Privacy Policy

Last updated: 3 November 2026

Magic Letterbox is building a new way to identify places, verify interactions and build trust in the physical world.

This Privacy Policy explains how Magic Letterbox collects, uses, stores and protects personal information when you use our website, mobile applications, products and services.

We aim to be clear about what information we collect, why we need it and how we use it.

1. Who we are

Magic Letterbox is operated by:

MAGIC LETTERBOX LIMITED
Company number: 17015503
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

ICO data protection registration reference: ZC283315

In this Privacy Policy, we refer to ourselves as “Magic Letterbox”, “we”, “us” or “our”.

If you have any questions about this Privacy Policy or how we use your personal information, please contact:

Email: privacy@magicletterbox.com

2. The information we collect

The information we collect depends on how you interact with Magic Letterbox.

This may include information about:

Information you provide to us

For example:

your name;
email address;
telephone number;
account and login details;
property address;
delivery preferences;
safe-place information;
access preferences;
information submitted through our website forms;
information provided when you contact us;
subscription and order information;
billing and delivery information associated with an order;
information relating to payment status or transactions;
information you provide when participating in pilots, testing or other programmes.

Buying from us

When you buy a product or service from us, we may process information needed to fulfil the purchase, including your name, contact details, billing or delivery information, order and transaction information and payment status.

Order and payment records are generally retained for six years where required for tax, accounting or other legal purposes.

Information about other people

Users may provide us with personal information about other people. For example, Magic Access hosts may provide guests’ and team members’ names, email addresses and mobile numbers, including information about co-hosts, cleaners, tradespeople and household members.

If you provide us with another person’s personal information, you should make sure they know that you have done so and that they can read this Privacy Policy.

Website usage and analytics information

Where you have provided the required consent, our website may use analytics technologies including Google Analytics 4 and Microsoft Clarity.

These technologies may collect information such as:

pages viewed;
navigation and interactions with the website;
scrolling and engagement;
referring websites or campaigns;
device, browser and operating-system information;
approximate location information derived from technical data;
pseudonymous identifiers;
website performance information; and
session interaction information, including clicks, scrolling and navigation.

Microsoft Clarity may also create session recordings and heatmap-style information to help us understand how visitors use the website and improve usability.

We do not intentionally configure these services to collect information such as passwords or complete payment-card details.

Property and location information

Magic Letterbox is designed around the concept of a Global Property ID (GPID™).

Depending on the service you use, we may process:

property address information;
precise geographic coordinates;
the location of the property;
the location of a designated safe place;
delivery-point information;
information associated with a GPID;
location information associated with delivery or access events.

Precise location information is particularly important to the operation of the Magic Letterbox service.

3. Information collected through the mobile applications

Our Magic Letterbox, Driver and Magic Access applications do not currently use analytics or advertising tracking SDKs.

Depending on the application and the features being used, information may include:

Magic Letterbox app

The Magic Letterbox app may use:

precise GPS location while the app is in use;
the camera for QR-code scanning;
photographs;
video recorded during supported guest arrival or exit processes;
photographs selected from the device's photo library;
push notification tokens;
property and safe-place information;
login information and authentication tokens.

The Magic Letterbox app may also cache certain property information on the device to support the service.

Magic Access app

The Magic Access app may use:

guests’ and team members’ contact details;
instructions, Wi-Fi details and key safe codes entered by hosts;
push notification tokens;
precise location information, only while setting up markers;
the camera to scan Magic Markers and to take photographs and video of entrances and key safes; these recordings are made without sound.

Driver app

The Driver app may use:

precise GPS location while the app is in use;
the camera for QR-code scanning;
proof-of-delivery photographs;
NFC for supported handover or recipient verification;
push notification tokens;
delivery information;
offline delivery information, including relevant GPS points, until that information can be synchronised with our systems.

Account and authentication information

Magic Letterbox and Magic Access accounts can currently be deleted through the relevant app. Deleting the account removes the shared Magic account used by both apps.

Driver accounts are created by Magic Letterbox rather than through the Driver app. Drivers can ask us to delete their account by emailing privacy@magicletterbox.com.

4. Photos and video

Some Magic Letterbox services may use photographs or video to support delivery, access or verification processes.

For example:

a driver may take a photograph as proof of delivery;
a Magic Access host may add arrival and check-out photographs or video in the Magic Access app;
a Magic Access guest may add check-out photographs or video through the web stay page, without using an app.

Photographs and video may contain information about people, homes, entrances, neighbouring properties or other objects visible within the image.

