Privacy Policy
Last updated: August 22, 2026
Effective date: August 22, 2026
Charmingly, 440 N. Wolfe Rd, Sunnyvale, CA 94085, controls the personal data described in this Policy. Contact privacy@charmingly.ai.
1. Scope
This Policy covers the Charmingly website, accounts, purchases, and live avatar calls. Charmingly decides why and how this data is used, including when vendors process it for us.
Charmingly is established in the United States. Section 9 explains what will apply before we offer the service in the EEA or UK.
2. Data We Collect
Account and sign-in
- Email address and the sign-in method you used.
- Name and profile picture if your sign-in provider supplies them.
- The date you confirmed you are 18 or older, consented to call recording and avatar memory, and accepted the current Terms.
Calls and relationships
- Microphone audio, call transcripts, generated avatar reply video, and session recordings when a call is recorded.
- What each avatar remembers from your conversations.
- Which avatar you called, when, call duration, how the call ended, connection records, ratings, and reports.
- Which avatars you have met and when, and how many calls you have had with each.
Plans and payments
- Your plan, billing interval and status, available and used minutes, purchases, and identifiers that connect your account to Stripe.
- Stripe collects card and billing details. Charmingly does not receive or store full card numbers.
Technical data
- IP address, browser and device information, request and security logs, cookies, and local-storage choices.
- An event log of sign-ins, consents, calls, account changes, purchases, feedback, and reports.
3. Conversation Content and Sensitive Data
Conversations may reveal sensitive information, including health, relationships, beliefs, sex life, or sexual orientation. We cannot reliably separate those details from the rest of a conversation.
We process what you choose to share to provide calls and avatar memory, investigate safety and service problems, and comply with law. We do not sell conversation data, use it for advertising, or use it to make legal or similarly significant decisions about you.
Before your first call, you expressly consent to call recording and avatar memory. Where GDPR or a similar law applies, that consent also covers sensitive information you choose to include for those purposes. You may withdraw by no longer calling and by deleting recordings, wiping an avatar’s memory, or closing your account as described below. Processing that happened before withdrawal remains lawful.
Do not share passwords, payment details, government identifiers, or another person’s private information with an avatar.
4. How We Use Data
We use personal data to:
- Provide calls, accounts, avatar memory, minutes, plans, and purchases.
- Authenticate users and secure the service.
- Provide support, investigate faults and billing questions, and send service messages.
- Prevent fraud and abuse, enforce our rules, and review safety reports.
- Meet legal, tax, accounting, and reporting duties.
- Measure use of the surrounding website, subject to the cookie choices in Section 11.
Where GDPR or UK GDPR applies, our legal bases are performance of a contract for the account, service, plan, and support; consent for recording, memory, optional model improvement, and analytics where required; legitimate interests in security, abuse prevention, service reliability, and support; and legal obligations for tax, accounting, and required reports.
Optional model improvement
We do not use conversations to improve models unless you turn this on under Privacy in your account. It is off by default and does not affect the service you receive.
If enabled, we may use call transcripts and recordings to evaluate and improve Charmingly’s own avatar and safety models. We do not allow a third party to train its own model on them, and we do not sell or share them for advertising. You can turn the setting off at any time. Withdrawal stops future use; it cannot remove information already incorporated into a completed evaluation set or trained model.
5. Recording and Avatar Memory
Recording. Calls may be recorded, so assume a call could be. A recording may contain microphone audio, the transcript, generated reply video, and session metadata. Recordings and transcripts are kept for 30 days after the call unless a safety or legal obligation requires longer retention. To delete them earlier, email privacy@charmingly.ai. If you do not consent to recording, do not start a call.
Memory. Each avatar has a separate memory of what you share. It is kept until you wipe that avatar’s memory or close your account. From an avatar’s page, Wipe what [name] remembers erases the memory and Charmingly’s record that you met. The wipe does not affect another avatar, your plan, or your minutes. It cannot be undone or edited in part.
Deleting your account erases all avatar memories. If an external memory deletion is temporarily unavailable, account closure still proceeds and we retain only the identifier needed to finish that deletion. We tell you if this happens.
6. Who Receives Data
We do not sell personal data or share it for targeted advertising. We use these providers:
| Recipient | Purpose and data |
|---|---|
| Cloudflare | Hosting, network, database, security logs, and email delivery. It processes account, relationship, billing, request, and email data. |
| Casola | Runs the live avatar call and stores avatar memory. It processes call audio, generated video, transcripts, session recordings, and memory identifiers, but not your email address or billing data. |
| Compute infrastructure providers | Run avatar, speech, and voice workloads and process call data in flight. |
| Stripe | Handles checkout, subscriptions, invoices, tax, and the billing portal. Stripe receives the account identifier and information you provide at checkout. |
| Provides Sign in with Google if selected and Google Analytics if enabled. We do not send Analytics your name, email, Charmingly account identifier, or conversation content. |
We may also disclose data to authorities when law requires it or when permitted to address an immediate safety risk, and to a successor in a merger, financing, reorganisation, or sale subject to this Policy.
