Articles on: General questions (f.a.q.)

GDPR and Maglr

This article explains which personal data Maglr processes for visitors of your publications, for recipients of a personalized email and for users of the Maglr dashboard, and which settings change that.

Personal data of publication visitors

A public publication that has no login, no forms and no personalised links doesn't ask visitors for personal data, and Maglr doesn't build a profile of individual visitors. Some visitor data is still processed: Maglr's servers briefly log each visitor's IP address and browser information (see Hosting and server logs), and Maglr statistics count visits without cookies. Analytics tools you add, such as Google Analytics, and the features described in the sections below can process more personal data.

Hosting and server logs

Maglr hosts publications on Amazon Web Services in Frankfurt (EU) and uses Cloudflare to protect its servers. Like every web server, Maglr's servers log the visitor's IP address and browser information when a page or image is requested. These logs are needed to route traffic and to protect the servers against bots, DDoS attacks and hacking attempts. The logs are stored securely for a short time and rotated every 24 hours.

Google Analytics and Google Tag Manager

Google Analytics on a Maglr domain runs in anonymous mode when the setting Activate Google Analytics in anonymous mode is turned on for that domain. For a new domain, this setting is off. Light mode of the cookie consent notification also runs Google Analytics anonymised until the visitor accepts (see the consent modes below). In anonymous mode, visitors are not tracked by IP address and geo-location: Google Analytics shortens their IP address before using it.

The anonymous mode setting is only available for Google Analytics. With Google Tag Manager, whether data is anonymised depends on how you set up your own GTM container.

To turn on anonymous mode for Google Analytics:

Go to Settings > Domain names.
Click the pencil icon next to the domain you want to change.
In the Statistics & integration section, turn on Google Analytics or GTM if it isn't on yet.
Set Integration type to Google Analytics and fill in your GA4 code, if it isn't there yet.
Turn on Activate Google Analytics in anonymous mode.
Click Save changes.

If you use Google Analytics without anonymous mode, Google Tag Manager or other third-party tools, use a cookie consent notification on the domain. Maglr has a built-in cookie consent notification (Activate cookie consent notification) with three consent modes:

Light mode: Google Analytics runs anonymised until the visitor accepts the cookie consent. After the visitor accepts, the more extensive Google Analytics options are turned on, unless anonymous mode is on for the domain.
Strict mode: Google Analytics doesn't run until the visitor accepts the cookie consent.
Manual mode: you provide your own cookie consent pop-up through Google Tag Manager, which tells Maglr whether the visitor gave consent. Use this mode only if you run your own consent tool.

For how to set it up, see how to configure cookie consent.

Maglr statistics

Maglr statistics are privacy-friendly statistics that measure visits to your publications without cookies. They are on by default for a new domain, you can turn them off per domain with the setting Activate standard Maglr statistics, and they can run alongside Google Analytics or Google Tag Manager. The data is processed by Pirsch and stored anonymously on a server in Germany (EU).

When the domain uses Maglr's cookie consent notification, the consent mode decides when Maglr statistics start:

Light mode: Maglr statistics are measured from the start, before the visitor accepts the cookie consent.
Strict mode and Manual mode: Maglr statistics are not measured until the visitor accepts the cookie consent.

For details about these statistics, see How our native statistics work.

Functional cookies

Maglr publications use functional cookies, for example to remember that a visitor has already seen a notification or made a cookie consent choice. Maglr doesn't use these cookies to store personal data. For more information, see The use of cookies.

When a visitor submits a form, a contact form or the subscribe option in a publication, Maglr sends the submitted details to you by email, to a Zapier or Make integration, or both. Maglr doesn't keep a list of form responses or subscribers. When a response is sent by email (including the backup email Maglr sends if a webhook doesn't respond), that email, with the submitted details, is kept in Maglr's email log for up to one year and then deleted automatically.

Email delivery: Maglr sends its emails, including form notifications, through SendGrid.
Zapier or Make: when you push form data to Zapier or Make, the details go straight to that integration, which can forward them to a tool such as Mailchimp. When the push works, the data is stored by that tool, not by Maglr.
Fallback: if a form, contact form or the subscribe option is set to push data to Zapier or Make and that push fails, Maglr sends the details to you by email instead. That email is kept in Maglr's email log like any other notification email.
Spam protection: the subscribe option is protected by Google reCAPTCHA, and the Captcha field in forms uses Cloudflare Turnstile. The visitor's browser connects to these services when the form loads or is submitted.

When a visitor logs in to a publication with Single Sign-On, Maglr stores the basic profile the identity provider sends, such as name and email address, together with a unique user ID, so the visitor can log in.

When a publication is secured with email login, Maglr stores the list of allowed email addresses that you upload. A visitor enters their email address and receives a 6-digit login code by email. That email shows an approximate location based on the visitor's IP address.

YouTube and Vimeo videos

YouTube videos in Maglr publications load from YouTube's no-cookie domain (youtube-nocookie.com). As long as a YouTube video has not started, YouTube saves no cookies on the visitor's computer. Vimeo videos load from Vimeo's standard player.

When the domain uses Maglr's cookie consent notification, in any consent mode (Light, Strict or Manual), YouTube and Vimeo videos only load after the visitor accepts the cookie consent. If the visitor has rejected the cookie consent and then clicks play, the cookie consent notification appears first, and the video loads only after the visitor accepts.

Personalisation through URL parameters

When you personalise a publication with URL parameters, the values in the URL are sent to Maglr's server and merged into the page when it opens. Depending on what you put in the URL, these values can contain personal details. Maglr doesn't save them in its database.

The full page URL, including these URL parameters, is also sent to Maglr statistics (processed by Pirsch) when they are turned on, and to Google when Google Analytics or Google Tag Manager is active on the domain. Don't put personal details in URL parameters unless your privacy policy and cookie consent cover it.

Recipients of a personalized email

With Personalized email (Send > Personalized email in the dashboard), Maglr stores personal data about the people you send a personalised publication to. To use Personalized email, Maglr and the customer need to set up a data processing agreement.

Maglr stores:

the recipient's first name, last name and email address
any additional details you enter to personalise the publication for that recipient

Each recipient gets a personal link. Maglr statistics (processed by Pirsch) count visits through that link with a unique code per recipient, and Maglr stores the date the recipient first and last opened the publication through the link. Maglr also stores the email events SendGrid reports for each recipient, such as whether the email was delivered, whether the email was opened and whether a link in it was clicked.

After the email is sent, the dashboard shows the recipient's email address only partly (masked). One year after sending, the personal link stops working, and the sent email and its SendGrid email events are deleted automatically. The recipient's name and email address, the personalised details and the open dates are also stored with the personal link, and are deleted automatically one year later, two years after sending.

Personal data of Maglr dashboard users

Maglr stores personal data about users of the Maglr dashboard, because they log in to their account and can get help through live chat. For dashboard users:

We store basic user credentials.
We store basic company details, with licence and payment information.
We use Pipedrive and Crisp for chat and CRM.
We sometimes use Microsoft Clarity on our website to better understand user behaviour.
We use Sentry for error tracking.
We use SendGrid to send emails.

Updated on: 20/10/2026