Privacy Policy
Magikal (magikal.co)
Last updated: 25 August 2026
1. Who we are
Magikal is a reading platform operated by Magikal Ventures (Registration No. 202503278683 / 003784218-D), a business registered in Malaysia with its principal place of business at 21-B, Persiaran Pegaga, Taman Bayu Perdana, 41200 Klang, Selangor, Malaysia.
In this policy, "Magikal", "we", "us" and "our" refer to Magikal Ventures as the data controller for personal data collected through magikal.co and its related sites. "You" refers to any person who visits, registers for, or purchases from Magikal.
This policy explains what personal data we collect when you use Magikal, why we collect it, who we share it with, and what rights you have over it. It is issued in accordance with the Malaysian Personal Data Protection Act 2010 (as amended by the Personal Data Protection (Amendment) Act 2024).
2. The personal data we collect
Account information. When you create a Magikal account we collect your name, email address, username and password. Passwords are stored in hashed form and are never visible to us.
Google sign-in information. If you choose to sign in with Google, Google sends us a limited set of information from your Google profile: your name, your email address, your profile picture, and a unique Google account identifier. This is covered in more detail in section 3.
Reading activity. When you read a title on Magikal we record which titles are in your library, your reading position within a book, and your reading history. This is what allows you to close a book on one device and resume from the same place on another.
Purchase information. When you buy a title we record what you purchased, when, and the amount paid. Payment card details are entered directly into our payment provider's systems and are processed by them — we do not receive, see or store your full card number.
Communications. If you subscribe to our newsletter we record your email address, your subscription preferences, and whether you opened or clicked our emails. Our newsletter runs on software installed on our own servers, so your subscription details are not passed to an external mailing provider. If you contact us for support we keep your message and our reply.
Technical information. Our servers automatically log your IP address, browser type and version, device and operating system, the pages you request, and the date and time of each request. This is standard web server activity and is used for security and troubleshooting.
3. Signing in with Google
Magikal offers "Sign in with Google" as a convenience so that you do not need to create and remember a separate password.
When you use it, we request only the basic sign-in scopes: your email address, your basic profile information (name and profile picture), and your OpenID identifier.
We want to be explicit about what this does not include. Magikal does not request and does not receive access to your Gmail messages, your Google Drive files, your Google Contacts, your Google Calendar, your Google Photos, your YouTube data, or any other Google service. We cannot read, modify or delete anything in your Google account.
We use the information Google sends us for one purpose only: to create your Magikal account and to sign you in to it on subsequent visits. We store the Google account identifier so that we can recognise you as the same person the next time you sign in. We do not sell this information, use it for advertising, or transfer it to anyone except as described in section 5.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Magikal from your Google account at any time at myaccount.google.com/permissions. Doing so stops future Google sign-ins but does not by itself delete your Magikal account — to delete the account, see section 9.
4. Why we use your data
We use your personal data to:
- create and maintain your account, and verify who you are when you sign in;
- give you access to titles you own or are entitled to read, and keep your library and reading position in sync;
- process purchases, issue receipts, and handle refunds or billing queries;
- send you service messages about your account, your purchases, or changes to this policy;
- send you our newsletter, where you have subscribed to it;
- understand how the site is used in aggregate, so we can improve it;
- keep Magikal secure — detecting fraud, abuse and unauthorised access; and
- meet our legal, tax and accounting obligations.
We process this data on the basis of your consent, and where processing is necessary to perform the agreement between us — for example, we cannot deliver a book you have bought without processing your order.
Providing your name, email address and payment details is necessary to hold an account and to purchase from Magikal. If you choose not to provide them, we will not be able to give you an account or complete a purchase. Newsletter subscription is entirely optional.
5. Who we share your data with
We do not sell your personal data. We share it only with the following categories of recipient, and only to the extent needed:
Our hosting and infrastructure providers, who store the data on our behalf and act only on our instructions.
PayPal, our payment provider. When you make a purchase you are handed over to PayPal to complete payment. PayPal receives your name, email address and order details, and handles your card or PayPal account credentials directly — we never see or store them. PayPal processes this data as an independent controller under its own privacy statement, not solely on our instructions.
Google, in connection with Google Sign-In (section 3) and Google Analytics (section 6).
Google, Meta Platforms and Reddit, in connection with the advertising and measurement tags described in section 6.
Professional advisers and authorities, where we are required to disclose data by law, court order, or a lawful request from a regulator, or where disclosure is necessary to establish or defend a legal claim.
A successor business, if Magikal Ventures is ever sold, merged or reorganised — in which case your data would transfer as part of that business, subject to the same protections.
6. Cookies and analytics
Magikal uses cookies and similar technologies.
Strictly necessary cookies keep you signed in, remember your session, and protect forms against cross-site request forgery. The site cannot function without these.
Analytics cookies. We use Google Analytics to understand how visitors find and use Magikal — which pages are popular, how long people stay, and where they drop off. Google Analytics sets cookies and collects information including your IP address, which Google processes on our behalf. You can opt out across all sites using Google's browser add-on.
Advertising and measurement tags. We run advertising tags from Google Ads, Meta Ads and Reddit Ads. These let us measure whether our advertising is working and show relevant ads to people who have visited Magikal. They may set cookies and may allow those platforms to recognise your browser on other sites they operate or serve ads on. You can manage ad personalisation at Google Ads Settings, in your Facebook or Instagram ad preferences, and in your Reddit account settings.
You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in.
7. Where your data is held
Magikal's servers and several of our service providers are located outside Malaysia. Where we transfer your personal data out of Malaysia, we do so on the basis that the recipient is bound by contractual obligations to protect it to a standard comparable to that required under the PDPA, and we assess each transfer before making it.
8. How long we keep it
We keep your account data for as long as your account is open. If you close your account we delete or anonymise your account and reading data within 90 days, except where we are required to keep records for longer.
Purchase and payment records are kept for seven years to meet Malaysian tax and accounting requirements. Newsletter subscription records are kept until you unsubscribe. Server logs are kept for no longer than 12 months.
9. Your rights
Under the PDPA you have the right to:
- Access the personal data we hold about you, and be told how it is being processed;
- Correct data that is inaccurate, incomplete, misleading or out of date;
- Withdraw consent to our processing of your data, including consent given when you registered;
- Request that we limit the processing of your data where you believe it is causing or likely to cause you unwarranted distress;
- Object to processing for direct marketing purposes — you may unsubscribe from our newsletter at any time using the link in any email, at no cost;
- Request portability of your data, so that it is transmitted to another data controller where this is technically feasible and the formats are compatible;
- Delete your account, by writing to the address in section 12.
To exercise any of these rights, email
If you are not satisfied with how we have handled your request, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).
10. Security
We protect your data with encrypted connections (HTTPS) across the site, hashed password storage, access controls limiting who within our organisation can view personal data, and regular backups. Book files are stored outside the public web root and are served only to readers entitled to them.
No system is perfectly secure. If a personal data breach occurs that is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it and notify you without unnecessary delay, as required under section 12B of the PDPA.
11. Children
Magikal is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has given us personal data, contact us and we will delete it. Readers under 18 should have a parent or guardian's permission before creating an account or making a purchase.
12. Changes and contact
We may update this policy. When we do, we will change the "Last updated" date at the top, and where the changes are significant we will tell you by email or by a notice on the site.
Questions, requests and complaints about this policy or about your personal data:
Magikal Ventures (202503278683) 21-B, Persiaran Pegaga, Taman Bayu Perdana 41200 Klang, Selangor, Malaysia
Email:
General enquiries:
