Privacy Policy

Charchy has two kinds of users, and our role is different for each.

• If you have a Charchy account — you use the dashboard or the iPhone app — Charchy decides how your account data is used. We are its "controller", and this whole policy applies to you.
• If you talked to a business that uses Charchy — in its website chat, on Instagram, Facebook, Telegram or Discord, by email or by call — that business decides how your data is used. It is the "controller", and Charchy only processes your data for that business and on its instructions, as its "processor". The business's own privacy policy applies to you. To see, change or delete your data, ask the business first. You can also write to us and we will help (see Data Deletion Instructions).

What we collect depends on how you use Charchy:

• Your account — your name, email address and profile picture. If you sign in with Google or Apple, we receive your account ID with that service, your name and your email address. With Apple you can hide your email address; we then receive a private relay address that forwards to you.
• Signing in — for each session we keep your IP address, your browser or device type and when it was last used, and for the dashboard roughly where you signed in (city and country), so you can see where you are signed in and sign other devices out.
• Your workspace — the business's name, logo, contact details and time zone, its team members and their roles, and the settings it chooses.
• Payments — our payment provider handles every payment. We never see or store card or bank details. We keep a record of each payment: the amount, the date, what was bought and the provider's reference.
• Website chat visitors — what a visitor writes and the files they send, and details the chat sends with the conversation: the page they are on and the page that brought them there, their browser's language and time zone, their browser and device type, and any campaign tags in the link (such as utm_source). If the business's website tells the chat who the visitor is, we also receive the name, email address and ID it passes. Visitors may give their name, email address or phone number when the business asks for them.
• Other channels — when a business connects a channel, we receive the messages, comments and files people send it there and the replies sent back, with the sender's name, username, profile picture and ID on that service. On Telegram this can include a phone number, if the person chooses to share it. For email, we receive the emails sent to the business's Charchy address, with the sender's name and address and any attachments.
• Calls — when a visitor calls a business from the website chat, we keep when the call happened, how long it lasted and who answered. If the business has switched call recording on, the call's audio is recorded.
• What teams write — replies, internal notes, saved replies, tags, contact details, Library Content and Documents, and email campaigns with their contacts' email addresses and records of their marketing consent.
• Email campaigns — for each email sent: whether it was delivered, opened or clicked, and any bounce, spam complaint or unsubscribe.
• How Charchy is used — on this website and in the dashboard we use analytics to see which pages are used and to find errors. Our servers also record a few account events, such as that a workspace was created or an invitation accepted, with IDs rather than message content. The iPhone app has no analytics.

• To provide Charchy: show conversations, send replies, run Zhirmand, deliver emails and connect calls
• To keep your account and Charchy secure, and to detect and prevent fraud and abuse
• To process payments and send messages about your account, such as sign-in codes and receipts
• To provide support
• To understand how Charchy is used and improve it, including Zhirmand as described in Improving Zhirmand below
• To meet our legal duties

Zhirmand is Charchy's AI assistant. A business can let Zhirmand answer its customers in the website chat and its connected channels, write drafts of emails and Library Content for its team, and answer the team's own questions about their workspace.

To do this, Charchy sends only the text needed for that one task to a third-party AI service — for example the customer's message and the recent conversation, the parts of the business's Library that match the question, and the business's Zhirmand settings. When a business adds Documents or Websites to its Library, the AI service also reads them to make them searchable. The AI service sends back an answer and uses the text only to produce it for Charchy.

AI services are not allowed to use this text to train or improve their models: Charchy only uses AI services that do not train on the text we send them.

AI can make mistakes. Charchy marks what the AI wrote so the team can check it before sending or saving it. The business decides where Zhirmand answers on its own and when a conversation goes to a person, and where the law requires it, the business must tell its customers that they may be talking with AI. Zhirmand is not used to make decisions that have legal or similarly important effects on people.

In the iPhone app, Charchy asks you before the first time it sends conversation text to the AI service. You can take your answer back at any time by turning off Allow AI features in Settings → You → AI and your data; the app then asks again before the next AI action.

Charchy may use conversations from a business's workspace to make Zhirmand better — for example to check whether a change gives better answers. Before we use a conversation this way, we remove names, email addresses, phone numbers and other details that identify people.

Each business decides. This is on unless an owner or admin turns off Help improve Zhirmand in Settings → Organization → General. When it is off, we do not use that workspace's conversations for this.

Conversations from Facebook, Instagram and TikTok are never used to improve Zhirmand, whatever the setting.