We use this information only for the relevant service, verification, security, operational or evidential purposes.

Magic Access guest photographs and video are deleted 90 days after check-out. Other photographs and video are retained only for as long as necessary for the relevant purpose, subject to legal, contractual and legitimate business requirements.

We will not use photographs or video for unrelated purposes without an appropriate legal basis.

5. How we use your information

We may use personal information to:

create and manage your Magic Letterbox account;
create, maintain and operate your GPID;
locate and register your property;
record delivery preferences and safe places;
provide verified delivery services;
support verified access services;
support delivery and access workflows;
verify interactions involving a Magic Letterbox location;
record delivery and access events;
provide proof or evidence of supported transactions or events;
send service notifications;
provide customer support;
process payments and subscriptions;
administer orders and fulfil purchases;
manage billing and delivery information;
operate our website, online shop and checkout;
understand website usage and performance;
analyse website interactions and usability;
improve and develop our products, services and website;
communicate with you about Magic Letterbox;
manage our business relationships;
detect, prevent and investigate fraud, misuse, security incidents and other unlawful activity;
comply with legal and regulatory obligations;
establish, exercise or defend legal claims.

Where we operate services for retailers, carriers or other business customers, we may also process information to provide those services in accordance with the relevant agreement and instructions.

6. Our lawful bases for processing

Under UK data protection law, we need a lawful basis for processing personal information.

Processing activity	Lawful basis
Accounts and services	Contract
Magic Access guest data	Legitimate interests
Order and payment records	Legal obligation
Website analytics	Consent
Marketing communications where consent is required	Consent
Security and fraud prevention	Legitimate interests

The main processing activities and lawful bases include:

Contract

Where processing is necessary to provide a product or service you have requested, manage your account, process a transaction or perform our obligations under an agreement.

This may include processing information necessary to fulfil an order or provide products and services purchased through our website.

Legitimate interests

Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms.

This may include:

operating and improving our services;
maintaining the security of our systems;
preventing fraud and misuse;
managing our business;
communicating with existing customers about relevant services;
maintaining appropriate records;
improving website functionality and usability where legitimate interests is an appropriate lawful basis.

Where we rely on legitimate interests, we will consider the impact on individuals and apply appropriate safeguards.

Consent

Where consent is required, we will ask for it.

This may include:

certain marketing communications;
non-essential website cookies and similar technologies;
website analytics using Google Analytics 4;
website analytics and session analysis using Microsoft Clarity; and
other processing where applicable law requires consent.

Where we rely on consent, you can withdraw your consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Legal obligation

Where processing is necessary for us to comply with a legal or regulatory obligation.

For example, this may include keeping records of sales for tax purposes.

Vital interests

In limited circumstances, processing may be necessary to protect someone's vital interests.

We will only rely on a lawful basis that is appropriate to the particular processing activity.

7. Information from other sources

We may receive information from sources other than directly from you.

Crowdfunder, where applicable, which may provide backers’ details so that we can administer rewards and fulfil our obligations;
Magic Access hosts, who may provide us with their guests’ and team members’ details;

Depending on the service, this may include:

retailers;
carriers;
delivery partners;
business customers;
address and property-data providers;
payment providers;
app stores;
service providers operating on our behalf.

Where we receive personal information from another organisation, we will provide the privacy information required by applicable data protection law.

8. Address and property information

Magic Letterbox uses address and property information to help identify and locate physical places.

Our current address-related providers include:

Royal Mail PAF;
Ordnance Survey;
Ideal Postcodes.

These services may be used to support address lookup and property identification.

The use of a property address or geographic location does not necessarily mean that the information relates to a particular individual. However, where property information can be linked to an identifiable individual, we will treat it as personal information where applicable.

9. Delivery information

Where Magic Letterbox is used in connection with a delivery, we may process information such as:

delivery location;
delivery event;
driver location associated with the delivery;
delivery time;
QR-code scans;
NFC scans;
proof-of-delivery photographs;
relevant account information;
safe-place information;
audit information.

Our systems may automatically process information following a confirmed delivery to refine the property's geographic location and generate a confidence score relating to the location.

We do not make decisions about you using only automated means that have legal or similarly significant effects on you.

This processing is intended to improve the accuracy of the place, rather than to profile individuals.

10. Magic Access guests

Magic Access hosts may provide us with information about their guests, including the guest’s name, email address, mobile number and stay dates.

