What we do with your data

This is our privacy notice for people who use Charla Club from the United States and Puerto Rico. It is given to you at or before the moment we collect anything, when you sign up, and it stays at this address. It says what we collect, where it comes from, why, who sees it, for how long we keep it, and what you can ask of us. It is written to be read in full, but if you only want to know one thing, each section stands by its heading.

Charla Club is operated from Spain. Because of that, the European Union's General Data Protection Regulation (GDPR) applies to what we do with your data as well, wherever you live, and this notice is also the information that its articles 13 and 14 require. You get the rights of both: those of your state's privacy law and those of the GDPR.

Who is responsible

The business responsible for your data (the "controller", in the words of the GDPR) is admin@charlaclub.com, tax identification number admin@charlaclub.com, with its address at admin@charlaclub.com.

For anything to do with your data and your rights, write to admin@charlaclub.com. If there is a data protection officer, you write to them at admin@charlaclub.com.

Some of the features described here may not be active yet in your country or for your account. What is not active is not offered on the screen and processes no data; what this text says applies just the same the day it is switched on.

The short version

• We collect what you give us when you sign up and use the service (your email, your first name, your date of birth, your photo, what you write), what your device gives us (your IP address, the identifier for notifications, your time zone) and what Google Play tells us if you buy the plan. Nothing comes from data brokers.
• We use it to run the service, keep it safe and tell you what is going on. Nothing is used for advertising.
• We do not sell your personal information, we do not share it for cross-context behavioral advertising, we do not use it for targeted advertising and we do not profile you, and we have not done any of that in the past twelve months. Because of that there is nothing to opt out of, and we treat the Global Privacy Control signal of your browser as a valid opt-out request all the same.
• It is stored on our own server in Madrid, Spain, and a few service providers help us; each is named below with what it receives.
• We do no facial recognition, we take no voiceprints, we collect no biometric identifiers and we do not seek health data.
• You can see, correct, delete and take away your data, and you can appeal our answer, whatever state you live in.

What we collect, where it comes from and why

Each block below says what we keep, who gives it to us, what it is for and who sees it. At the end of each one is its legal basis under the GDPR, which applies because we are established in Spain.

Your account. Your email, your first name, your date of birth, the country you sign up from, your time zone, your language and the date and version of these texts that you read. You give them to us; the country comes from your connection. They are used to give you access, to organize the rooms and to check that you are 18 or older. When you sign up we do not ask for a phone number or a surname. Legal basis: the contract (article 6.1.b of the GDPR).

Your profile. Your city, chosen from a list, what you say about yourself, your interests (from the app's topics, never the sensitive ones), what you are looking for (from a closed list: practicing hobbies, socializing, making friends, professional contacts), and which parts of all this you let others see. With it, people with an account are shown your profile, together with your photo, your name, the hangouts you have been to and the groups you belong to, when they tap your name in a room, at a hangout or in a list in which you already appear. Nobody sees it without an account, it has no public address and no program reads it to rank, suggest or measure anything. With a block in between, it does not exist for that person. Legal basis: the contract.

Your gender, if you state it. Only for the switches "only with people of my own gender" and, in "Shall we talk today?", "only with people of another gender", which are off unless you turn them on. You declare it yourself, in "Your account", and you can delete it right there; it goes to nobody, not to those who sign up for your room and not to any third party. It is sensitive personal information under several state laws, and we use it only for the switch you turned on. Legal basis: your consent, which you withdraw by deleting it or turning the switch off.

Your photo. Before anyone sees it, a program on our own server checks it: it only looks for sexually explicit content and can only approve it, never reject it. If it does not approve it, a person reviews it before anyone sees it; and what it approves, a person looks over afterwards. No program does facial recognition, compares it with an ID document, estimates your age or infers anything about you, and no face template or other biometric identifier is created from it. We keep three sizes without hidden data (no location, no camera data) and never the original. Until it is reviewed, others see your initial. Once approved, it is seen by people with a Charla Club account wherever the app shows your name: in the rooms you run, on the card of a room you are both going to, inside a room (whether you talk or just listen), when it ends, in "Your people", in a call, on your profile, in the people search results and in the member list of your groups. At a hangout you are going to or organizing, and on the page of a group you run, it is also seen by people without an account, unless you set in "Your account" that your face at hangouts is shown only to people with an account. Nobody you have a block or a "rather not" with sees it, whether you or the other person set it. Nobody can download faces in bulk: each face is served with a signed, expiring address and a request cap. It is also seen by whoever reviews it; if there is a report in which you appear, by whoever reviews that; and by the person responsible for Charla Club in the accounts list of the admin panel, small, and large only after writing a reason. Every time someone on the team opens it, who, when and why is recorded. Legal basis: the contract (it is the condition of using the service, because there is no anonymity here).

