Privacy Policy

1. Who is responsible

CharmGym is operated by S.R.L. PERFECTION STUDIO in the Republic of Moldova. For privacy questions or requests, email help@charmgym.co with the subject “Privacy request.”

2. Data processed in the public preview

• Readiness quiz. Your answers and result are held in the current browser tab. They are not sent to our database by the preview quiz.
• Anonymous practice account. Supabase creates an anonymous account identifier and stores an authentication token in your browser so the practice service can reject unauthenticated traffic.
• Practice input. The message, selected scenario, language, and practice mode are sent to our Supabase Edge Function to generate a reply. The preview does not save the message or transcript.
• Safety metadata. If automated checks detect a safety category, we may retain the category, severity, status, timestamp, and an internal anonymous user reference. The triggering text is not included.
• Technical data. Hosting and security providers may process IP address, user agent, request time, and diagnostic data needed to deliver and protect the service.
• Support messages. If you email us, we receive the address and information you choose to include so we can respond.
• Early-access signup. If you choose to join, we store your normalized email address, language, signup source, consent version, and consent timestamp. Cloudflare also processes technical data to confirm that the request came from a person rather than automated abuse.

3. Why we process data

We process data only to:

• provide the quiz and AI practice experience;
• keep the service secure, prevent abuse, and respond to safety signals;
• diagnose reliability problems without logging conversation content;
• answer support and privacy requests; and
• send product updates and early-access invitations when you explicitly opt in; and
• meet legal obligations.

Depending on the context, the legal basis is performance of the service you request, our legitimate interest in security and reliability, consent where specifically requested, or compliance with law. Optional sensitive quiz questions can always be skipped and are not uploaded by the preview quiz.

4. Providers and international processing

We use a small number of processors to operate the preview:

• Vercel for web hosting and delivery;
• Supabase for anonymous authentication, database infrastructure, and Edge Functions in the Frankfurt region.
• Cloudflare for Turnstile abuse protection on the public signup form;
• MailerLite for the opted-in early-access mailing list; and
• Resend for the transactional signup confirmation.

These providers may process technical data in other countries under their contractual safeguards. We do not sell personal data and do not share it for cross-context behavioural advertising.

5. Retention

• Quiz answers disappear when the browser state is cleared or the tab is refreshed.
• Anonymous accounts older than 30 days are deleted by a scheduled cleanup.
• Practice text is not retained as a transcript in the public preview.
• Safety metadata is kept only as long as needed for review, security, and legal accountability.
• Provider security logs follow the provider retention periods and are access restricted.
• Support correspondence is retained while the request is active and then for a limited audit period.
• Early-access email and consent records are kept while you are subscribed and for a limited period after unsubscribe where needed to honour suppression, consent, and legal-accountability requirements.

6. Your choices and rights

Subject to applicable law, you may ask for access, correction, deletion, restriction, portability, or an objection to processing. You may also withdraw consent without affecting earlier lawful processing. Email help@charmgym.co. We may need to verify your identity before acting on a request.

You can unsubscribe from marketing through the link in an email or by contacting us. You can clear the anonymous browser session at any time by removing site data for charmgym.co. You may also complain to the data-protection authority available to you.

7. Security and age limits

We use encryption in transit, restricted service credentials, row-level database controls, content-minimised logs, and automated cleanup. No system is perfectly secure, so please do not submit information you do not want processed for the practice reply.

CharmGym is intended for adults aged 18 or older. If we learn that a minor has provided personal data, we will take reasonable steps to delete it.

8. Changes to this policy

We will update this page before activating material new processing such as analytics, payments, voice features, or a third-party AI provider. Material changes will show a new date and, where required, a new consent request.