During a stay, the Magic Access guest web stay page may record information such as Magic Marker scans, use of the “show the code anyway” option, check-out checklist information, private notes, and photographs or video provided by the guest.

Hosts and co-hosts can see the relevant guest information. Cleaners may see relevant access times where needed for their role. Magic Access does not use location tracking to track guests during their stay.

A limited offline copy of relevant stay information may also be stored on the guest’s phone to support the service.

Magic Access guest details, notes, photographs and video are deleted 90 days after check-out. This deletion runs automatically each night.

The lawful basis for processing Magic Access guest information is generally our legitimate interests in providing and securing the service, managing access and maintaining appropriate records, balanced against the rights and interests of the people whose information we process.

11. Sharing information

We may share personal information where necessary to provide our services, operate our systems, process transactions, comply with legal obligations or protect our legitimate interests.

Our current technology and service providers include:

Amazon Web Services (AWS)

AWS provides hosting and infrastructure services for our backend systems, database, photo and video storage, message queues and authentication services.

Our website and backend infrastructure use AWS services, including infrastructure located in the UK (London) region.

Stripe

Stripe provides payment-processing and online checkout services.

Where you purchase products or services through our website, relevant information may be shared with Stripe to process the transaction, including information such as your name, contact details, billing or delivery information, order and transaction information and payment-related information.

Stripe may also process information for purposes such as payment security and fraud prevention in accordance with its own privacy arrangements.

Google

Google provides certain services including Firebase Cloud Messaging and Google Maps within supported applications.

Google Analytics 4 is also used on our website for website analytics where the appropriate consent has been provided.

Apple

Apple provides push notification services for supported mobile applications and distributes our iOS applications through the App Store.

HubSpot

HubSpot provides website forms and customer relationship management services. HubSpot hosts relevant services in its EU data centre where applicable.

Microsoft

Microsoft provides Microsoft Clarity, which we use for website usability and interaction analysis where the appropriate consent has been provided.

Royal Mail, Ordnance Survey and Ideal Postcodes

These providers support address lookup and property information.

Crowdfunder

Where applicable, Crowdfunder may provide or process backer information for campaign administration and reward fulfilment.

Courier providers

We may share relevant name, contact, delivery and order information with courier providers used to deliver Magic Letterbox kits.

Amazon SES

AWS sends our emails through Amazon Simple Email Service (SES).

Zoho

Zoho provides business email services.

We may also share information with retailers, carriers or other business customers where this is necessary to provide a Magic Letterbox service or where you have otherwise authorised or requested the relevant interaction.

For example, our backend can send relevant delivery events to retailers and carriers using webhooks.

12. Controller and processor roles

Magic Letterbox may act in different data-protection roles depending on the service and processing activity.

For information relating to your Magic Letterbox account, GPID, preferences and use of our consumer services, Magic Letterbox will generally determine the purposes and means of processing and will therefore act as a data controller.

Where Magic Letterbox processes personal information solely on behalf of a retailer, carrier or other business customer and in accordance with their documented instructions, we may act as a data processor.

The precise role will depend on the particular processing activity and contractual arrangement.

Where we act as a processor, the relevant business customer's privacy notice and contractual arrangements may also apply.

13. International transfers

Some of our service providers are international organisations and may process personal information outside the United Kingdom. Where relevant, Google and Microsoft may process personal information in the United States under the UK-US data bridge or another valid transfer mechanism. Stripe and Apple use their own appropriate transfer safeguards.

Where personal information is transferred outside the UK, we will ensure that an appropriate legal mechanism and safeguards are in place as required by applicable data protection law.

Depending on the circumstances, these may include:

an adequacy decision;
appropriate contractual safeguards;
the UK International Data Transfer Agreement;
the UK Addendum to EU Standard Contractual Clauses;
another legally permitted transfer mechanism.

Where required, further information about the relevant safeguards will be made available on request.

14. Cookies and similar technologies

Our website uses cookies and similar technologies for essential website functionality, online shopping and checkout functionality, forms and customer relationship management, and website analytics.

These currently include:

essential browser storage associated with website shopping and checkout functionality;
HubSpot cookies associated with forms and CRM functionality;
Google Analytics 4 analytics technologies;
Microsoft Clarity analytics technologies.

Where non-essential cookies or similar technologies require consent, we will obtain the appropriate consent before using them.

Further information about the cookies and similar technologies we use, their purposes and how they are managed will be provided in our Cookie Policy.

Our website fonts are self-hosted and do not require requests to Google's font servers.

