Privacy Policy

Our Services are intended for Business Customers, and we hold and process consumer and other End User data on behalf of our Business Customers. When we process consumer personal information on behalf of a Business Customer, we act as a service provider / data processor, while the Business Customer is the responsible data controller. We process such consumer personal information only per our Service Agreement with that Business Customer, the Terms, and applicable law. If you are an End User who is a customer of one of our Business Customers (such as a dry cleaning or laundry company), please contact them directly to inquire about how their data policies may affect you or to exercise any applicable rights for which they are the data controller.

For instances in which you interact with us directly apart from your relationship to a Business Customer, we may be the data controller.

If you are an End User of one of our Business Customers and use one of our service portals to interact with that Business Customer, any user information you directly input into that portal goes into the Business Customers’ account on our systems. In addition, the Business Customer or their authorized users may directly input data about you into their accounts on our systems. All such data is treated as data of the Business Customer, and the Business Customer is the applicable data controller for any such personal information.

Information We Process

Depending on the Services selected by a Business Customer and how those Services are configured or used, we may process the following categories of personal information:

• Account and contact information: names, business names, postal and e-mail addresses, telephone numbers, account identifiers, authentication information, roles, account settings, and preferences.
• Consumer, order, and garment information: consumer profiles, service requests, order history and status, garment or item descriptions, care preferences, pickup and delivery instructions, support records, and transaction history.
• Business operations and inventory information: business profiles, store and plant information, service settings, inventory records, wholesale and other invoices, and operational and analytics data.
• Workforce, timekeeping, and payroll-related information: employee or contractor identifiers, roles, schedules, work locations, clock-in and clock-out times, time records, and payroll-related information, but only when a Business Customer uses those features or submits that information.
• Location and route information: service addresses, pickup and delivery locations, route assignments, stops, status information, timestamps, and location information submitted to or generated by enabled route or location features.
• Payment and transaction information: transaction amounts, invoices, payment status, transaction identifiers, and payment tokens or other limited payment information made available through payment processors or integrations. Depending on the payment implementation, payment card or bank account details may be collected directly by a third party payment processor rather than by Magnoli.
• Communications and marketing engagement information: the content and metadata of e-mails, text messages, notifications, and support communications; campaign selections; delivery status; opt-out requests; and engagement information.
• AI feature information: prompts, instructions, inputs, outputs, feedback, and related usage information when AI-enabled features are offered and used.
• Technical, usage, and cookie information: IP address, device and browser information, pages and features used, access times, log data, identifiers, cookies, and similar technologies.

Sources of Information

We may obtain personal information directly from you or other End Users; from our Business Customers and their authorized users; from third-party services, integrations, and payment processors; automatically from devices when using the Services; and from information generated or derived through use of the Services.

Purposes for Processing

We may process personal information to provide, configure, maintain, support, secure, and improve the Services; authenticate and administer accounts; carry out Business Customer instructions; process or facilitate payments; deliver communications and Business Customer-directed campaigns; provide support and troubleshoot problems; analyze performance and usage; prevent fraud, misuse, and security incidents; comply with law; and enforce or protect rights and agreements.

How We Disclose Information

We may disclose personal information to the applicable Business Customer and its authorized users; to End Users as needed to provide Business Customer-facing functionality; to vendors and service providers supporting hosting, security, communications, analytics, professional services, payment processing, and other operations; to third-party integrations and payment processors authorized by a Business Customer; to professional advisers; to governmental authorities or other parties when required by law or reasonably necessary to protect rights or safety; and to parties involved in a merger, acquisition, financing, reorganization, or sale of assets. We may also use and disclose aggregated or deidentified information for other business purposes to the extent permitted by law.

Service Provider Role

When we process personal information on behalf of a Business Customer, we act as a “service provider” or “processor” (as those terms are defined under applicable law). We process your personal information in accordance with our agreement with that Business Customer and applicable law. The Business Customer is the data controller and you should direct any inquiries regarding your personal consumer information directly to them.

Retention Criteria

We retain each category of personal information only for as long as reasonably necessary based on the nature of the information; the purposes described herein; instructions from and agreements with Business Customers; the duration and status of the relevant account, transaction, or business relationship; support, security, fraud prevention, and continuity needs; applicable legal, tax, accounting, and recordkeeping requirements; and the establishment, exercise, or defense of legal claims. Customer data may be returned, deleted, or deidentified in accordance with the applicable Service Agreement or Business Customer instructions. Information may remain longer in backups or under a legal hold where reasonably necessary, after which it may be deleted or deidentified in accordance with our retention practices and applicable law.

Children

The Services are not directed to children under 13 (or under 16 in jurisdictions where that is the applicable threshold), and we do not knowingly collect their personal information.

Cookies and Tracking

We may use cookies and similar technologies for authentication, security, analytics, and to remember preferences. Most browsers allow you to control cookies through their settings. We do not respond to “Do Not Track” browser signals. Where required by applicable law, we will honor opt-out preference signals pertaining to your usage of our website such as Global Privacy Control (GPC).

Addresses, Phone, SMS, and E-mail

Our Business Customers may collect and use your contact information for their business purposes, including the use of communications or marketing campaigns managed through our platform or via third-party integrations.

We offer various communication compliance tools to our Business Customers and require them to comply with applicable law in their use of our Services. However, we do not approve communications our Business Customers send and make no representations or warranties about those communications. The Business Customer is the sending party of such communications and is responsible for how that contact information is used and for compliance with any applicable laws such as CAN-SPAM, TCPA, and any applicable data protection or privacy laws. Please direct any relevant questions or opt-out requests directly to them.

Text messages can ordinarily be stopped or started, as applicable, by texting STOP or START to the sending number. E-mails can ordinarily be unsubscribed from a dedicated link found at the bottom of the e-mail.

For instances in which you interact with us directly apart from a Business Customer and we are the data controller, you may reach out to us with any relevant questions or opt-out requests.

Your Other Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to opt out of certain processing, and to be free from unlawful discrimination for exercising these rights.

If we are the data controller, contact us to exercise these rights. We will verify your request and respond within the time required by applicable law.

If you are an End User of one of our Business Customers and are inquiring about information held by the Business Customer, we are unable to respond to your request directly as we are not the data controller; please direct your request to that business, and we will assist them as their service provider.

International Users

We operate in the United States of America. If you access the Services from a different country, you understand that your information will be processed in the United States of America, which may have different data protection laws than your country.

Data Breaches

We implement reasonable security measures to protect your information. If you are our Business Customer, we will attempt to notify you promptly if we become aware of a confirmed data breach affecting your data, and in any event within the timeframe required by applicable law. Where we are the data controller and law requires, we will attempt to notify affected individuals directly.

Third Parties

We are not responsible for the data handling practices of any third parties whose services may integrate or interact with ours. Please direct any such inquiries directly to those third parties. We will be glad to assist you in making that inquiry as appropriate.

Data Backup

You are responsible for backing up your own data as used with our Services. We are not liable for data loss caused by third party failures, your own errors, or unauthorized access of your account.

Other Business Customer Provisions

If you are our Business Customer, you are responsible for ensuring that your use of our integrated communication tools (such as text messages and e-mails sent through our platform), data you upload to our platform, and other Services complies with applicable laws, such as CAN-SPAM, TCPA, and any applicable data protection or privacy laws.

If you are our Business Customer, upon termination of our relationship, we will make your data available for export for a reasonable period, after which we may delete or deidentify it in accordance with our retention practices and applicable law.