What we do with your data

Who is responsible

Pending: data controller: name or company name, tax ID and address. Pending the tax adviser.

Pending: data protection officer, if there is one.

For anything to do with your data, write to us at admin@charlaclub.com.

What we keep and why

Your account. Your email address, your first name, your date of birth, the country you sign up from, your time zone, your language and the date and version of these texts you read. They are used to give you access, organise the rooms and check that you are 18 or older. When you sign up we do not ask for your phone number, surname or city. Legal basis: the contract (Art. 6.1.b GDPR).

Your gender, if you give it. Only for the "only with people of my own gender" switch, which stays off unless you turn it on. You declare it yourself.

Pending: the switch does not exist yet. Once it does: whether gender is asked at sign-up or only when turning the switch on, that it is used for nothing else and shared with no one, how long it is kept and its legal basis.

Your photo. Before anyone sees it, software checks it on our own server: it only looks for explicit sexual content and it can only approve it, never reject it. If it does not approve it, a person reviews it before anyone sees it; and whatever it approves, a person looks over afterwards. No software does facial recognition, compares it with an ID document, estimates your age or infers anything about you. We keep three sizes with no hidden data (no location, no camera data) and never the original. Until it has been reviewed, others see your initial. Once it is approved, it is seen by everyone with a Charla Club account wherever the app shows your name: in the rooms you lead, on the card of a room you are both going to, inside a room (whether you talk or only listen), when it ends, in "Your people" and during a call. Nobody you have a block or an "I'd rather not" with, whether you set it or the other person did, can see it. There are no profiles and no people search, and nobody can download photos in bulk. It is also seen by whoever reviews it; if there is a report you appear in, whoever reviews it; and the person responsible for Charla Club, in the list of accounts in the admin panel, only after writing down a reason. Every time someone on the team opens it, we record who, when and why. Legal basis: the contract.

Pending: whether the photo can be handed over to an authority, for example in a possible crime against children, and in which cases. Pending the lawyer.

Your rooms. Which rooms you say "I'm going" to, whether you went and for how long. When you say "I'm going" to a table, the other people going too see your first name and your photo, once it has been reviewed. If you create a room, its title, its category and your first name appear in the listing for anyone who looks, unless the room does not appear in it. In rooms on sensitive topics, such as health or faith, and in those in the "Other" category, we do not record what the room you went to was about. If you invite someone in "Your people" to your room, we keep whom you invited. Legal basis: the contract.

The room chat. What you write in a room's chat is deleted when the room closes. If someone makes a report, only the reported person's messages are kept, until the report is deleted.

What you write goes through a filter. Software on our server checks room titles to stop phone numbers and shortened links, and the room chat and the messages in "Your people" to also stop payment details and requests for money. If you write words of crisis, it shows you, and only you, the helplines of your country, without telling anyone and without recording it. Legal basis: legitimate interest in protecting the people who use Charla Club.

"Your people". When a room ends, whom you marked as someone you would talk to again: nobody else sees it if the mark is not mutual. If you both mark each other, you are in each other's "Your people" and your conversation opens: the messages between the two of you, which only the two of you read, not our team either, except what is kept with a report. And whom you have removed from "Your people", so that they cannot write to you, call you or be in a room with you. Legal basis: the contract.

If you ask for a one-to-one conversation without having met before, once this exists: when you asked and at what times you wanted to talk. Legal basis: the contract.

Your calls. Two people in "Your people" can call each other. For each call we keep who called, when, whether it was answered and how long it lasted, and, in your conversation, the date of the first time you heard each other and of the first time you saw each other on video. Never what was said or seen. Nobody else can join a call, not even our team. Legal basis: the contract.

Your voice and your image. In a room, your voice travels live through our server in Madrid to the other people; rooms have no camera. In a call, your voice, and your image if you turn the camera on, travel the same way to the other person, who only sees you if they turn theirs on too. They are not recorded or transcribed.

The panic button. In the Android app, while you are in a room or a call, your phone keeps in its memory the last 60 seconds of what it hears, never your own microphone, overwriting them as it goes. If you press the button and make a report, those seconds are uploaded with your report; if you do not report, they are discarded. Nothing is kept on the web. What is uploaded is deleted after 30 days, only the person responsible for Charla Club listens to it, with a written reason, every listen is recorded, and it is handed to the authorities if they ask for it.

