Privacy Policy

1. Who We Are

This Privacy Policy explains how FERRUM ASM PTE. LTD., a company incorporated in the Republic of Singapore (Registration No. 202218043H, registered address: 10 Anson Road, #20-05 International Plaza, Singapore 079903) (“we”, “us”, “the Operator”), collects, uses, and protects personal data of users (“you”) of the website https://charla.io/ (the “Website”, the “Service”).

Questions about this Policy can be sent to welcome@charla.io.

2. Key Definitions

• Personal data — any information relating to an identified or identifiable individual.
• Processing — any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• Operator / Controller — FERRUM ASM PTE. LTD., which determines the purposes and means of processing.
• Cross-border transfer — transfer of personal data to a recipient located in a country other than the one where you reside.

3. What Personal Data We Collect

Account data

When you register, we collect your name, Telegram account, and email address.

Technical data

IP address, browser and device information, country, language, UTM/referral parameters, and pages visited.

Third-party account data

If you connect a third-party account (e.g. messaging service, social network, file storage), we may receive additional data such as your avatar, gender, or approximate location, as permitted by that service.

Payment data

Payments are processed entirely by our third-party payment/acquiring provider (e.g. Visa, Mastercard, Shopify Pay). We do not store or process any card details or other payment credentials ourselves — we only receive a notification of successful or failed payment status from the provider. Any payment data you provide during checkout is handled under the payment provider's own privacy policy.

Usage logs

For security purposes, we log authorisation timestamps and request activity within your account.

4. How We Collect Personal Data

• directly from you (registration, payment, support requests);
• automatically, through cookies and similar technologies (see Section 7);
• from third-party services you choose to connect to the Service.

5. How We Use Personal Data

We use personal data to:

• create and administer your account;
• provide customer support;
• send service notifications (registration confirmation, billing, trial expiry, security alerts);
• send product and educational communications, where you have not opted out;
• operate integrations you have enabled with third-party services;
• improve, secure, and analyse the Service, including through aggregated or de-identified statistics;
• prevent fraud and misuse and comply with legal obligations.

6. Legal Bases for Processing (EEA / UK / Switzerland)

Where the GDPR or UK GDPR applies to our processing of your personal data, we rely on one or more of the following legal bases: your consent; performance of a contract with you; compliance with a legal obligation; or our legitimate interests (such as securing the Service and preventing fraud), provided these are not overridden by your rights.

7. Cookies and Similar Technologies

Strictly necessary cookies are set automatically to operate core Service functionality (e.g. keeping you logged in). A cookie notice is shown on your first visit; by clicking “Accept” you consent to our use of analytics and other non-essential cookies described in this section. You can control or delete cookies at any time through your browser settings.

8. Sharing Personal Data with Third Parties

We may share personal data with:

• service providers who process data on our behalf (e.g. hosting, customer support tooling, email delivery) under contractual confidentiality and data-protection obligations;
• payment processors, to complete transactions;
• authorities or third parties, where required by law, to enforce our Terms, or to protect the rights, safety, or property of the Company, our users, or others.

We do not currently share personal data with third parties for targeted or cross-context behavioural advertising. If this changes in the future, we will update this Policy in advance and provide an appropriate opt-out mechanism.

Our service providers are prohibited from using your personal data for their own independent marketing purposes.

9. International Data Transfers

The Company is based in Singapore, and personal data may be processed in Singapore, in the European Union, and other countries where our service providers operate. Singapore does not currently benefit from a European Commission adequacy decision. Where we transfer personal data of individuals in the EEA, UK, or Switzerland to a country without an adequacy decision, we are in the process of putting in place appropriate legal safeguards with our service providers, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable). We can provide further information on the current status of these arrangements on request.

10. Your Rights

Depending on your place of residence, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion of your data;
• request a portable copy of your data;
• restrict or object to certain processing;
• withdraw consent at any time, without affecting the lawfulness of prior processing;
• lodge a complaint with your local data protection authority.

You can exercise most of these rights from your account settings, or by emailing welcome@charla.io.

10.1 European Economic Area, UK, and Switzerland

The legal bases for our processing are set out in Section 6. You have the right to lodge a complaint with your national supervisory authority.

10.2 California (CCPA/CPRA)

If you are a California resident, in addition to the rights above, you have the right to:

• know what personal information we have collected, used, or disclosed about you in the preceding 12 months;
• limit the use of sensitive personal information;
• non-discrimination for exercising any of these rights.

We do not currently sell or share personal information for cross-context behavioural advertising, so no “Do Not Sell or Share” opt-out is required at this time. If this changes, we will add the required opt-out mechanism and notice before doing so.

10.3 Singapore (Personal Data Protection Act)

If you are located in Singapore, we process your personal data in accordance with the Personal Data Protection Act 2012 (PDPA). We rely on your consent, or another basis permitted under the PDPA (such as a legitimate interest exception), to process your personal data, and we will notify you of the purposes of collection at or before the time of collection. You may withdraw consent or request access/correction by contacting welcome@charla.io. You may also lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore.

10.4 Other US States

If you reside in a US state with a comprehensive privacy law (e.g. Virginia, Colorado, Connecticut, Utah), you may have similar rights to access, correct, delete, and opt out of targeted advertising or profiling. Contact welcome@charla.io to exercise these rights.

11. Data Retention

We retain personal data for as long as your account is active, and afterwards only as needed to comply with legal obligations, resolve disputes, and enforce our agreements. Indicative retention periods: account data — for the life of the account plus 1 year after closure; security and authorisation logs — 1 year from creation. We do not store payment card data or metadata ourselves; any payment records are retained by our payment provider under its own policy.

12. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our Service is not directed at children under 16, or the minimum age of consent to data processing in your country if lower (not below 13). We do not knowingly collect personal data from children below the applicable age without verified parental consent. If you believe a child has provided us with personal data, contact welcome@charla.io and we will take steps to delete it.

14. Log Files

Like most websites, we automatically log IP addresses, browser type, ISP, timestamps, and referring/exit pages for security, analytics, and site administration. This data is not used to identify you individually beyond the purposes described in this Policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to you (e.g. by email or an in-product notice) before they take effect. The “Last updated” date at the top of this Policy reflects the most recent revision.

16. Contact Us

For any questions, requests, or complaints about this Privacy Policy or our handling of your personal data, contact us at welcome@charla.io.