Privacy policy

Privacy policy

Last updated: 18 October 2026

This policy describes how Magic Bahn processes personal data when you visit our Shopify shop, place orders and contact us.

1. Data controller and contact

The data controller is Swaravo LLC, trading as Magic Bahn, 30 N Gould St Ste N, Sheridan, WY 82801, USA. For privacy questions and to exercise your rights, contact us at support@magicbahn.com or through our contact page.

2. Data we process

Depending on how you use our services, we process the following data:

  • Contact, account and order data: name, email address, billing and delivery address, telephone number where applicable, account settings, products purchased, and payment, shipping, return and refund status.

  • Communication data: messages, enquiries and the information they contain.

  • Technical and usage data: IP address, browser, device, identifiers, pages visited, product views, cart and purchase events, and cookie and consent information.

  • Marketing data: subscriptions, consents, unsubscribes and interactions with messages.

Data comes from you, from automated interactions with the shop, and from Shopify, payment providers and other integrated service providers. Payment details are processed by the payment provider selected at checkout.

3. Purposes and legal bases

Where the General Data Protection Regulation (GDPR) applies, we distinguish the following purposes and legal bases:

  • Steps prior to entering into a contract and performance of a contract under Article 6(1)(b) GDPR: orders, payments, delivery, returns, customer accounts and related communication.

  • Legal obligations under Article 6(1)(c) GDPR: in particular retention, record-keeping and disclosure obligations.

  • Legitimate interests under Article 6(1)(f) GDPR: secure shop operation, fraud prevention, handling general enquiries, and establishing, exercising or defending claims, provided your interests do not override these interests.

  • Consent under Article 6(1)(a) GDPR: marketing requiring consent and corresponding analytics and advertising processing. The applicable legal rules also apply to storing or accessing information on your device.

4. Shopify and other recipients

Shopify hosts the shop and processes data for shop functions, checkout and service improvements. We also share necessary information with payment, shipping, IT, support and other service providers. Payment providers may act as independent controllers for their own statutory tasks. Other disclosures may be necessary to fulfil legal obligations, protect rights or as part of a business transfer.

We also use enhanced Shopify features that incorporate information from interactions with our shop, other merchants and Shopify. Shopify is independently responsible for certain related processing, including personalised advertising and associated rights requests. Details are available in the Shopify Consumer Privacy Policy. You can manage relevant rights and settings through the Shopify Privacy Portal.

5. Cookies, analytics and advertising

Technically necessary cookies support functions such as the cart, checkout and security. Other cookies, pixels and similar technologies are used for analytics, recognition and advertising. Where consent is required, it forms the legal basis. The following services are integrated into our shop:

  • Klaviyo: Email Marketing & SMS by Klaviyo: managing marketing contacts, messages and their performance, and interest-based communications. Contact and order data, product views, cookie identifiers and message interactions may be processed. Use of individual communication channels requires the relevant subscription. More information: Klaviyo Privacy Policy.

  • Google & YouTube by Google: reach and performance measurement, product advertising and attribution of shop events to advertisements. This may involve device and cookie identifiers, page and product views, cart, checkout and purchase events, and order values. More information: Google Privacy Policy.

  • Facebook & Instagram by Meta: measuring and optimising advertisements and interest-based advertising. Device and cookie identifiers, shop events and contact details may be processed to attribute interactions. More information: Meta Privacy Policy.

  • Microsoft Clarity by Microsoft: analysing shop usage based on clicks, scrolling, device and session information, and page content. Heatmaps and reconstructed session recordings help identify usability problems. Microsoft may also use data to improve its services and for advertising in accordance with its privacy statement. More information: Microsoft Privacy Statement.

6. Marketing and your privacy choices

You can unsubscribe from marketing emails using the unsubscribe link or by emailing us. Necessary order messages are unaffected. You may withdraw consent with effect for the future through the privacy settings provided or by contacting us.

Depending on where you live, you may also have the right to opt out of the sale or sharing of personal data or targeted advertising. Use our data-sharing opt-out page. Where applicable, we treat an enabled Global Privacy Control (GPC) signal as a corresponding opt-out for the device and browser used; if linked to a Shopify account, it may also apply to that account. Other “Do Not Track” signals are not recognised as such a choice. These rights supplement European consent and objection rights.

7. International transfers

We are based in the USA. Shopify and other recipients may also process data outside your country of residence. For transfers from the European Economic Area (EEA) or the United Kingdom, where required and no adequacy decision applies, we rely on recognised transfer mechanisms such as EU Standard Contractual Clauses or equivalent UK contractual instruments. You may request information from us about the relevant safeguards.

8. Retention and security

Retention periods depend on the purpose and legal obligations. We retain order and payment records for the prescribed periods. We store enquiries and account data for as long as needed to handle enquiries or maintain accounts. Consent and objection records may remain necessary to meet evidentiary obligations. We then delete or anonymise data unless other legal grounds prevent this. Technical and organisational safeguards are intended to protect data; complete security cannot be guaranteed.

9. Your rights and complaints

Under applicable law, particularly in the EEA and United Kingdom, you may request access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time; this does not affect the lawfulness of prior processing.

Under Article 21 GDPR, you may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time without giving reasons; we will then no longer process your data for these purposes.

Send requests to support@magicbahn.com. We may require reasonable information to verify your identity or authorisation and will respond within statutory deadlines. Legal retention obligations may prevent immediate deletion. You may also complain to your competent data protection authority. The European Data Protection Board provides an overview for the EEA.

10. Children's data and changes

Our shop is intended for adult buyers. We do not knowingly collect personal data from children. Parents or guardians may contact us to request deletion. We are not aware of any sale or sharing of personal data of children under 16 within the meaning of applicable privacy laws.

If our processing or legal requirements change, we will update this policy and any notices required. The current version is available on this page.