Venue and album photos. The photo of a hangout's venue and the album photos of a hangout or a group are uploaded by whoever organizes or goes, and they are of a place or a get-together, not a portrait. They go through the same explicit-content program as your photo, which only approves; anything doubtful is looked at by a person. They are seen as the hangout or the group is: venue photos also without an account. If you appear in one and do not want to, ask the organizer to remove it or write to us. Legal basis: the contract with whoever uploads it, and the community's legitimate interest in seeing the place and the get-together, which gives way to anyone asking for an image of themselves to be removed.

Your rooms. Which rooms you say "I'm going" to, whether you went and for how long. When you say "I'm going" to a room, the other people going see your first name and your photo, if it has been reviewed. If you create a room, its title, its category and your first name appear in the listing for whoever looks, unless the room is private; a room can also be shared with a link, whose page shows, also without an account, the title, when it is, who runs it and how many are going, without faces. In rooms on sensitive topics, such as health or faith, and in those in the "Other" category, we do not record what the room you went to was about. If you invite someone to your room, we keep whom you invited. If whoever runs the room turns your microphone off or back on, it is recorded, and who is muted is known only to that person and to whoever runs the room. Legal basis: the contract.

Stars for whoever runs a room or a hangout. When a room closes, those who were inside can rate the person who ran it from 1 to 5, stars only and no text. We keep who rated whom, so that each person rates only once, but no screen or response says who gave what: the score is shown as a single average per person, and room stars are added to it in batches so that nobody can tell whose each one was. Hangout reviews, on the other hand, are public under your first name: you choose that when you write one. Legal basis: the contract.

Room titles. We may keep the titles written when creating a room, without the name of whoever wrote them or the room they come from, to see what people enjoy talking about and improve the title ideas we offer when a room is created. If we do, we do not keep those on sensitive topics or in the "Other" category. And each title is translated automatically into the app's other language by a translator that runs on our own server: the title does not leave it. Legal basis: legitimate interest in improving the service.

Chats. What you write in a room's chat is deleted when the room closes. We may keep it for a while, at most 90 days, the period published here, for one purpose only: the safety of the service and improving its filters against abuse and scams. If we do, a program running on our Madrid server goes through it and raises an alert if something looks like a risk. In addition, the person responsible for Charla Club can read a room's kept chat and private messages (those of "Your people", of a hangout and of a group), with or without an alert from the program, for the safety of the service and to handle a report or a legal request: only that person, nobody else on the team, with a written reason each time, and every reading is recorded with who, when and why. That person can also delete from the panel an archived room, the comments and chat of a past hangout and the text of a private conversation (for both people), with the same password and leaving a trace; never anything with an open alert or report. Chats are never used for anything product-related and never handed to anyone. If someone reports, only the reported person's messages are kept as well, until the report is deleted. The contents of your private messages are sensitive personal information under several state laws: we use them only to deliver them, to keep the service safe and to handle a report, nothing else. Legal basis: legitimate interest in the safety of the service and of the people who use it (article 6.1.f), weighed as follows: access is held by one person only, with a reason and a trace, for a specific purpose and for a limited time; there is no listening to voice, which the wiretap laws forbid; and you know from this page that it can happen. If you do not want anyone to be able to read what you write, talk by voice: voice is not recorded.

What you write goes through a filter. A program on our server looks at room titles, hangout and group descriptions, comments and discussions to stop phone numbers and shortened links, and at the room chat and private messages to stop payment details and requests for money as well. If you write crisis words, it shows you, and only you, your country's helplines, without alerting anyone or recording it. Legal basis: legitimate interest in protecting the people who use Charla Club.

"Your people". At the end of a room, whom you marked as someone you would talk to again: nobody else sees it if the mark is not mutual. If you mark each other, you are "Your people" and your conversation opens: the messages between the two of you, which nobody else on the team reads, except as said under "Chats". And whom you have removed from "Your people", so that they cannot write to you, call you or end up in a room with you. Requests to be "your people": whom you asked, who asked you and what each answered; the person asking is not told the answer. To show you whom you can ask, we use whom you have been in a room with, which we already keep from your rooms, and whom you share a hangout or a group with. If you joined someone's "Your people" through their invitation or their link, that it was so. If the other person can see how far you have read their messages, it is because that box is on in "Your account", it is reciprocal and it is turned off there; there is no "last seen" and no "typing". Legal basis: the contract.

