Privacy Policy

1. Introduction

Chalzy ("we", "us", or "our") operates the Chalzy platform at chalzy.com and app.chalzy.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service, whether as a challenge creator or a challenge participant.

2. Information We Collect

Account & Creator Data

When you create an account and use the platform, we collect:

• Email address and name
• Phone number (if provided)
• Business profile and brand information
• Website URL and branding assets
• Challenge content you create

Participant Data

When participants join challenges, we may collect on behalf of the challenge creator:

• Name and email address
• Phone number (if requested by the challenge creator)
• Challenge responses and submissions
• Uploaded files and media

Payment Data

Payment information is collected and processed securely by Stripe. We do not store raw credit card numbers on our servers. Stripe may share limited transaction data with us for billing records.

Usage Data & Cookies

We automatically collect usage data such as pages visited, features used, device information, and IP address. We also use cookies and similar technologies as described in Section 4.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process subscription payments and manage billing
• Send transactional emails (account notifications, challenge updates) via Resend
• Analyze your website during onboarding to personalize your experience using AI
• Generate AI-powered challenge content based on your inputs
• Analyze usage patterns and improve the platform (via Google Analytics 4)
• Comply with legal obligations

4. Cookies & Tracking

We use the following types of cookies and tracking technologies:

Essential Cookies

Required for core functionality, including authentication (Clerk) and payment processing (Stripe). These cannot be disabled.

Analytics Cookies

Google Analytics 4 (GA4) helps us understand how users interact with the platform. You can opt out using the Google Analytics opt-out browser add-on.

Marketing Cookies

Facebook Pixel may be used for marketing analytics and ad targeting. You can manage your Facebook ad preferences through your Facebook account settings.

5. Third-Party Service Providers

We share data with the following third-party service providers as necessary to operate the Service:

• Clerk — authentication and user management
• Stripe — payment processing and subscription management
• Supabase — database hosting and file storage (hosted on AWS)
• OpenRouter / Claude — AI content generation
• fal.ai — AI image generation
• Pexels — stock photography
• YouTube — video embedding
• Resend — transactional email delivery
• Trigger.dev — background job processing
• Google Analytics 4 — usage analytics
• Facebook Pixel — marketing analytics
• Playwright — automated website analysis during onboarding

6. Data Storage & Security

Your data is stored on Supabase, which is hosted on Amazon Web Services (AWS) infrastructure. We implement the following security measures:

• Row-Level Security (RLS) policies to ensure data isolation between tenants
• TLS encryption for all data in transit
• No raw credit card data stored on our servers (handled by Stripe)
• Regular security reviews and access controls

7. Creator Responsibilities for Participant Data

If you are a challenge creator collecting participant data through the Service:

• You are the data controller for your participants' personal data
• Chalzy acts as a data processor, handling participant data on your behalf and according to your instructions
• You are responsible for obtaining appropriate consent from participants
• You must provide participants with your own privacy notice explaining how their data will be used
• You must comply with all applicable data protection laws (e.g., GDPR, CCPA)

8. Data Retention

We retain your data for as long as your account is active and for a reasonable grace period after account termination to allow for data export and recovery. Backup copies may be retained in accordance with our backup and disaster recovery policies. After the retention period, your data will be permanently deleted.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data
• Objection — object to the processing of your personal data
• Portability — request a copy of your data in a portable format
• Withdraw consent — withdraw previously given consent at any time

To exercise any of these rights, please contact us at hello@chalzy.com.

10. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a challenge creator, you are responsible for ensuring that your challenges comply with applicable laws regarding the collection of data from minors, including COPPA.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or through an in-app notification. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.