-in. Our web server’s request logs are kept about 14 days; the app’s own logs are kept until they reach a size limit, and then the oldest lines are dropped.

If your business gave the Help train permission, what was kept under it stays too, as that permission says. It is not stored with your name or your business, and nothing in MagicTax looks it up by you to remove it.

There is no way in MagicTax to close your sign-in. To ask us to remove it, write to mchelabchi@gmail.com. We will tell you what we can remove, what has to stay, and why.

• You can see and correct your business’s transactions, accounts and settings in MagicTax.
• A business’s owner can turn the Help train permission off in Settings at any time.
• You can delete a statement or archive a business (clause 10).
• Each business’s “What you agreed to” page shows its answers to the first-upload acknowledgment and the Help train permission.
• To ask what we hold about you, or to have it corrected, write to mchelabchi@gmail.com. We will answer.

MagicTax uses cookies only to sign you in and keep you signed in. Your browser also keeps a few things in its own storage, such as light or dark and an estimate you have not finished. MagicTax’s pages have no third-party analytics, advertising or tracking scripts. Only WorkOS’s sign-in pages, which clause 5 names, collect anything through them. We do not track you across other sites, so a browser’s Do Not Track signal changes nothing here.

MagicTax is a tool for running a business and is not meant for children under 13. We do not knowingly collect information from a child under 13; if we learn we have, we delete it. If you think we have, write to us at mchelabchi@gmail.com.

When we change this policy, we publish the new version here with its date, and earlier versions stay readable here. We tell everyone who has signed in to MagicTax in the bell, and ask you to accept the new version before you go on in MagicTax.

Mykolay Chelabchi, doing business as MC Soft Solution, California. Questions about this policy or your information: mchelabchi@gmail.com.