PRIVACY POLICY

Last updated: August 20, 2026

Sumcloud Inc. ("we", "us" or "our") operates Magikaru at https://magikaru.com (the "Service"). This Privacy Policy explains what personal data we collect, how and why we use it, when we disclose it, how long we retain it, and the choices and rights available to you.

Please also review our Terms of Use. If you use the Service on behalf of an organization, that organization may separately control content and account data within its workspace.

1. Personal Data We Collect

Category	Examples
Account and profile data	Name, nickname, email address, mobile number, authentication identifiers, avatar, account settings, organization and workspace membership
User Content and project data	Prompts, uploaded images, videos, audio, documents and other files; canvas, project and collaboration data; generated outputs; associated metadata
Transaction data	Plan, credit balance, order identifiers, purchase amount and currency, payment and refund status. Payment providers process full payment-card or wallet details; we generally receive transaction records rather than full card details
Usage and device data	IP address, signup-country information, browser and device information, pages and features used, interactions, timestamps, logs, diagnostics and performance data
Cookies and local-storage data	Session, security, referral, preference and analytics identifiers
Communications	Support requests, feedback, survey responses and other messages you send us
Derived data	Thumbnails, embeddings, safety or abuse signals, usage statistics, and inferences needed to operate, secure or improve the Service

User Content may contain personal data about you or other people. You are responsible for having the rights and permissions required to provide that content to the Service.

We collect data directly from you, automatically from your browser or device, from people who invite you to a workspace, and from service providers such as authentication and payment providers.

2. How We Use Personal Data

We use personal data to:

provide and operate the Service, including authentication, uploads, storage, generation, editing, collaboration, sharing and support;
process AI requests, including transmitting prompts, files, parameters and outputs to the AI model or infrastructure provider selected for a task;
administer purchases, subscriptions, credits, invoices, refunds and payment disputes;
maintain safety and security, detect fraud and abuse, enforce our Terms, debug failures and protect users and the Service;
analyze and improve the Service, including reliability, performance and user experience, using operational data and, where practicable, aggregated or de-identified data;
communicate with you about your account, transactions, security, service changes and support;
send marketing communications where permitted. You may opt out of marketing at any time, but not essential account, transaction or security notices; and
comply with law and establish, exercise or defend legal claims.

We do not use private User Content for targeted advertising. If we introduce a materially different use of private User Content, we will provide additional notice and obtain consent where required by law.

2.1 Legal Bases for EEA and UK Users

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:

contract — to provide the Service you request and administer your account and purchases;
legitimate interests — to secure, maintain, analyze and improve the Service, prevent fraud and communicate with you, balanced against your rights;
consent — where we specifically request it, such as for certain marketing or non-essential tracking; and
legal obligation — to comply with applicable law, lawful requests and recordkeeping duties.

3. How We Disclose Personal Data

We disclose personal data only as reasonably necessary for the following purposes:

AI model and API providers. Prompts, task parameters, uploaded files and related content may be sent to third-party model providers to generate the output you request. Which provider receives data can depend on the selected model, availability, routing and any bring-your-own-key configuration.
Infrastructure providers. Cloud hosting, databases, storage, content delivery, communications, monitoring, security and technical-support providers process data needed to run the Service.
Payment providers. Payment processors, merchants of record, banks and wallet providers process purchases, subscriptions, refunds, fraud checks and disputes.
Analytics providers. Where enabled, analytics providers receive device, usage and event data so we can understand and improve the Service. Private User Content is not provided to them for advertising.
Other users and the public. Content and profile information are disclosed when you collaborate, invite others, publish, share a link or otherwise choose to make information available. Workspace administrators may access and manage data within their workspace.
Professional advisers and authorities. We may disclose data to advisers, auditors, insurers, regulators, courts or law-enforcement authorities when reasonably necessary or legally required.
Business transfers. Data may be disclosed in connection with a financing, merger, acquisition, reorganization or sale of assets, subject to appropriate safeguards.
At your direction or with your consent. We disclose data when you request an integration, direct us to do so or otherwise consent.

