Last updated 25 October 2026. VisionMagic is digital signage software: businesses use our web console to plan what plays on their screens, and our app plays it on TV boxes. This policy covers the console at v2.visionmagic.co.uk, the box app and this website.
Who we are
VisionMagic is a trading name of QuantumLayer Platform Ltd, a company registered in England and Wales (company no. 16381947), registered office 86–90 Paul Street, London EC2A 4NE. QuantumLayer Platform Ltd is the data controller for the personal data described here and is registered with the Information Commissioner’s Office (registration ZC103647). For content a business puts on its own screens, that business decides what is shown. Questions: hello@visionmagic.co.uk.
What we collect
- Accounts: your name, email address and a scrambled form of your password; who did what in your workspace (the activity log).
- Your content: the pictures, videos, playlists and schedules you add, and the settings of your screens and venues.
- Screens: what each box reports so you can see it works: model, app version, network, storage, errors, screenshots you ask for, and which file played when (proof of play, which you can switch off per screen).
- Instagram: only if you connect an account (see below).
Why we use it
To run the service you signed up for: show your content on your screens, send the alerts and reports you ask for, keep the service secure, and answer you. We don’t sell personal data, and we don’t use it for advertising.
Our legal bases under UK data protection law: providing the service under our contract with your business; our legitimate interests in keeping the service secure, working and supported; and, for Instagram, the business’s choice to connect its account, which it can withdraw at any time by disconnecting it.
Instagram data
When a business connects its Instagram professional account, VisionMagic uses Meta’s Instagram API with Instagram Login and asks only for instagram_business_basic, which lets us read that account’s own profile and posts.
- What we get: the account’s id, username and account type; for its posts, the pictures and videos, captions, dates and links. We also hold a sign-in token from Instagram, encrypted.
- What we do with it: we copy the account’s latest posts into that business’s own private VisionMagic library and play them on that business’s own screens, as the business chooses (for example only posts with its hashtag, optionally with a frame showing its @name and the post’s date). Captions are used only to match a chosen hashtag and are never shown on screen.
- What we never do: post, comment or message on Instagram; read other people’s accounts or posts; show the posts to anyone other than the business’s own screens and team; sell or share the data; use it for advertising or to train AI models.
- How long we keep it: copies are refreshed every 30 minutes. A copy is deleted when the post is deleted on Instagram or no longer chosen to play, and every copy, the token and the account details are deleted when the business disconnects the account, removes VisionMagic in Instagram’s settings, or asks for deletion. See Instagram data deletion.
- Where: in our database and file storage in Microsoft Azure (UK South); boxes download the copies they play.
Who else handles data
- Microsoft Azure (hosting, database, file storage, email; UK South), Cloudflare (our domain names), Meta (only when you connect Instagram), MET Norway and OpenWeather (weather and air quality for a venue’s area; no personal data), OpenStreetMap (address search).
Outside the UK
We keep your data in the UK. Some of it leaves the UK when it must: Instagram data comes from Meta in the United States, and partners who run screens for businesses in India see their own workspaces from there. Where that happens we rely on the safeguards UK law provides, such as UK adequacy regulations or the International Data Transfer Agreement.
How long we keep things
- Your account and content: while your workspace is active, then deleted on request.
- Box error reports: 30 days. Removed screens: 30 days, then deleted with their history. Sign-in sessions: 30 days.
- Instagram: as above.
Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it, by emailing hello@visionmagic.co.uk. We answer within a month. In the UK you can also complain to the Information Commissioner’s Office (ico.org.uk).
Security
Passwords are stored only in scrambled form, connections are encrypted, Instagram tokens are encrypted at rest, and screen files are served only through signed links. If something goes wrong that affects your data, we will tell you.
Changes
If we change this policy we will update this page and its date, and tell workspace owners about important changes.