Privacy Policy

Information you give us:

• Account data: email address, username and password. The password is stored only as a one-way hash; we cannot read it. If you sign in with Google, we receive your email address and Google account ID, not your Google password.
• Profile data (optional): age and gender, used to personalise conversations.
• Your conversations: the messages you send to characters and the AI replies.
• Content you create: characters (name, description, personality, scenario and other fields), prompts for images and videos, and the generated images, videos and voice messages.
• Support requests and reports: what you write in the support form or in a character report, screenshots you attach, and the page and browser details sent with a support request.
• Payments: package, amount, currency, order and payment-provider reference, and status. Payments are handled by our crypto payment provider; we never receive card numbers or wallet private keys.

Information created automatically:

• Conversation memory: a summary of each conversation and short notes about facts mentioned in it, so that a character can remember earlier parts of the chat. On the Gold plan, messages are also stored as numeric vectors to find relevant earlier messages.
• Usage and account records: credits, plan, message and character counters, language preference and account creation date.
• Security data: your IP address when an account is created, failed sign-in counters linked to an email address, and server logs (IP address, browser type, page requested and time).

Sensitive information. Conversations on Charmzy.ai can be romantic or sexual, so what you write may reveal information about your sex life or sexual orientation. This is "special category data" under the law. We process it only to provide the service to you, with your explicit consent (see "Your consent to sensitive data").

We do not sell your personal data, show you advertising, or use your data to build advertising profiles. We do not use your conversations to train AI models.

Automated moderation. Some safety checks are automatic and may block a character, a prompt or a message. These decisions do not have legal or similarly significant effects on you. If you think one is wrong, contact us and a person will review it.

Staff access. Our authorised administrator can view an account's chats and media only when this is needed to handle a report, a support request, a suspected breach of our Terms or a legal request. Every such access is logged.

Before your first chat we ask for your explicit consent to process conversations that may include information about your sex life or sexual orientation, and we record when you gave it. You can withdraw your consent at any time by deleting the relevant chats or your account, or by writing to [email protected]. Because chats are built on these conversations, we cannot provide chats without this consent. Withdrawing consent does not affect processing that took place before.

We share personal data only with service providers that process it on our behalf under contract, and only what they need:

You can ask us for the names of our current service providers at [email protected].

We may also disclose data when the law requires it (for example to the police or a court), or to protect users and the public, for example when reporting child sexual abuse material to the authorities. If our company is sold or merged, personal data may pass to the new owner, who must continue to protect it under this policy.

Our servers are located in Moldova, and several of our service providers are based in the United States. Both are outside the UK. When we transfer your data outside the UK, we protect it with the safeguards the law requires: UK adequacy regulations where they exist (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or contractual safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about these safeguards.

For users in the EU, EEA and Switzerland, the same applies under the EU GDPR and the Swiss Federal Act on Data Protection: the UK is covered by a European Commission adequacy decision, and transfers to other countries rely on an adequacy decision (including the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses.

• All traffic to the website is encrypted (HTTPS/TLS).
• Passwords are stored only as one-way hashes.
• The database is not reachable from the internet, and each user can only access their own private data.
• Backups are encrypted.
• Only our authorised administrator can access personal data, and that access is logged.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.

You have the right to:

• access your personal data and get a copy of it. You can download most of it yourself from your account settings ("Download my data");
• have inaccurate data corrected;
• have your data deleted. You can delete your account in your account settings;
• restrict or object to processing that is based on our legitimate interests;
• data portability: receive the data you gave us in a machine-readable format;
• withdraw your consent at any time.

To use any of these rights, write to [email protected] from the email address of your account. We reply within one month. We may ask you to confirm your identity first.

If you are unhappy with how we handle your personal data, please tell us first, through the support form (category "Privacy / personal data") or at [email protected]. We acknowledge every complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113. If you live in the EU or EEA, you can also complain to your local data protection authority.

We only use cookies and browser storage that the website needs to work. We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner.

You can delete cookies and local storage in your browser settings at any time. You will then need to sign in and choose your settings again.

We apply this policy to everyone, wherever you live.

• EU, EEA and Switzerland: you have the same rights as described above under the EU GDPR and the Swiss Federal Act on Data Protection.
• United States, including California: we do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information for any purpose other than providing the service.
• Brazil (LGPD, Law 13.709/2018): our legal bases correspond to Articles 7 and 11 of the LGPD (contract, legal obligation, legitimate interests, protection of life, and your specific, highlighted consent for sensitive data). You have the rights in Article 18, including confirmation and access, correction, anonymisation, blocking or deletion, portability, information about who we share data with, and withdrawal of consent. We answer access requests within 15 days. You can reach our data protection officer (encarregado) at [email protected] and complain to the ANPD (www.gov.br/anpd).
• Other countries: you can exercise the rights your local law gives you by writing to [email protected].

If we make important changes, we will update the date at the top of this page and tell you by email or on the website before they take effect.