The people search. With the plan, in [Add] you can search for a person with an account by their first name, in your country or across the whole app: the name, the country code, the city and the face are shown. We keep how many requests you send per day, for the cap. If you do not want to appear in the search, turn off "let people find me" in "Your profile". Nobody you have a block with can find you. Legal basis: the contract; being findable, your choice, which you can change at any time.

Following. Whom you follow, to show you what they run and, if you set the bell, to notify your phone when they propose something new. The person followed sees only how many people follow them, never who, and nobody else sees that number. You unfollow whenever you want, and if someone turns off "let people follow me", they disappear for those who followed them. Legal basis: the contract.

"Shall we talk today?". If you ask for a one-to-one conversation, when you asked and at what times you wanted to talk. If we suggest someone to you, whom and for what time: the other person sees your first name and the time, and your photo only if you have already been in a room together. If you both say yes to someone you had not met, a conversation with someone new opens: you can write to each other only in the 10 minutes before the time and, at the time, call each other by voice only, without video. Afterwards, each says whether they want to stay in touch: if you both do, you become "Your people"; if one says no, or you do not both say so within 24 hours, the conversation closes for both and nobody is told who said what. Of that conversation we keep the messages, the calls as under "Your calls", whether each said yes and when it closed. Legal basis: the contract.

Your calls. Two people in "Your people" can call each other. Of each call we keep who called, when, whether it was answered and how long it lasted, and in your conversation the date of the first time you heard each other and of the first time you saw each other on video. Never what was said or seen. Nobody else can join a call, not our team either. If video in calls has a monthly minutes cap for you, we keep a single number: the seconds of camera this month, overwritten every month, with no record of whom or when. Legal basis: the contract.

Who holds the microphone in a room. Whoever runs it can take the microphone, and then only that person is heard until they let it go or pass it to someone else. While the room lasts we keep who holds it; we do not keep how long anyone speaks. It is deleted when the room closes. Legal basis: the contract.

Your voice and your image. In a room, your voice travels live through our Madrid server to the other people; there is no camera in rooms. In a call, your voice, and your image if you turn on the camera, travel the same way to the other person, who only sees you if they also turn on theirs; whoever watches sees a watermark with their own identifier. They are not recorded, analyzed or transcribed, and no voiceprint or other biometric identifier is taken from them, except as follows.

Transcription, only if all of you accept. A room is turned into text only if every person inside accepts it, in that session. Each phone turns into text only its owner's voice, inside the phone, and uploads the text; the audio stays on each phone and no server process enters the room. We keep who said what and in what order, never the time, and who accepted and when. Only those who were in that room read it, and every reading is recorded. Legal basis: your consent, which you withdraw in the room itself and which, if the conversation touches health, faith, politics or sexuality, is the explicit consent of article 9.2.a. Captions are generated on your phone and the audio does not leave it: we keep nothing, and the recognition model is downloaded from our server only if you ask for them.

The panic button, with your consent. In the Android app, while you are in a room or a call, your phone keeps in its memory the last 60 seconds of what it hears, never your own microphone, overwriting them. If you press the button and report, those seconds are uploaded with your report; if you do not report, they are discarded. On the web nothing is kept. What is uploaded is deleted after 30 days, only the person responsible for Charla Club listens to it, with a written reason, every listening is recorded, and it is handed to the authorities if they ask. In many states, recording a conversation requires the consent of everyone in it: that is why, in the United States and Puerto Rico, every person is asked for their express consent to this when they sign up (and again before entering a voice room or a call, if they did not give it then), and nobody enters a voice room or a call without having given it. You can withdraw it in "Your account" or by writing to us; then you can use everything except voice rooms and calls. Legal basis: your consent (article 6.1.a), together with our legitimate interest in protecting whoever asks for help and in being able to review what happened (article 6.1.f), weighed as follows: they are seconds, not a recording of the room; they only leave the phone if the person reports; only one person hears them, with a reason and a trace; and they expire.

If you have the plan. If you buy it in Google Play, Google sends us a purchase token, the plan, its status and until when it is paid; with that we give you the features and verify the purchase on our server. Google is who charges you and who keeps your payment details and your receipt: we see no card, no name on it and no billing address. If we give you the plan, who gave it, when, until when and why, and if it is withdrawn, when and why. Legal basis: the contract.

