Privacy policy
Effective 19 October 2026 · Version 0.7.0 of the extension
This policy covers the MagiClip Firefox extension, published by Surprisingly Ltd (“we”). It explains what the extension does with data, where that data is kept, and what leaves the computer.
The short version
- We don’t receive any data from MagiClip. It has no analytics, telemetry, advertising or crash reporting, and it never contacts a server run by us.
- Case data stays in Firefox on your computer, and is deleted when you finish or discard the case.
- Case data leaves your computer only for your organisation’s AI gateway. Anything sent for AI processing is shown to you first, with personal details replaced by placeholders, and is sent only when you approve it.
- The privacy model is downloaded from Hugging Face unless your organisation or you choose another server. No case data is sent with that download.
Who is responsible
MagiClip is installed by an organisation (“your organisation”) for its staff. Your organisation decides which casework systems MagiClip may read, where its forms library and AI gateway are, and how long the activity log is kept. Your organisation is the data controller for the personal data you handle with MagiClip. Its own privacy notice, and its contracts with any AI provider behind its gateway, apply to that data.
Surprisingly Ltd writes and publishes the software. We do not process personal data handled through MagiClip, because none of it is sent to us.
What MagiClip keeps on your computer
MagiClip uses Firefox’s extension storage on the computer where it runs. It keeps:
- The active case: the forms it started from, and the values you clipped from casework pages. These can include names, dates of birth, addresses, reference numbers such as NI numbers and client IDs, and financial, housing, employment and health details, depending on the case. It also keeps where each value came from.
- Your notes on the case.
- An activity log of the approved casework pages you used and what you did with them. Pages outside your organisation’s approved list are not logged. Your organisation sets how long entries are kept, 90 days by default.
- Settings and profile drafts. Drafts hold page structure and pass/fail test results, never values from pages.
- Cached library and model files downloaded from your organisation’s servers.
When you finish or discard a case, MagiClip deletes the case, its values and its working data. If Firefox closes part-way through, the deletion completes the next time it starts. Removing the extension removes all of its storage.
Reading text from PDFs and pictures (OCR) runs entirely on your computer. So does the privacy model that finds personal details before an AI request.
What leaves your computer, and where it goes
MagiClip connects to the services below. Your organisation sets the forms library and AI gateway addresses, usually through Firefox enterprise policy. It connects to:
| Service | What is sent | When |
|---|---|---|
| Your organisation’s forms library | A request for the library files, with the sign-in token or cookies your organisation requires. No case data. | On start and when the library is refreshed |
| The model server: Hugging Face (huggingface.co and its download network) by default, or another server set by your organisation or by you in MagiClip’s Privacy tab | Requests for the privacy-model files, each checked against a known checksum. No case data. Like any website, the server sees your computer’s IP address and browser version, and Hugging Face’s own privacy policy applies to those requests. | When you load the privacy model, then only after it changes |
| Your organisation’s AI gateway (optional) | Text, and sometimes images, from the case, pages or documents you chose, and the instruction for the task. Detected personal details are replaced by placeholders unless your organisation’s policy allows you to send them as written and you choose to. | Only when you choose a ✦ action and approve its preview |
Before any AI request, MagiClip shows a preview of exactly what will be sent. Nothing is sent until you approve it, and a retry sends only that same approved content. If your organisation does not set up a gateway, no AI requests are possible and MagiClip still works.
MagiClip also uses your browser on your behalf: it reads the casework pages you clip from, and it fills form fields you have reviewed in a fill plan. It does not submit forms for you.
Things that happen only when you ask
- Copy diagnostics copies a report to your clipboard to help IT support. The report contains version numbers, which settings are set, and recent error types. It never contains case values, page addresses, notes or keys. It goes nowhere unless you paste it somewhere.
- Downloads of the activity log (CSV or JSON), or of a settings and drafts backup, are saved to your computer.
- Copying values puts them on your clipboard.
Firefox’s data permissions
When MagiClip is installed, Firefox lists the kinds of data it handles, such as website content and personal information. These match the descriptions above: the data is handled on your computer, and sent only to your organisation’s services as described.
Your rights
Because your organisation is the data controller, send requests about your personal data, or about people in your cases, to your organisation’s data protection officer. They can see what your organisation’s services hold. You can delete everything MagiClip holds on your computer by discarding the case, or by asking IT to remove the extension.
Changes
If MagiClip starts handling data differently, we will update this page and its effective date before releasing that version.
Contact
Surprisingly Ltd · privacy@surprisingly.ltd