Pending: the legal basis for the panic buffer (legitimate interest or separate consent), and whether anything changes in a call, where it identifies the other person beyond doubt. Pending the lawyer.

If you have a gifted member plan. Who gave it to you, when and why, and, if it is withdrawn, when and why. It is used to give you the plan benefits, video in calls among them. It is not a payment. Legal basis: the contract.

Your contacts. When you invite someone to a room by email, we keep their address and the name you typed in your contact list, so you do not have to type them again; you can also add contacts by hand. Your list is yours alone: we do not cross it with anyone else's, we do not suggest anyone, and we do not tell you whether a contact has an account. We do not import your phone's address book.

Pending: the legal basis for the contact list (legitimate interest, or the household exemption with Charla Club as processor). Pending the lawyer.

Phone and browser notifications. If you accept them, the identifier your phone or browser gives us to send you notifications, and a key so that your phone can ask us what each one says. The notification goes out empty: what it says, your phone then asks our server for. When you sign out, that phone stops receiving them. Legal basis: the contract.

The emails we send you. Which email went out, when and to which fingerprint of your address, never the address itself. Legal basis: the contract.

Your IP address. We use it to know which country you are connecting from, with a country database installed on our own server: your IP is not sent to anyone for that. While you sign up we keep a fingerprint of your IP, not the IP, to stop abuse. Legal basis: the contract, because you are asking to join. The server's access log keeps the full IP, for security.

Pending: the legal basis and the period of the access log with the full IP, and how long the other server logs are kept. Pending the lawyer.

If you join the waiting list. Your email address, your city if you type it and the time you prefer, to let you know when it opens. Legal basis: your consent, which you can withdraw at any time.

If someone invites you. Your email address, which the person inviting you gives us, to send you the invitation. If they invite you to a room, the invitation does not keep your address or your name, only a fingerprint of the address in the record of emails sent; but the person inviting you keeps you in their contact list, and the invitation email tells you so. If you do not want to be in anyone's list, write to us at admin@charlaclub.com: we remove you from all of them at once and you do not go back into any. If it is an invitation to try Charla Club before it opens, the legal basis is legitimate interest in deciding who tries it.

If you ask us to send you the link to open it on a computer. Anyone can type an address to receive that link, with or without an account. We do not keep the address: only a fingerprint of it in the record of emails sent, so that no more than a few go to the same address each day. The email carries the link to stop receiving more.

Pending: legal basis for emails to addresses without an account (the sign-in code, the invitation and the computer link). Pending the lawyer.

Reports and sanctions. If you report someone, if someone reports you or if your account is sanctioned, we keep what happened and what was decided. If you report from a conversation, the last 20 messages of the reported person are kept, never yours. What is kept from a chat or a conversation is only read by the team with a written reason, and every reading is recorded. The person who reports is told whether measures were taken or not, never which ones; the reported person is never told who reported them. Legal basis: legitimate interest in protecting the people who use Charla Club, and the duty to explain decisions (Art. 17 of the Digital Services Act).

We do not sell your data or use it for advertising.

Where it is and who helps us

What we keep ourselves, the database, the photos and the logs, is on a Kamatera server in its data centre in Madrid. The daily copy Kamatera makes of the server stays in Madrid and lasts 14 days.

Pending: whether Kamatera's daily copy is encrypted and who can read it, and the copies on the controller's computer: where they are, whether they are encrypted and how long they last. Pending Kamatera's written reply, a decision and the lawyer.

These processors help us:

• Clerk, a United States company: your email address and the technical data of your sessions, so you can sign in. Its protection against automated access goes through Cloudflare.
• Resend, a United States company that sends from servers in Ireland: it sends our emails. It receives your address, your first name and the text of each email: the sign-in code, the notices about your rooms, invitations and, when it applies, what was decided about your photo or your account. It does not track whether you open the emails or click their links.
• Kamatera: the server in Madrid. Its parent company is Israeli, and Israel has an adequacy decision from the European Commission.
• Apple and Google, for phone notifications, and your browser's notification service if you accept them on the web: they receive an empty notification and your device identifier, nothing else. What the notification says, such as "Myla is calling you", your phone then asks our server for.

Neither Clerk nor Resend receives your photo.

Pending: the safeguard for each transfer outside the European Economic Area (Clerk and Resend), how long Resend keeps each email under its contract, Kamatera's sub-processors and where its support staff work from, and how to declare that Resend receives the decisions about your photo. Pending the lawyer.