Hangouts. If you create one, its title, its description, its category and its topics, its city and its place, its date and its length, its price if you set one, your payment handle (Venmo, Zelle, PayPal or similar) if you give it with the organizer plan, its sign-up questions, its outside link and its video call link if you add them, its photo and its poster, and who organizes with you. If you go, that you go, with how many people, your answers to the questions, your attendance mode if it is mixed, whether you are waiting for a seat, whether you asked to go and what you were answered, whether you were removed or added by hand and by whom, whether you came (marked by the organizer with your entry code) and whether you canceled; of all this the organizer sees their part and the people of the hangout only that you are going. Your comments and replies, public as the hangout is; the hangout chat and the private messages between the people of the hangout, or to the organizer, only between those people; which comments you give a heart to, of which others see only how many each comment has; which hangouts you save without signing up, which nobody sees; your drafts, which only you see; whom you want to stay in touch with afterwards; and your review, public under your name, and the organizer's reply. The organizer also has aggregate numbers about their hangouts (how many people, how many for the first time, age bands and declared-gender split), always with a minimum number of people behind each figure so that nobody can be worked out from them; and an attendance history, only for their own hangouts and only as counts. Legal basis: the contract; the aggregate numbers, the organizer's legitimate interest in knowing their audience, with no personal data inside.

The venue and the hangouts map. A hangout's city and place are text, never anyone's position. To find the venue, the text the organizer types, with the country, the language and the city center, may be sent to Google (Places API) from our server, with our key: Google sees that text and our server's address, not the person. If the map shown is Google's, your browser or phone talks to Google when drawing it, and Google sees your IP address and which piece of map you look at, under its own terms; the pins are the hangouts' venues, which are public, and your position is not sent to it. You can use hangouts without opening the map. "Near me" is optional: if you ask for it and allow it on your phone, your position is rounded on the phone, travels in the body of that request, is used to filter and sort the hangouts of that moment and is forgotten: it is not stored in the database or in the logs, it is shown to nobody, and you can refuse or withdraw the permission in your phone's settings without losing anything. Your precise location is sensitive personal information under several state laws: it is used only for that one search, with your permission, and never kept. Legal basis: the contract; "Near me", your consent, which you withdraw on the phone.

The camera, for taking attendance. If you organize a hangout, in the Android app you can take attendance by reading with the camera the entry code of whoever arrives. The camera is on only while you keep the reader open, the image is processed on your phone and no image is stored or sent: our server receives only the code read, the same one you would type by hand. To read the code, the app uses a Google library (ML Kit) that ships inside the app. That library sends Google, encrypted, metrics about its own working: the phone's make, model, Android version and which machine-learning accelerators it has, the app's name and version, the library's version, what was done (starting it, reading, releasing it), how long it took, the size and format of the image and the error codes, with an installation identifier that, according to Google, is not intended to identify a person or a phone. Never the image or the content of the code. Google uses them to measure, debug, maintain and improve the library and to detect misuse, as a controller in its own right and under its own privacy policy; we do not receive them. You can take attendance without the camera, by typing the code: the reader is optional and asks for your permission first. Legal basis: legitimate interest in the reader working (article 6.1.f), weighed as follows: they are technical data about the library, with no image, no name and no account of yours, and only when you open the reader.

Groups. If you run one, its name, its description, its welcome message, its city, its topics, its cover and that you run it. If you are a member, which groups, with which role and since when, your answers to the joining questions and your introduction (read by the leadership and, the introduction, by the other members), whether you want its notices, the day of your last visit (no time), and the discussions, comments, photos and messages you write or upload in it. We keep every action of the leadership (who accepted, removed, banned, gave a role or transferred the group), without text, to be able to look back if someone complains. The group's statistics are numbers only, with nobody inside. The group's page is seen by anyone, also without an account, and in a public group its discussions too; the member list, with name, city and face, only by the other members. If the group closes, it is deleted with everything of its own. Legal basis: the contract; the leadership's actions, legitimate interest in being able to handle a complaint.

Your contacts. When you invite someone to a room or a hangout by email, we keep their address and the name you typed in your contacts list, so you do not have to type them again; you can also add contacts by hand. Your contacts list is yours alone: we do not cross it with anyone else's, we suggest nobody and we do not tell you whether a contact has an account. If you add a contact by hand and that address belongs to an account, that person receives your request to be "your people"; we do not tell you whether they had one or what they answer. We do not import your phone's address book. This is the one case in which we receive personal information about you from another person: the member who typed your address. Legal basis: your and our legitimate interest in letting you invite again without typing, limited as follows: the invited person is informed by the invitation email itself, a hand-added contact you do not write to is deleted by itself after a month, and anyone can ask to be taken out of every contacts list at once.

Notices. The app's "Notices" tray keeps which kind of notice you received, when, which room, hangout, group or conversation it refers to and whether you have opened the tray, without text: the text is composed when read. "Your notices", in "Your account", keeps which groups of notices you have turned off on the phone or asked for by email too. Legal basis: the contract.