Third-party processors are not our own systems. Their processing is governed by our arrangements with them and, where applicable, their terms and privacy policies.

We do not sell personal data, and we do not share it for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws.

4. Cookies and Similar Technologies

We use cookies, local storage and similar technologies for:

strictly necessary functions, such as authentication, security and session continuity;
preferences, such as language and interface settings; and
analytics and performance, where enabled, such as page views, feature interactions, diagnostics, performance metrics and masked session recordings.

Our analytics configuration respects supported browser Do Not Track signals. You can also control cookies through your browser or device. Blocking necessary storage may prevent parts of the Service from working. Additional consent or opt-out controls may be provided where required by applicable law.

5. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy. Retention depends on the data type, account or workspace status, operational need, legal and contractual requirements, dispute and fraud-prevention needs, and applicable limitation periods.

User Content is generally retained while you or the relevant workspace keeps it in the Service. Deleting content removes it from normal access, but deletion from caches, backups and provider systems may take additional time under their retention cycles.
Account data is retained while your account is active and then deleted or de-identified as described below, subject to necessary exceptions.
Transaction, security and audit records may be retained after account deletion when required for accounting, tax, fraud prevention, dispute resolution, safety or legal compliance.
Backups and logs may persist until they are deleted or overwritten on their ordinary schedules. They are not available through normal product access, but may be used where necessary for disaster recovery, security or legal needs.

We may retain de-identified information that can no longer reasonably identify you.

6. International Data Transfers

We and our service providers may process data in countries other than where you live. Those countries may have different data-protection laws. Where required, we use appropriate safeguards for international transfers, such as contractual protections, and make further information available on request.

7. Security

We use reasonable administrative, technical and organizational safeguards designed to protect personal data. No system, transmission or storage method is completely secure, so we cannot guarantee absolute security. Please protect your credentials and notify us promptly if you suspect unauthorized account access.

8. Your Privacy Rights and Choices

Depending on where you live, you may have the right to:

access or obtain a copy of personal data we hold about you;
correct inaccurate personal data;
request deletion of personal data;
object to or restrict certain processing;
receive certain data in a portable format;
withdraw consent, without affecting processing that was lawful before withdrawal;
opt out of certain sales, sharing or targeted advertising, where applicable;
appeal a refusal to act on a request; and
lodge a complaint with your local data-protection authority.

You may use available account controls or email info@sumcloud.com to exercise these rights. We may need to verify your identity and authority before acting. Authorized agents may submit requests where applicable. We will not discriminate against you for exercising a privacy right.

Some rights are subject to exceptions. For example, we may retain data needed to complete a transaction, protect security, comply with law or establish legal claims.

9. Account and Content Deletion

You may initiate account deletion from available account settings or contact info@sumcloud.com. Account deletion is irreversible and ends access to remaining credits and account-only features.

When an account is deleted, we deactivate it, remove direct sign-in identifiers from the active account and delete or de-identify associated personal data where reasonably practicable. Account deletion does not necessarily erase every record immediately: transaction, security, audit, legal, shared-workspace, backup and third-party-provider records may remain for the limited purposes and periods described in Section 5.

Deleting your account does not delete content owned or controlled by another workspace, content you intentionally made public, or copies another user lawfully saved outside the Service. Delete content you control before deleting your account if you want it removed from normal access.

10. Third-Party Services and Links

The Service may integrate with or link to third-party services. Their privacy practices are governed by their own notices, not this Policy. Review those notices before providing data or enabling an integration.

11. Children's Privacy

The Service is not directed to anyone under 18 years old, and we do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, contact us so we can investigate and take appropriate action.

12. Changes to This Policy

We may update this Policy as the Service, our practices or applicable law changes. We will post the revised Policy and update the "Last updated" date. Where required, we will provide additional notice of material changes before they take effect.

13. Contact Us

For privacy questions or requests, contact:

Company: Sumcloud Inc.
Address: 300 Lenora Street #683, Seattle, WA 98121, USA
General and privacy inquiries: info@sumcloud.com
Business inquiries: sales@sumcloud.com
Website: https://magikaru.com

We will respond within a reasonable time and within any deadline required by applicable law.