How long

• Your account and your approved photo: for as long as you have an account.
• A sign-up you did not finish, without a photo: deleted after 30 days.
• A rejected photo or one you replaced: the file is deleted in the nightly clean-up after one day has passed, so within two days at most. The reason and who reviewed it stay on record.
• The fingerprint of the sign-in code and of your IP: two days at most, through the same nightly clean-up.
• Your "I'm going": 90 days after the room.
• The invitations to a room you send to "Your people" in the app: 90 days.
• Your conversation requests and the times you asked for: 90 days.
• How long you stayed in each room: 90 days. That you were in it: two years.
• A room's chat: deleted when it closes.
• Whom you marked as someone you would talk to again: two years.
• Your messages in "Your people": they do not expire. If the other person deletes their account, their messages go with it, and your conversation stays in your "Your people", read-only, with yours, until you delete it. Once neither of you is left, it is deleted entirely.
• Whom you have removed from "Your people": for as long as you have an account.
• Your calls: the exact time each of you joined and left, 90 days. That there was a call, who called and when: for as long as your conversation lasts.
• The seconds from the panic button: 30 days. Who listened to them: one year.
• Who read what was kept with a report: one year.
• Your contacts: one added by hand whom you do not invite is deleted after 30 days; the rest, for as long as you have an account, and after two years unused.
• A gifted plan: while you have it; once withdrawn, one year after it is withdrawn.
• The identifier for phone notifications: until you sign out or, if it is not used, six months.
• The record of emails sent: 90 days; if you had no account, as with the code, the invitation or the computer link, 30 days.
• The waiting list: one year.
• An invitation to try Charla Club: if nobody uses it, 180 days; if it is withdrawn, 90 days.
• Reports: one year, and none is deleted while it is still open.
• Who on the team opened your photo: one year.
• If you asked us not to write to you: your address, five years, so we do not do it again.

Pending: how long sanctions and bans are kept (three years after they end is proposed) and the justification for keeping for one year the record of who opened your photo. Pending the lawyer.

Pending: how long it takes for what was deleted to disappear from the backups. Pending decision.

How to delete your account

From "Your account", in the app or on the web: you type the word it asks for to confirm, and it is deleted there and then. If you are a host or part of the team, write to us to do it. You can also write to admin@charlaclub.com from your account's email address and tell us you want to delete it: we delete it and reply within one month at most (Art. 12.3 GDPR). If we ever need more time, we tell you within that month, with the reason.

Your account is deleted on our server and at Clerk, with everything that depends on it, your photo and your contact list included, and the messages you wrote. You are also removed from other people's contact lists. After that, these remain, each until its period ends:

• sanctions, with a fingerprint of your email address instead of your name, so that a ban cannot be dodged by signing up again;
• the record of who on the team opened your photo, with that same fingerprint;
• your address, if you asked us not to write to you;
• the note that the account was deleted, for 120 days, so that it does not come back when a backup is restored;
• the reports and the agreed mutes you appear in, with what was written in them, for one year, but no longer linked to your account;
• what the host did with you in a room, for 90 days, and what they noted about the room in their report, which may name you, for one year;
• the messages you wrote that go with a report, until the report is deleted;
• in a one-to-one conversation, what the other person wrote and the calls between you, no longer with your name, for as long as the other person keeps it.

Nothing linked to their email address remains of a person under 18, except the note of the deletion for those same 120 days.

Your rights

By writing to admin@charlaclub.com you can ask, at any time:

• to see what data of yours we have and get a copy;
• to correct any that is wrong;
• to delete it;
• for us to stop using it, or to restrict its use while something is resolved;
• to take it with you in a machine-readable format;
• to withdraw your consent where you gave it, as on the waiting list, without affecting what came before.

We reply within one month at most. If you do not agree with the reply, you can complain to the Spanish Data Protection Agency (AEPD) or to the data protection authority of the European Union country where you live.

Under 18s

Charla Club is only for people aged 18 or older. If someone looks under 18, their account is suspended until they prove their age by showing their ID in person, with no copy made: only the result is recorded.

Pending: protocol for child sexual abuse material or a suspected minor: what is kept, for how long, who is notified and what happens to the account if the person does not prove their age. Pending the lawyer.