Phone and browser notifications. If you accept them, the identifier your phone or browser gives us to send you notifications, and a key so your phone can ask us what each one says. The notification goes out empty: what it says is fetched afterwards by your phone from our server with your session. When you sign out, that phone stops receiving them. Legal basis: the contract.

The emails we send you. The notices about your rooms, your hangouts (reminders, changes and cancellations), your groups, "Your people" and your account, and the written decisions about your photo or your account. Of each sending we keep which email went out, when and to which hash of your address, never the address in clear. You can turn off groups of notices in "Your notices", and every email that is not essential carries its one-click link to stop receiving it, which we honor at once (CAN-SPAM Act). What is essential (a decision about your account, a canceled hangout you were going to) cannot be turned off. We do not measure whether you open emails or click their links. Legal basis: the contract.

Invitations and links. If you invite someone without an account by email, we send them the invitation with your first name; if you ask Charla Club to send your "Invite a friend", we send it once per address, with a one-click unsubscribe and without telling you whether that address has an account. The "Invite a friend" link carries, encrypted, who invites, shows only your first name to whoever opens it and does nothing by itself when opened; we do not count who arrives. A single-use link to a private room keeps who used it. Legal basis: the contract with whoever invites; for the address of someone without an account, legitimate interest in delivering the invitation another person asked for, limited to that sending and with the unsubscribe in the email itself.

Your IP address. We use it to know which country you connect from, with a country database installed on our own server: for that, your IP is sent to nobody. It tells us the country, not your street or your city. While you sign up we keep a hash of your IP, not the IP, to curb abuse. The server's access log keeps the full IP, with the address requested and the time, for 90 days, for security: to investigate an attack or an abuse and to be able to show what happened. Legal basis: the contract for the country; for the log, legitimate interest in the security of the network and the service (recital 49 of the GDPR).

If you join the waiting list. Your email, your city if you type it and the time you prefer, to let you know when it opens in your country. Legal basis: your consent, which you can withdraw at any time by writing to us or with the link in the email.

If you ask us to send you the link to open it on a computer. Anyone can type an address to receive that link, with or without an account. We do not keep the address: only a hash of it in the record of emails sent, so as not to send more than a few a day to the same address. The email carries the link to receive no more. Legal basis: your request (pre-contractual, article 6.1.b).

If you write to us. What you send from "Write to us" goes out by email to our mailbox, with your address so we can reply, and is not stored in the database: only when you wrote, for the daily cap. What you send to the point of contact is kept in that mailbox for as long as it takes to answer you and to be able to show that it was answered. Legal basis: the contract, and our commitment to answer notices about illegal content.

Reports and sanctions. If you report someone, if someone reports you or if your account is sanctioned, we keep what happened and what was decided. If you report from a conversation, the last 20 messages of the reported person are kept, never yours; if you report a comment, a discussion or a photo, a copy of what was reported is kept. What is kept from a chat or a conversation is read by the team only with a written reason, and every reading is recorded. We tell whoever reports whether there were measures or not, never which; we never tell the reported person who it was. A sanction is explained in writing and a review can be requested. If a report points to a risk to someone's life or safety, we notify the police. Legal basis: legitimate interest in protecting the people who use Charla Club, and the need to explain decisions and to keep the proof of a sanction for as long as it can be contested.

Copyright notices. If someone sends our designated agent a notice that something you published infringes their copyright, that notice, which names the person who sent it, what was removed and what you answered stay in our mailbox, to be able to show what we did and to apply the repeat-infringer policy of the terms. Legal basis: legitimate interest in being able to show how a notice was handled, and the law that governs those notices.

Who on the team looks at what. Every time someone on the team opens your photo, listens to panic audio, reads a kept text, opens an archived chat or a private thread, looks at your plan or requests your data report, who, when and why is recorded, and that record cannot be rewritten; the person responsible may delete rows from it, and for each one the audit keeps that it was deleted, without who or the reason. Legal basis: the obligation to be able to show that we do what we say (article 5.2 of the GDPR).

What we measure. To know whether Charla Club works we count things by groups of people (how many rooms filled up, how many people came back), always aggregated and with a minimum number of people behind each figure: there is no data of yours in those numbers, and there are no trackers or third-party analytics.