15. Marketing communications

We may use your contact information to communicate with you about Magic Letterbox where we have a lawful basis to do so.

Where marketing consent is required, we will ask you to opt in.

You can unsubscribe from marketing communications at any time.

Service and transactional communications, such as information necessary to operate your account, process an order or provide a service you have requested, are different from marketing communications and may continue where necessary.

16. Data retention

We do not keep personal information indefinitely.

The length of time we retain information depends on:

the type of information;
why we collected it;
whether it is necessary to provide an ongoing service;
legal or regulatory requirements;
contractual requirements;
whether it is needed to establish, exercise or defend legal claims;
security and fraud-prevention requirements;
whether it can be anonymised instead of retained in identifiable form.

We currently apply the following retention periods or criteria:

Account, property, GPID, delivery, access, notification and audit information: for as long as necessary to provide the service, meet legal or contractual requirements, maintain security, or establish, exercise or defend legal claims.
Microsoft Clarity recordings: 30 days.
Google Analytics data: retained according to the retention setting configured in Google Analytics 4.
Order and payment records: six years where required for tax, accounting or other legal purposes.
Unaccepted team invitations: 30 days after the invitation expires.
Magic Access guest details, notes, photographs and video: 90 days after check-out; deletion runs automatically each night.

Analytics providers may also retain information in accordance with their own service configurations and retention arrangements. We will configure and review these services appropriately for our purposes.

Where a specific retention period has not been established, we will periodically review whether the information remains necessary and securely delete or anonymise it when it is no longer required.

17. Security

We take the security of personal information seriously.

We use appropriate technical and organisational measures designed to protect personal information against:

unauthorised access;
accidental loss;
destruction;
alteration;
disclosure;
other unauthorised or unlawful processing.

Our infrastructure is hosted using AWS services and our applications use appropriate authentication and secure device storage mechanisms.

Our online checkout and payment processing use established payment infrastructure provided by Stripe.

No internet-based service can be guaranteed to be completely secure. We will nevertheless continue to review and improve our security measures as Magic Letterbox develops.

18. Your rights

Depending on the circumstances, you have rights under UK data protection law including:

the right to be informed about how we use your information;
the right to request access to your personal information;
the right to request correction of inaccurate information;
the right to request deletion of your information;
the right to request restriction of processing;
the right to object to certain processing;
the right to data portability where applicable;
the right to withdraw consent where we rely on consent.

Some rights are subject to conditions and exceptions.

For example, we may need to retain certain information where we have a legal obligation to do so or where it is necessary to establish, exercise or defend legal claims.

Where we rely on legitimate interests, you generally have a right to object to that processing.

The exact rights available to you depend on the lawful basis and circumstances of the processing.

19. How to exercise your rights

You can contact us using:

Email: privacy@magicletterbox.com

We may need to verify your identity before responding to a request.

We will normally respond within one month. Where a request is particularly complex, we may extend the response period by up to two further months, in which case we will tell you.

20. Account deletion

Magic Letterbox and Magic Access accounts can currently be deleted through the relevant app. Deleting the account removes the shared Magic account used by both apps.

If you cannot access the relevant functionality, or if you are using another Magic Letterbox service, you can contact us using the details above.

Deletion of an account does not necessarily mean that every item of information is immediately deleted. We may need to retain certain information where required by law, necessary for legitimate purposes, required to resolve disputes, needed to establish, exercise or defend legal claims, or required to maintain appropriate transaction or financial records.

21. Children

You must be 18 or over to create an account or buy from us.

Magic Access may involve invited guests who are under 18 where the host permits this, but accounts and purchases must be made by someone aged 18 or over.

If you believe that a child has provided us with personal information inappropriately, please contact us.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be necessary when:

we introduce new products or features;
our use of technology changes;
our service providers change;
legal or regulatory requirements change;
we develop new delivery, access or verification services;
our website, shop or payment services change.

The latest version will be published on our website and will show the date it was last updated.

Where changes are significant, we will take additional steps to bring them to your attention where required.

23. Complaints

If you have a concern about how we have handled your personal information, please contact us first so that we have an opportunity to investigate and resolve it. We will acknowledge data-protection complaints within 30 days and will investigate and respond without undue delay.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk/make-a-complaint/

You can contact the ICO if you believe that your personal information has been handled unlawfully or that your data protection rights have not been respected.

24. Contact us

If you have any questions about this Privacy Policy, your personal information or the way Magic Letterbox processes data, please contact:

Magic Letterbox
Email: privacy@magicletterbox.com