Privacy Policy

This policy covers data we collect from merchants — the food sellers running a shop on Mag!c. If you're a diner ordering from a Mag!c shop, the Customer Privacy Policy is the one you want.

Mag!c is a service of Mise (“we,” “our”), operating at magic.mise-group.com. This policy is written to comply with the Philippine Data Privacy Act of 2012 (RA 10173).

• Business identity — shop name, shop URL slug (e.g. /lolaspancit), description, logo, cover photo, hours, cuisine tags.
• Operator contact — the email and phone of the person who runs the account, used for sign-in, transactional emails, and support.
• Locations — pickup address and any additional branch addresses. We need these to book Lalamove and to show customers where the food is coming from.
• Payment and payout details — GCash QR image, and (when payouts launch) the bank or e-wallet account where we remit platform-collected amounts.
• Item data — items, prices, photos, availability, modifiers, and any allergen / dietary notes you add.
• Operating data — orders received, totals, refunds, end-of-day reports, stamp issuance, promo usage. This is what powers your dashboard.
• Billing and wallet data — your wallet balance and transaction ledger, top-up records, subscription plan, billing status, and invoices. Top-ups are processed by our payment partner (PayRex); we never see your full card or e-wallet credentials.
• Compliance documents, if and when we ask for them — e.g. business permit, BIR registration, FDA LTO, or ID for KYC on payouts. Stored encrypted, accessible to a small operations group only.
• Technical data — standard server logs (IP, user agent, request paths) for security and abuse prevention.

We don't collect data about your staff beyond what's needed to give them access to the dashboard or POS. If you add staff logins later, those follow the same rules.

• To run your shop: sign-in, your dashboard, the POS, your public storefront at /[your-slug].
• To book deliveries on your behalf — we pass pickup address, contact, and order summary to Lalamove (or another courier you choose).
• To process wallet top-ups, collect the platform subscription from your wallet, and send billing notices and receipts, working with our payment partners.
• To send transactional and operational emails (order alerts, refund confirmations, dashboard digests, incident notices).
• To improve Mag!c. Aggregate, de-identified usage data may be used to size capacity, fix bugs, and prioritise features. We don't use your individual sales numbers to train AI or to sell ad targeting.
• To prevent fraud and abuse, and to comply with lawful requests from regulators or courts.

• You — full access via your dashboard.
• Your customers — they see what you publish on your storefront: shop name, description, hours, items, photos, pickup area, and your GCash QR at checkout. They do notsee your payouts, fees, or other merchants' data.
• Lalamove (and future couriers) — for orders you set to deliver, the courier receives pickup address, your contact person and number, drop-off address, customer contact, and an order summary. We pass the minimum needed to complete the ride.
• Payment partners — when payouts go live, our payment processor receives the payout instruction and whatever KYC information they require by law.
• Payment processing — PayRex processes wallet top-ups and receives the details needed to complete each payment.
• Our infrastructure providers — Supabase (database + auth), Vercel (hosting and aggregate page analytics), and Resend (email). Each processes data on our behalf under their own contractual protections. The analytics are audience-level page statistics — no cross-site advertising trackers.
• Regulators or courts, only when we are lawfully required to disclose.
• We do not sell your data, and we do not share your items, sales, or customer list with other merchants on the platform.

Mag!c uses database-level Row Level Security (RLS) to keep each merchant's data isolated. Another merchant on the same platform cannot read your orders, your item drafts, your customer list, or your sales numbers, even though we all sit on the same Supabase instance.

Under the Data Privacy Act you have the right to be informed, the right to access, the right to correct, the right to erase, and the right to object. To exercise any of these, email hello@mise-group.com. We respond within 15 working days.

You can edit your shop profile, items, GCash QR, and operator contact at any time from your dashboard. Closing your account removes your shop from public view immediately and queues your records for deletion, subject to the retention rules below.

Active merchant accounts are kept indefinitely. Financial records (orders, refunds, payouts, invoices) are kept at least 10 years to satisfy BIR record-keeping rules. KYC and compliance documents are kept as long as required by the applicable regulator, then deleted.

Inactive accounts (no sign-in for 12 months and no active orders) may be archived; we email you before doing so.

Passwords are hashed via Supabase Auth. All connections use HTTPS. Sensitive uploads (GCash QR, compliance documents) are stored in access-controlled buckets. Access by Mise staff to merchant data is logged and limited to support, security, and billing roles on a need-to-know basis.

If a security incident affects your data, we will notify you and the National Privacy Commission within the timelines required by RA 10173.

If we make material changes, we'll email active merchants and post the updated version here at least 14 days before it takes effect.

Data Protection Officer · Mise · hello@mise-group.com