What we do not do

• We do not sell your personal information and we do not share it for cross-context behavioral advertising, in the words of California law, nor for targeted advertising in the words of the other states' laws, and we have not done so in the preceding twelve months. We do not sell or share the personal information of anyone, so also not of anyone under 16.
• We do not profile you and we make no decision about you by automated means that has legal or similarly significant effects: a sanction is always decided by a person, and the photo filter only approves.
• We do not use your data for advertising, we show no ads, and we pass your data to nobody for marketing. We do not disclose your personal information to third parties for their direct marketing purposes (California Civil Code section 1798.83).
• We collect no biometric identifiers or biometric information: no facial recognition, no face geometry, no voiceprints, no fingerprints, under the Illinois Biometric Information Privacy Act or any other law. The photo filter looks for explicit content, not for faces; voice travels live and is not analyzed; captions and transcription turn speech into text on the phone without identifying anyone by their voice.
• We do not seek health data, and we treat none to identify your health. The topics of rooms about health, faith, politics or sexuality are not recorded in your attendance, your interests cannot include them, what you say in a room is not recorded except for the panic seconds described above, and crisis words show you helplines without recording anything. If you write about your health in a message, it is your message and it is treated as said under "Chats", and we infer nothing from it. We make no inferences about you of any kind.
• We honor Global Privacy Control. We do not sell or share, so there is nothing to opt out of; if your browser sends the Global Privacy Control signal, we treat it as a valid request to opt out of sale and sharing, which we fulfil by not doing either. Because we do not track you across other sites, there is nothing to turn off there either.
• We offer no financial incentive for your data: no discount, no reward, nothing, in exchange for collecting, keeping or selling it.

Where it is and who helps us

What we keep ourselves, the database, the photos, the panic audio and the logs, lives on a Kamatera server in its Madrid data center, in Spain. The voice of rooms and calls is relayed by that same server, live: it passes through no third party. The program that checks photos, the title translator and our own venue search also run on that machine, without leaving it. The daily copy Kamatera makes of the server stays in that same data center and lasts 14 days. In addition, every night the machine itself encrypts a copy of the database, the deletions, the configuration and the approved photos with a key whose private half only the person responsible holds, and stores it in their Google Drive and on their computer, in Spain; neither Google nor the computer can open it, and what expires is deleted by itself. Photos set aside on suspicion of a minor and panic audio never go into that copy.

Your data leaves the United States. By using Charla Club you understand that your personal information is transferred to, stored in and processed in Spain, in the European Union, where the privacy law is the GDPR, and that it is processed by the providers below in the United States and in Ireland. The GDPR gives you the rights listed under "Your rights" wherever you live, and we apply the same protections to everyone.

These service providers help us, each under a contract that binds them to use your data only for us (a processing agreement under article 28 of the GDPR, which also meets what the state laws ask of a service provider or processor contract):

• Kamatera, the Madrid server and its daily copy. It is a company with an Israeli parent; Israel has an adequacy decision of the European Commission. Its staff provide support on the machine only when we ask.
• Clerk, a United States company: your email, the technical data of your sessions (device, browser, IP address) and, if you are on the team, your password, so that you can sign in. Its protection against automated access goes through Cloudflare. Transfer safeguard under the GDPR: the European Commission's standard contractual clauses included in its processing agreement and, as far as it is covered, the EU-US Data Privacy Framework.
• Resend, a United States company that sends from servers in Ireland: it sends our emails. It receives your address, your first name and the text of each email. It does not measure whether you open emails or click their links. Safeguard: the standard contractual clauses of its processing agreement.
• Google, a United States company, for five distinct things: phone notifications (Firebase Cloud Messaging, which receives your phone's identifier and an empty notification); the encrypted daily copy in Google Drive, which it cannot read; the venue search and the hangouts map (Places API and Maps JavaScript API, which receive the text searched, the city center and, when drawing the map, your IP address and the piece of map you look at); the entry-code reader in the Android app (ML Kit, a library of its own that ships inside the app and sends it technical metrics about its own working, never the image or the code read); and Google Play, which sells and charges for the plan and sends us the purchase token. Safeguard: the standard contractual clauses in its data processing terms and its certification under the EU-US Data Privacy Framework. For the store, the map and the reader's metrics, Google also processes your data as a controller in its own right, under its own privacy policy.
• Apple, once the iPhone app exists: the last leg of the phone notification, with the device identifier and an empty notification.

None of them receives your photo in clear. If one day we switch on paying for hangouts through the platform, the payment provider (Stripe or PayPal) would be one more processor and we will say so here, in a new version, before charging anything. The external monitor that checks whether the server is alive receives only the word "alive" or "sick".

Beyond these providers, your data leaves Charla Club only in these cases: if an authority with power to ask for it does so (a court, a prosecutor, a law enforcement agency with a subpoena, warrant or equivalent formal request, or a privacy or consumer protection authority), and then we hand over only what it asks for; if a report points to a risk to someone's life or safety, to the police; and if Charla Club is ever reorganized into a company or passes to another owner, your data goes with the service, for the same purposes and under this notice, and we tell you beforehand. We do not accumulate data to sell it: a change of owner never changes what your data may be used for.