Zhirmand answers from the workspace's own Library — the Content its team writes, the Documents it uploads and the Websites it adds.

With Teach Zhirmand, the team can turn a teammate's answer into Library Content, written as a general question and answer rather than a copy of the conversation. If a business switches on Suggest content from conversations, Charchy suggests such entries after a conversation is resolved and marks anything that looks like an email address or phone number. Nothing is added until someone on the team approves it.

One workspace's Library is never used to answer another workspace's customers. When Library Content or the workspace is deleted, it is gone.

When a business connects its Facebook Page or Instagram professional account to Charchy, it grants us permission, through Meta's login, to receive data from that account. We receive:

• The Page or Instagram account's ID, name and profile picture, and the access token that lets us act for it
• Messages sent to the Page or Instagram account, with any files in them, and the replies sent from it
• Comments on the account's posts, and the replies to them
• The sender's Facebook or Instagram user ID, name and profile picture, as Meta provides them with each message or comment

We use this data only to provide Charchy to the business that connected the account, and only as that business directs: showing conversations in its inbox, sending the replies and likes it has set up or approved, letting Zhirmand answer from its own Library, and handing conversations to its team.

Message and comment text is sent to a third-party AI service to write those answers, as described in How Charchy uses AI. Each business's data is kept separate and is never used for another business's workspace.

We never use Facebook or Instagram data to train or improve AI models, to build profiles of people, for surveillance, or to decide whether someone is eligible for anything, such as credit, housing, a job or insurance. We do not sell it, we do not use it for advertising, and we share it only with the service providers we need to run Charchy.

When a business disconnects its Facebook Page or Instagram account in Charchy, we delete the access token and stop receiving data from it. Conversations already in the inbox stay in the workspace until the business deletes them or the workspace. Removing Charchy in Facebook's settings also stops new data; to delete what we already received, follow the Data Deletion Instructions.

TikTok is coming to Charchy. This section applies once it is available and a business connects its TikTok account. The business then authorizes us, through TikTok's own login, to receive data from that account:

• The account's ID, username, display name and profile picture, and the access token that lets us act for it
• The account's own videos — their ID, caption, thumbnail and link — so we can show which video a comment is on
• Comments on those videos and the replies to them, with each commenter's username and profile picture as TikTok provides them
• If the business turns on TikTok direct messages, the messages its customers send it and the replies sent from it

We use TikTok data only to provide Charchy to the business that connected the account: showing comments and messages in its inbox, sending the replies it approved or set to send automatically, liking, hiding or deleting comments on its own videos, and suggesting AI replies from its own Library. Comment and message text is sent to a third-party AI service for that purpose only.

We do not post videos, download or redistribute them, or access any TikTok account that has not authorized Charchy. We never use TikTok data to train or improve AI models. We do not sell it, use it for advertising or profiling, or share it with anyone except the service providers we need to run Charchy.

When a business disconnects its TikTok account from Charchy, or removes Charchy's access in TikTok, we delete that account's TikTok data — its access token, videos, comments and messages — within 30 days.

The app shows the same workspace data as the dashboard. What is particular to the app:

• It uses your account details and the sign-in method you chose: an email code, Google or Apple
• It keeps notification tokens, including the one that makes calls ring on your phone, and an ID for this installation of the app, so notifications reach the right phone and stop when you sign out
• It shows the sessions where you are signed in, so you can see them and sign them out
• It sends the photos, files and voice notes you choose to send, and the audio of calls you take
• The app asks for your permission before it first uses the microphone (for calls and voice notes), the camera or your photos. You can change this at any time in your iPhone's Settings
• The app has no advertising, does not track you across other apps or websites, and has no analytics or crash-reporting tools. During a call, our calling provider receives call quality data, such as connection and audio quality, so the call works

We use personal data only when we have a reason to:

• To provide the service you or your business signed up for
• For our legitimate interests — keeping Charchy secure, preventing abuse, understanding how Charchy is used and improving it — where these do not outweigh your rights
• With your consent, where we ask for it, such as the iPhone app's AI notice. You can withdraw it at any time
• To meet legal duties, such as keeping payment records

We do not sell personal data, and we do not use it for advertising.

