How we handle your data

Magic Lupa is designed with privacy by default. We don't create user accounts, don't ask for email, don't build advertising profiles and don't sell data to third parties.

What we store

• Pack balance cookie (HMAC-signed, name ml_pack): how many paid searches remain. Expires in 365 days.
• Free quota cookie (HMAC-signed, name ml_q): how many free searches you used today. Expires each day.
• Preferences in localStorage: country, language, mode, optional city. Lives only in your browser.
• Aggregated anonymous counter of total searches and detected savings. Does not include what anyone specifically searched.

What we do NOT store

• Individual search history.
• Personal data (email, name, phone).
• Payment information (Stripe handles that).
• Advertising or third-party tracking cookies.
• Your IP in plain text. For rate limit we store an irreversible HMAC hash of the IP, not the IP.

Cookies

We only use strictly necessary cookies for operation: ml_pack (balance), ml_q (free quota) and consent. All first-party, httpOnly when applicable, and signed so they can't be manipulated.

No advertising cookies, no cross-site tracking, no social media cookies. No Facebook pixel. No classic Google Analytics. We use Vercel Web Analytics for aggregate pageview counts and referrer info — Vercel does not use cookies and does not identify individual users.

Third-party data sharing

• Anthropic (model provider): your search query. No cookies or identifiers passed.
• Google Custom Search: when fetching product images. We pass the product name only.
• Stripe: only if you buy a pack. Stripe processes payment and returns a session_id. Stripe has its own privacy policy.
• Vercel: our hosting. Processes each request and stores basic logs for 30 days.

Your rights (GDPR / CCPA / equivalents)

Since we don't build individual profiles, most GDPR rights don't literally apply (no profile to rectify or delete). If you want:

• Delete your pack balance: clear site cookies in your browser (Settings → Privacy → Cookies). That removes our record of you.
• Delete preferences: clear site localStorage in your browser.
• Request info or exercise any right: email us at hola@magiclupa.com — we reply within 30 days.

Changes to this policy

If anything material changes, we announce it on this page. The current version always shows the date in the header.

Contact

Any question: hola@magiclupa.com.