If there is a security breach that affects your personal information, we tell you, and the authorities where the law requires it, without undue delay and in the way your state's law provides.

For how long

• Your account, your profile and your approved photo: for as long as you have an account.
• A sign-up you did not finish, without a photo: deleted after 30 days.
• A rejected photo or one you replaced: the file is deleted in the next night's clean-up. The reason and who reviewed it are kept. A photo rejected for a serious reason is set aside outside the app for 90 days, available only to the person responsible and to the police, and destroys itself.
• The hash of your sign-in code and of your IP: one day.
• Your "I'm going": 90 days after the room.
• Invitations to a room in the app: 90 days. Single-use links to a private room: 90 days.
• Your conversation requests and the times you asked for: 90 days. Whom we suggested to you: 30 days after it closed.
• The messages of a conversation with someone new that closes without staying in touch: 30 days. If you stay in touch, they stay like those of "Your people".
• Who holds the microphone in a room: deleted when the room closes. That your microphone was turned off or back on: 90 days.
• How long you stayed in each room: 90 days. That you were in it: two years. The exact time you joined and left: 90 days.
• A room's chat: deleted when it closes; if we keep it, at most 90 days.
• Room titles, if we keep them: without anyone's name, for as long as they help with the title ideas.
• Whom you marked as someone you would talk to again: two years. Stars for whoever ran a room: two years.
• Requests to be "your people": one year.
• Your messages in "Your people": they do not expire. If the other person deletes their account, their messages go with it, and your conversation stays in your "Your people", read-only, with yours, until you delete it. When neither of you is left, it is deleted entirely.
• Whom you have removed from "Your people", whom you follow and who follows you: for as long as you have an account.
• Your calls: that there was a call, who called and when, for as long as your conversation lasts. The camera seconds of the month: until the month ends.
• The seconds from the panic button: 30 days. Who listened to them: one year. Your consent to them: for as long as you have an account.
• A room's transcription, if all of you accepted it: 30 days from the day it was said, and sooner if you delete your account. Who accepted: 30 days. Who read it: one year.
• Who read what was kept with a report: one year.
• Your contacts: one added by hand whom you do not invite is deleted after 30 days; the rest, for as long as you have an account, and after two years unused.
• A gifted plan: for as long as you have it; withdrawn or expired, one year after. A plan gifted in advance to an email that has no account yet, if nobody uses it: 90 days. Your Google Play subscription: for as long as you have an account.
• Who on the team looked at your plan: one year.
• The identifier for phone notifications: until you sign out or, if it is not used, six months.
• The "Notices" tray: one month. Which groups of notices you have turned off: for as long as you have an account.
• The record of emails sent: 90 days; if you had no account, as with the code, the invitation or the computer link, 30 days.
• The waiting list: one year.
• An invitation to try Charla Club: if nobody uses it, 180 days; if it is withdrawn, 90 days.
• Reports: one year, and none is deleted while it is still open. What was kept with a report goes with it.
• Sanctions and bans: three years after they end, to be able to handle a complaint; a ban without an end date, for as long as it lasts.
• Who on the team opened your photo: one year.
• Your hangouts and what hangs from them (who was going, comments, chat, reviews, venue and album photos, hearts, invitations): two years after their date, so that reviews and the organizer's score stay there, as in other hangout apps; a series that stops repeating, 30 days. Your hangout drafts: 90 days untouched.
• Your groups and what hangs from them (members, discussions, comments, albums): for as long as the group lives; closing it deletes everything at once. Group notices: one year. Leadership actions and transfers: one year.
• If you wrote to us from "Write to us": when, 7 days; the message is not kept.
• The server's access log, with your IP: 90 days.
• If you asked us not to write to you: your address, five years, so as not to do it again.
• The proof that we handled a request of yours (a data report, leaving other people's contact lists): one year, with the hash of your email.
• Copyright notices and counter-notices: in our mailbox, for as long as it takes to handle them and to be able to show how they were handled and to apply the repeat-infringer policy.

What has already been deleted disappears from Kamatera's daily copy after 14 days and from the encrypted copy of the person responsible when it expires, at most after 90 days. When a copy is restored, the deletion record stops a deleted account from coming back.

How to delete your account

From "Your account", in the app or on the web: you type the word it asks for to confirm and it is deleted at once. If you are a trained host or part of the team, write to us to do it. You can also write to us at admin@charlaclub.com from your account's email and tell us you want to delete it: we delete it and confirm it to you within 45 days at most, and within one month if you ask under the GDPR (article 12.3). If we ever need more time, we tell you within that period, with the reason.