We share data with service providers that help us run Charchy. They may use it only to provide their service to us, under contracts that require them to protect it with the same or equal protection as this policy:

• Hosting, database and cloud infrastructure
• File storage, content delivery and security protection
• Third-party AI services, for Zhirmand's answers, drafts and Library search
• Email delivery
• Our calling provider, for calls and call recordings
• Our payment provider
• Notification delivery to browsers and phones
• Website reading, for Websites added to a Library
• Product analytics and error tracking, for this website and the dashboard
• Google and Apple, when you choose to sign in with them
• Meta, Telegram and Discord — and TikTok once it is available — when a business connects them, to receive and send its messages

We may also share data when the law requires it or to protect people's safety and our rights; with professional advisers, such as lawyers and accountants, who must keep it confidential; and with a buyer or successor if Charchy is sold or merged, who must keep to this policy.

A list of our service providers is available to business customers on request.

Charchy's data — including data received from Facebook, Instagram and other channels — is stored and processed mainly in the United States. Some of our service providers may process it in other countries. Wherever it is processed, it is encrypted in transit and at rest and protected as this policy describes.

We keep data only as long as we need it:

• A workspace's data, including data from its connected channels: until the workspace is deleted. Deletion starts immediately and cannot be undone
• Your account: until you delete it
• One contact: until the business deletes the conversation or erases the contact, which it can do at any time. If the contact unsubscribed or their address bounced, the address stays on that business's do-not-email list, so they are not emailed again
• Call recordings: 90 days, then they are deleted automatically
• Ask Zhirmand chats on the dashboard's Home: deleted after 90 days without a new message
• Sign-in sessions: until you sign out, or two weeks after they were last used
• Facebook and Instagram: when a business disconnects an account, its access token is deleted. Conversations stay until the business deletes them or the workspace
• TikTok, once available: deleted within 30 days of the account being disconnected
• A record that an account or workspace was deleted: kept, with internal IDs and dates only — no names, addresses or content
• Payment records: as long as tax and accounting law requires

You can delete your Charchy account at any time: in the iPhone app under Settings → You → Delete account, or in the dashboard under Settings → Personal → Profile → Delete account. You confirm by typing DELETE. Deletion starts immediately and cannot be undone.

It deletes your name, picture, sign-in methods, sessions, notification settings and registered devices, and every workspace where you are the only member, with everything in it. If you signed in with Apple, we also ask Apple to remove Charchy's access to your Apple account.

What you wrote in a workspace you leave — replies and internal notes — stays there with your name, because it is part of that business's conversations; your former teammates see that you are no longer on the team. Open conversations assigned to you go back to the team.

If you are the only owner of a workspace that has other members, make someone else an owner first, or delete the workspace.

To delete other data, follow the steps at https://charchy.krd/legal/data-deletion, or email privacy@charchy.krd.

You can see and change most of your account and workspace data yourself in Charchy.

For anything else, email privacy@charchy.krd. We reply within 7 days and complete your request within 30 days. We may first ask you to confirm that the data is yours. If your data is held for a business that uses Charchy, we may pass your request to that business, because it decides about that data.

Wherever you live, you can ask us to:

• Show you the personal data we hold about you, and give you a copy
• Correct it
• Delete it
• Give it to you in a format you can take elsewhere
• Stop or limit using it, or object to how we use it
• Withdraw a consent you gave

Charchy is not for children. You must be at least 16 to create a Charchy account. Businesses must not aim their use of Charchy at children under 16. If you believe a child has given us personal data, email privacy@charchy.krd and we will delete it.

• Your business is responsible for having a legal reason to collect its customers' data through Charchy, and for telling them about it, for example in its own privacy policy
• Do not use Charchy to collect sensitive data — such as health information, religious beliefs or bank details — unless you have a legal reason and your customers know
• Where the law requires it, tell your customers that they may be talking with AI, and that calls are recorded. The website chat tells callers before a recorded call starts

We are committed to maintaining the highest email sending standards:

• Consent required — campaigns go only to contacts who have given marketing consent. Charchy records when and how each consent was given, and a contact who unsubscribes is never sent a campaign again
• One-click unsubscribe — every email includes an unsubscribe option compliant with RFC 8058
• Bounce management — we automatically remove hard bounces and monitor complaint rates

We use appropriate technical and organizational measures to protect data, including encryption, secure sign-in, access limited to the people who need it, and regular security reviews.

If a security incident affects personal data, we will tell the affected businesses and account holders without undue delay, and anyone else the law requires.

To report a security problem, email privacy@charchy.krd.

We update this policy when Charchy changes. If a change is important, we tell account holders by email or in Charchy before it takes effect. The date at the top shows when it last changed.

Privacy questions and requests, including data deletion: privacy@charchy.krd. Other help: support@charchy.krd. Website: https://charchy.krd.