Privacy Policy

Effective 5 September 2026

This policy explains what Charmvow (“we”) collects, why, and who we share it with. The data controller is YOUR_LEGAL_ENTITY, established in YOUR_EMIRATE, United Arab Emirates, at YOUR_ADDRESS. Contact us at YOUR_CONTACT_EMAIL.

We operate from the UAE and serve users worldwide, primarily in the United States and the European Union. Sections below headed United States and European Union set out rights that apply depending on where you live.

What we collect

·Account data — email address, display name, hashed password, and (optionally) date of birth.
·Chat content — the messages you send to characters and the replies generated for you.
·Billing data — subscription tier and status, and Stripe customer and subscription identifiers.
·Product usage — message counts, ember balance and transaction history, gifts sent, and referral activity.

We do not receive or store your card number. Card details are entered on Stripe’s systems and never reach our servers.

How your chat messages are processed

Character replies are generated by an external AI provider. To produce a reply we send that provider the character’s persona definition and the recent portion of your conversation. This is the core of the service — it cannot be switched off while still using chat.

Our AI processor is DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), which operates the model that generates character replies. Conversation content sent for generation is processed on DeepSeek’s infrastructure, which is located in the People’s Republic of China.

This means your chat messages leave your country. If you are in the United States, your messages are transmitted to and processed in China. If you are in the EU or EEA, this is a transfer to a third country that has no European Commission adequacy decision; we rely on YOUR_TRANSFER_MECHANISM (e.g. Standard Contractual Clauses) as the safeguard for that transfer, and you may request a copy of the relevant terms. Chinese law may permit government access to data held on infrastructure in China on terms that differ from those in your own country. Please do not send anything through chat that you would not want processed outside your jurisdiction.

Review DeepSeek’s own privacy terms at deepseek.com for how they handle data submitted through their API, including whether submitted content may be retained or used for model training. Where their terms and this policy differ on their own processing, theirs governs what they do.

Site analytics

We measure how the site is used so we can improve it. This is done entirely by us, on our own servers. We do not use Google Analytics or any other third-party analytics service, no third-party analytics script runs on this site, and no analytics data is shared with anyone.

We do not use analytics cookies, and we do not ask you to accept any, because we store nothing on your device for this purpose.

For each page you view we record:

·The page address, and the time you viewed it.
·The site that linked you to us — the domain only, never the full web address.
·Your country.
·Whether you are using a phone, tablet or computer.
·Your browser's language setting.
·How long the page was open.
·Whether you were signed in, and if so, which account.

We never store your IP address. It is used momentarily to determine your country and to generate a temporary identifier, and is then discarded. It is never written to our database and never written to our logs.

That temporary identifier lets us count one visit as a single visit rather than a series of unrelated page views. It changes every day. We therefore cannot tell that a visitor today is the same person who visited yesterday, and we cannot build a profile of you over time or follow you across other websites.

Individual analytics records are deleted after 90 days. After that we keep only anonymous daily totals, which cannot be traced back to any visitor or account.

Analytics records that note a signed-in account store the account identifier as a plain value, not as a database link to your account. Deleting your account is therefore never blocked or delayed by analytics data, and never deletes traffic history that other reporting depends on. Records written before you deleted your account keep that identifier until they expire under the 90-day rule above, at which point they are removed with everything else from that day.

Legal basis (EU/EEA and UK): our legitimate interest in understanding how our service is used, under Article 6(1)(f) GDPR. Because we store nothing on your device and use no persistent identifier, this does not require consent under the ePrivacy Directive. You can object to processing based on legitimate interest — see Exercising your rights below.

Who else we share data with

·Stripe — payment processing, subscription billing, and the customer billing portal. Stripe receives your email and billing details directly. Processing occurs in the United States and elsewhere.
·Neon — managed PostgreSQL hosting, in the United States. Your account data, chat messages, and ledgers are stored here.
·DeepSeek — AI generation in China, as described above.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not share chat content with advertisers.

How long we keep it

·Chat history — on the free tier, retained for 7 days; on paid tiers, for the duration of your membership. See the pricing page for the tier you are on.
·Ember and referral ledgers — retained while your account is open and for as long as needed to resolve payment disputes, because they are the audit trail for a chargeback.
·Account data — until you delete your account, then removed within 30 days except where we must keep transaction records for tax and accounting purposes.
·Analytics records — 90 days, after which only anonymous daily totals remain. See Site analytics above.

United States

Depending on your state — including California, Colorado, Connecticut, Texas, Utah and Virginia, among others with comprehensive privacy laws — you may have the right to know what personal information we collect, to access or delete it, to obtain a portable copy, to correct inaccuracies, and not to be discriminated against for exercising those rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of in those categories. We do not use your data for profiling that produces legal or similarly significant effects. To exercise any right, email YOUR_CONTACT_EMAIL. We will verify your request against your account email before acting on it, and you may use an authorised agent where your state allows.

Chat content can reveal sensitive details depending on what you choose to write. We use it only to operate the service — generating replies and maintaining your history — and never to infer characteristics about you for advertising.

European Union

If you are in the EU or EEA, the GDPR applies to our processing of your data. Our legal bases are:

·Performance of a contract — running your account, delivering chats, and processing subscriptions you bought.
·Legitimate interests — preventing fraud and abuse, including the referral qualification checks that stop bulk fake signups.
·Legal obligation — retaining transaction records for tax and accounting.

You have the right to access, rectify, erase, port, or restrict processing of your data, and to object to processing based on legitimate interests. You may lodge a complaint with your national supervisory authority.

Because we are established outside the EU, our representative in the Union under Article 27 GDPR is YOUR_EU_REPRESENTATIVE, YOUR_EU_REP_ADDRESS. You may contact them or us directly on any matter relating to your data.

Transfers of your data to the United States and to China are described under “How your chat messages are processed” above.

Exercising your rights

Email YOUR_CONTACT_EMAIL from the address on your account. Deleting your account removes your chat history from our systems; it does not retroactively remove content already processed by DeepSeek under their own retention terms, which is a limit we cannot engineer around and should factor into what you send.

Children

Charmvow is not intended for anyone under 13, and you must be 18 or older to purchase a subscription or embers. We do not knowingly collect data from children below the minimum age and remove such accounts when we learn of them.

Cookies

We use a session cookie to keep you logged in, and a short-lived referral cookie if you arrive through an invite link. Both are strictly necessary for the features they support; we do not use advertising or cross-site tracking cookies. Our site analytics use no cookie at all — see Site analytics above.

Changes

We will update this page when our processing changes and revise the effective date above. Material changes will be notified by email.