Privacy Policy

01Who this policy covers

MagiBox provides an encrypted content and learning-delivery platform for training schools, individual teachers, schools, universities, and corporate learning teams operating across Singapore, Malaysia, and Australia. This Privacy Policy explains how we handle personal data when administrators, teachers, and students use the MagiBox web console and the protected teaching application.

It applies to MagiBox as the platform operator. Where a campus or organisation uploads its own learners and configures its own courses, that organisation acts as the data controller and MagiBox acts as its processor.

02What data we collect

• Account and campus records: organisation name, billing contact, campus locations, franchise structure, and administrator profiles.
• Teacher and student records: names, contact details, class assignments, enrolment status, and progress within assigned courses.
• Device information: device fingerprints, operating system, app version, and the approved-device list used to bind playback to authorised hardware.
• Usage data: log-in events, course views, playback sessions, feature usage, and diagnostic logs needed to operate and secure the service.
• Support and communications: messages you send to us and records of demos, onboarding, and support requests.

We do not intentionally collect special-category data and ask customers not to upload it through free-text fields unless strictly necessary for their programme.

03How we use data

• To deliver the service: provision accounts, stream protected course content, and enforce device approval and content protection.
• To secure the platform: detect unauthorised access, prevent content leakage, and investigate abuse.
• To support customers: respond to requests and provide onboarding and troubleshooting.
• To improve the product: understand aggregate usage and reliability, using the least identifiable data that achieves the purpose.
• To meet legal and contractual obligations, including billing and record-keeping.

04How we share data

We do not sell personal data. We share it only with vetted infrastructure and sub-processors (such as cloud hosting and content-delivery providers) under contract, with the customer organisation that owns the records, and where required by law or to protect rights and safety.

05Data retention

We retain personal data for as long as an account is active and for a limited period afterwards to meet legal, billing, and dispute-resolution needs. When a customer offboards, we delete or anonymise the associated records within a defined window, except where retention is legally required.

06Your rights

Subject to local law, individuals may request access to, correction of, or deletion of their personal data, and may object to or restrict certain processing. Because campuses control their own learner records, we will route requests to the relevant organisation where appropriate and assist them in responding.

07International data transfer

MagiBox operates primary infrastructure in Singapore with an Australian mirror. Data may be processed in these regions and by approved sub-processors. Where data crosses borders, we apply contractual and technical safeguards consistent with Singapore PDPA, Malaysia PDPA, and the Australian Privacy Principles. See our PDPA & Data Protection notice for region-specific detail.

08How we protect data

We encrypt data in transit and at rest, restrict access on a need-to-know basis, and protect course video with DRM so it can only be viewed inside the protected teaching application. For a fuller description, see our Security page.

Questions about this page?

Reach our data protection team and we will respond within a reasonable period. For data access, correction, or deletion requests, please include the campus or account involved.