Small print
Privacy policy
In short
- This website sets no cookies, runs no scripts, loads nothing from other servers and builds no profiles of visitors.
- We process personal data in three situations: when you send the access request form or write to us, when you have an account in the MagicBucket.pro application, and when your organization uploads documents to it.
- Form data is kept in our own system in the EU (Amazon Web Services, Frankfurt region) and deleted automatically 12 months after it was sent; backup copies expire up to 35 days later. A notification with the form fields, without your IP address, goes to our team mailbox, which is hosted by Google.
- For personal data inside uploaded documents, your organization is the controller and we are its processor. We sign a data processing agreement before the first document with personal data is uploaded.
- Documents are stored and read only in the EU. We never use them to train AI models.
- We send no marketing messages unless you ask for them.
- Questions about personal data: hello@magicbucket.pro, with “personal data” in the subject.
The summary helps reading; the full text below is binding.
1. Who is the controller
The controller of personal data connected with the website magicbucket.pro, the access request form, correspondence and user accounts in the MagicBucket.pro application is ETHICALC spółka z ograniczoną odpowiedzialnością, with its registered office in Gdańsk, ul. ks. Leona Miszewskiego 18/2C, 80-239 Gdańsk, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under no. 0001241947, NIP 9571202612, REGON 544803812 (“Ethicalc”, “we”).
We can be reached in writing only. For personal-data matters, please email hello@magicbucket.pro with “personal data” in the subject, or send a letter to our registered office.
Personal data inside the documents your organization uploads to the application is different. For that data your organization is the controller, and Ethicalc processes it on the organization’s behalf (section 6).
2. The website magicbucket.pro
The website sets no cookies and runs no scripts. It uses no analytics or advertising tools and loads nothing from third-party servers. We do not profile visitors.
The web server may technically log the IP address, the date and time, and the page requested. We use these logs only to keep the website working and secure and to count visits without identifying visitors. The legal basis is our legitimate interest in a working, secure website (Art. 6(1)(f) of Regulation (EU) 2016/679, the “GDPR”). We keep the logs no longer than needed for these purposes.
3. The access request form
The form on the access page collects the following data.
| Data | Required |
|---|---|
| Name, email address, company | Yes |
| VAT or tax ID, role, document types, monthly page volume, message | No |
| IP address and browser user agent | Recorded automatically when the form is sent |
We use the data for these purposes:
| Purpose | Legal basis |
|---|---|
| Replying to your request and arranging the test | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); where you act for an organization, also our legitimate interest in replying to it (Art. 6(1)(f) GDPR) |
| Protecting the form against abuse (IP address and user agent) | Our legitimate interest (Art. 6(1)(f) GDPR) |
The form sends the data to Ethicalc’s own system in the EU (Amazon Web Services, Frankfurt region). The system then emails a notification with the form fields to our team mailbox, hello@magicbucket.pro. The notification does not contain the IP address or user agent; these stay only in the database.
The request is deleted from the database automatically 12 months after it was sent. The database keeps point-in-time backup copies for up to 35 days, so a deleted request can remain in those backups for up to 35 more days, until the copies expire. The notification in the mailbox is kept like other correspondence (section 4).
Providing the data is voluntary. Without a name, email address and company we cannot reply to the request.
We do not send information about our services unless you ask for it: not by email, not by text message, not by letter.
4. Correspondence
When you write to us by email or letter, we process the data in the message, usually your name, email or postal address, company and the content. We do this to reply and handle the matter and, if the message concerns a test or a contract, to prepare and perform it (Art. 6(1)(b) and (f) GDPR).
We keep correspondence as long as needed to handle the matter. If it concerns a contract, we keep it until claims under that contract become time-barred.
Our mailbox hello@magicbucket.pro, including the notifications from the access request form, is hosted by Google (Google Workspace), which processes email on our behalf (section 8 and section 9).
5. Accounts in the MagicBucket.pro application
The MagicBucket.pro application at app.magicbucket.pro is a separate service from this website. For each user account we process the email address, the name if given, and the sign-in history. We receive this data from you or from your organization’s administrator.
Ethicalc is the controller of account data. We process it to provide the account under the test or agreement with your organization and to keep the application secure (Art. 6(1)(b) and (f) GDPR). An account cannot be used without this data.
You sign in with your email address and a password. Two-step sign-in with an authenticator app is available.
Unlike this website, the application runs JavaScript. To keep you signed in, it stores sign-in tokens in your browser, and the sign-in page may set cookies that are strictly necessary for signing in. They are not used for analytics or advertising.
We keep account data while the account exists. After the account is closed, we keep only what is needed to secure the system and to establish, exercise or defend legal claims, and only as long as that need lasts.
6. Personal data in uploaded documents
Documents uploaded to the application, such as invoices, payroll lists, contracts and financial statements, may contain personal data of employees, contractors and counterparties. Some of it may belong to special categories of data: for example, a payroll list showing sick pay can reveal information about health (Art. 9 GDPR). The data processing agreement covers such data as well.
For this data the customer, meaning the organization that uses the application, is the controller. Ethicalc is the processor and acts only on the customer’s documented instructions, under a data processing agreement (Art. 28 GDPR). We sign that agreement before any document with personal data is uploaded.
- Place. Documents are stored and processed only in the EU, in the Frankfurt region. Settings that would send reading to services outside the EU are rejected in the system’s code.
- No training. We never use documents to train AI models.
- Working files. Deleted after 7 days.
- Logs. System logs record numbers and errors, never document content or model answers.
- Retention. Documents are kept for the period set in the data processing agreement. For a test, documents are deleted when the test ends, unless the customer continues under an agreement.
7. No decisions based solely on automated processing
We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The application extracts data from documents. Values on which the models do not agree stay blank and are left for a person to review. The customer decides how to use the results.
8. Who receives the data
Our cloud infrastructure and the AI model services that read documents are provided by Amazon Web Services and operated in the EU (Frankfurt region). Amazon Web Services processes data on our behalf. For data in customer documents it acts as a further processor (sub-processor), only within the scope the customer agreed to in the data processing agreement.
Our email, including the mailbox hello@magicbucket.pro and the notifications from the access request form, is provided by Google (Google Workspace), which processes it on our behalf. We do not use email to process customer documents in the application.
We may also disclose data to public authorities that have a legal basis to obtain it.
We do not sell personal data and do not share it for marketing.
9. Transfers outside the European Economic Area
Documents uploaded to the application and the database of access requests stay in the European Economic Area. The system rejects settings that would send the reading of documents to services outside the EU.
Email is different. Google, which hosts our mailbox, may process email data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, in which Google LLC participates, and on the standard contractual clauses in Google’s data processing terms. If you prefer, you can write to us by letter instead.
10. Security
- Originals and result sets are encrypted and versioned.
- Each organization sees only its own documents. The organization a document belongs to is taken only from the sign-in. Within an organization, a user sees their own uploads and the organization’s administrator sees all of them.
- Two-step sign-in with an authenticator app is available.
- Working files are deleted after 7 days. Logs hold numbers and errors only.
How reading works and how documents are protected is described on the security page.
11. Your rights
You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability and to object to processing, on the terms set out in the GDPR. You may object in particular to processing based on our legitimate interest. To use these rights, email hello@magicbucket.pro with “personal data” in the subject, or write to our registered office.
For data inside a customer’s documents, please contact that customer, because it is the controller. We help the customer handle such requests.
If you believe we process your data unlawfully, you may lodge a complaint with the data protection supervisory authority in the EU member state where you live or work, or with our lead supervisory authority, the President of the Personal Data Protection Office (UODO) in Poland.
12. Changes
We publish changes to this policy on this page with a new version number and date. If a change concerns data processed in the application, we inform customers before it takes effect.