Reports involving suspected child sexual abuse material may have to be reported and preserved under applicable law, including reports to the NCMEC CyberTipline. A legal preservation duty overrides a deletion request only for the affected records.
7. Retention
| Data | Usual retention |
|---|---|
| Call recordings, transcripts, and session-tagged logs | 30 days after the call |
| An avatar’s memory | Until you wipe it or close your account |
| Account, sign-in, consent, relationship, model-choice, and event records | Until account deletion |
| Sign-in codes and OAuth state | Up to ten minutes or until the sign-in completes |
| Google Analytics identifiers | Up to 14 months |
| Operational and security logs | Up to 90 days |
| Charmingly billing and minute records | Until account deletion |
| Safety, fraud, tax, payment, or legally preserved records | As long as the relevant duty or dispute requires |
Stripe keeps its own payment records under its policies and legal obligations. Deletion jobs may run on a schedule rather than at the exact minute a period ends.
8. Your Choices and Rights
From Charmingly you can:
- Turn optional model improvement on or off under Privacy in your account.
- Wipe one avatar’s memory from that avatar’s page.
- Delete your account and all avatar memories from the account screen. This also cancels an active paid plan immediately.
- Change analytics choices through Cookie settings in the footer.
Email privacy@charmingly.ai to request access, correction, deletion, portability, restriction, an objection, or withdrawal of consent. We may verify that you control the account. We respond within the period required by applicable law and explain any denial and available appeal. There is no charge unless a request is manifestly unfounded or excessive and law permits one.
Some memory content cannot be corrected in part; wiping that avatar’s memory is the available way to remove it. Where GDPR or UK GDPR applies, you may also complain to your local supervisory authority.
9. International Processing and GDPR Contact
Charmingly and its main infrastructure are in the United States, and Cloudflare also processes requests at edge locations worldwide.
Before Charmingly is offered to people in the EEA or UK, we will put the required international transfer safeguards and processor agreements in place and publish the identity and contact details of the applicable EEA or UK representative or other GDPR contact in this section. Until then, privacy@charmingly.ai is the contact for privacy questions and requests.
10. Adults Only and Security
Charmingly is for people 18 and over. We ask users to confirm their age, but we do not currently verify identity documents or dates of birth. If we learn that an account belongs to someone under 18, we close it and delete the associated data. Report a concern to safety@charmingly.ai.
We use administrative, technical, and organisational safeguards appropriate to the service, including encryption in transit, protected authentication cookies, access controls, and logging. No system is perfectly secure. Report a vulnerability to security@charmingly.ai.
11. Cookies and Similar Technologies
Necessary storage. The csla_av cookie keeps you signed in for up to seven days. The
csla_oauth cookie carries one-time Google sign-in state and is deleted when sign-in completes.
Session storage remembers which avatar you intended to call during a sign-in or disclosure step and
clears when the tab closes.
Analytics. If Google Analytics is enabled, it uses _ga cookies and similar identifiers for
page views and navigation on the surrounding site. It does not receive conversation content, the
avatar you called, call duration, or your Charmingly account identifier.
Analytics are opt-in in the EEA, UK, and Switzerland. Elsewhere they may start on, subject to local
law. Use Cookie settings in any footer to accept or reject analytics. Your choice is stored in
local storage as charmingly-cookie-consent.
We do not use advertising cookies or track people across unrelated sites for targeted advertising. We do not currently respond to browser Do Not Track signals; use Cookie settings to control Google Analytics. Google may receive analytics data under its own policies. Cloudflare Web Analytics may also measure page traffic without cookies or cross-site tracking when enabled for the site.
12. California and Other Regional Disclosures
For California residents, the categories collected are identifiers, commercial information, internet or device activity, audio and visual information, conversation content, and inferences used to provide memory or improve the service when enabled. Sources are you, your device, your sign-in provider, and payment providers. Purposes and recipients are described in Sections 4 and 6.
We do not sell personal information or share it for cross-context behavioural advertising. Where a state privacy law applies, you may exercise its access, correction, deletion, portability, consent, or appeal rights through Section 8. We do not discriminate against anyone for exercising a privacy right.
13. Changes and Contact
We may update this Policy. We give notice before a material change takes effect and request a fresh acknowledgement or consent where required. The date at the top identifies the current version.
Privacy: privacy@charmingly.ai. Security: security@charmingly.ai. Postal: Charmingly, 440 N. Wolfe Rd, Sunnyvale, CA 94085. The EEA and UK contact described in Section 9 will be added before launch in those markets.