Privacy notice

Phone verification and account linkage

We collect and verify your mobile number to create and protect your Magic Dragon account. The verified number links your name, account, saved delivery profile, order history, and required compliance records so we can provide the service safely and consistently.

Each order also keeps the recipient and phone details used for that order as an order record. Changing your account phone does not rewrite earlier orders, and a newly verified number does not automatically claim older guest orders.

Text messaging and Blackleaf

Magic Dragon is preparing Blackleaf Marketing Solutions, LLC as a downstream messaging provider for one-time verification codes, order updates, preference synchronization, and—only after a separate opt-in—marketing texts. Live Blackleaf messaging remains disabled until its contract, data-processing terms, sender/campaign approval, and operation and STOP behavior are validated.

When enabled, we will provide only the mobile number, a stable account or contact identifier, and the limited profile, message, public order reference, and order-status information needed for that service. The integration is designed not to send full order history, delivery address, date of birth, cart or product details, payment information, identity documents, driver details, METRC information, or internal notes.

Providing or verifying a phone number, creating an account, completing a profile, requesting a code, or placing an order does not sign you up for marketing texts. Order texts are service updates about that order. Marketing consent is separate and optional.

Consent, opt-out evidence, and retention

We keep timestamped records of the disclosure shown, your choice, the encrypted phone/account reference, and later opt-out or provider-suppression events so we can honor your preference and demonstrate how it was recorded. Reply STOP to stop all Magic Dragon texts or HELP for help. A later marketing opt-in does not resume messages until the messaging service confirms the subscription.

Raw OTP challenge phone and provider request data is scrubbed 24 hours after a challenge expires, is consumed, or becomes uncertain. Terminal challenges and authentication-attempt records are deleted after 7 days. Keyed retired-phone reuse holds expire after 90 days, and PII-free identity-event hashes are retained for 2 years unless a legal hold applies.

Current verified account phone and name remain while the account is active and as needed under the customer and order retention policy. Consent, opt-out, and suppression evidence is retained only as reasonably needed to honor your choice, demonstrate compliance, resolve disputes, and meet legal obligations. Blackleaf-specific deletion and backup timing will be aligned to the signed data-processing agreement before live use.

Your choices

A recently verified phone is required before a new order can be placed. We do not automatically claim older guest orders merely because their recipient phone matches a newly verified account.

Use the Support or Contact page to request access, correction, or deletion; report a recycled-number concern; or recover an account when the prior phone session is unavailable.