Your account is deleted from our server and from Clerk, with everything that depends on it: the photo, your profile, your contacts list, your messages, your "I'm going", your hangouts and what you wrote in them, your groups (a group you ran passes to its leadership or closes) and what you uploaded to an album. You also leave other people's contact lists. Afterwards there remain, each until its period ends:

• sanctions, with a hash of your email instead of your name, so that a ban cannot be dodged by signing up again;
• the record of who on the team opened your photo or handled a request of yours, with that same hash;
• your address, if you asked us not to write to you;
• the note that the account was deleted, for 120 days, so that it does not come back when a backup is restored;
• the reports and the agreed mutes you appear in, with what was written in them, for one year, but without your account;
• what the host did with you in a room, for 90 days, and what they noted about the room in their report, which may name you, for one year;
• the messages you wrote that accompany a report, until the report is deleted;
• if we keep a room's chat, what you wrote in it, without your name, until its period ends;
• in a one-to-one conversation, what the other person wrote and the calls between the two of you, without your name, for as long as the other person keeps it;
• in a hangout or group that goes on, that a person who is no longer there made an action or wrote a notice, without your name;
• copyright notices in which you appear, in our mailbox, as said above;
• if we switch it on, the blocking that Spanish law asks of a controller established in Spain (article 32 of Spanish Organic Law 3/2018): what belonged to your account, encrypted with a key only the person responsible holds, set aside from the app and the panel, with no use at all, available only to courts, prosecutors or data protection authorities, for six months, after which it destroys itself.

Nothing linked to a minor's email remains, except the deletion note for those same 120 days.

Your rights

We give these rights to everyone who uses Charla Club from the United States and Puerto Rico, whatever state or territory you live in, so you do not have to work out which law covers you. They include those of the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and those of the comprehensive privacy laws of the other states (among them Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), and those of the GDPR. By writing to admin@charlaclub.com from your account's email you can ask, at any time:

• to know and to access: what personal information we have about you, by category and the specific pieces, where it came from, why we use it, to whom we disclose it, and to receive a copy (GDPR article 15);
• to correct what is wrong (article 16);
• to delete it (article 17), as said under "How to delete your account";
• to take it with you, in a portable and machine-readable format (article 20);
• to opt out of the sale or sharing of your personal information, of targeted advertising and of profiling: we do none of these, so there is nothing to opt out of, and if you ask anyway we confirm it to you in writing;
• to limit the use of your sensitive personal information: we use it only for what you asked (your gender for the switch you turned on, your location for the search you requested, your messages to deliver them and keep the service safe), which the state laws allow without a separate request; if you ask us to limit it further, we tell you what we can stop and we stop it;
• to object to processing based on legitimate interest, such as the access log, the text filter, the entry-code reader's metrics or another person's contacts list you are in (article 21): we tell you what happens and, if there is no overriding reason, we stop;
• to withdraw your consent where you gave it (gender, transcription, "Near me", the waiting list, the panic-button seconds), without affecting what came before;
• not to be discriminated against for exercising any of these rights: your price, your features and your treatment do not change because you asked.

We check that it is you by your account's email, never asking for an ID document, and we ask nothing more than what we need to find your data. You can also ask through an authorized agent: we need to see that you gave them permission and we confirm it with you by email before acting. We answer within 45 days at most; if we need up to 45 more, we tell you why within the first 45. If you ask under the GDPR, we answer within one month (article 12.3). Your first two requests in any twelve-month period are free; a copy you ask for more often may be charged at cost, or we may tell you why we are not giving it, as the law allows.

If we say no, or you disagree with our answer, you can appeal: write back to admin@charlaclub.com saying that you appeal, within 45 days of our answer. A different person reviews it whenever possible, and we answer in writing within 45 days, telling you what we decided, why, and that you can take it to your state's Attorney General if you still disagree. You can also complain at any time to the California Privacy Protection Agency or the California Attorney General if you live in California, to the Attorney General of your own state, and, because we are established in Spain, to the Spanish Data Protection Agency, which is our supervisory authority under the GDPR. And you can go to court.

Minors

Charla Club is only for people aged 18 or older, and it is not directed to children. We do not knowingly collect personal information from anyone under 13 (the Children's Online Privacy Protection Act) or from anyone under 18, and we do not sell or share the personal information of anyone, so also not of anyone under 16. Where Google Play gives our app an age signal for the Google account that installs it, we use it: if Google tells us the account belongs to someone under 18, the app does not let that person in, and we receive from Google only that signal, not your date of birth or your documents. If someone looks underage, their account is suspended until they prove their age by showing their ID document in person, without any copy being made: only the result is recorded. If they do not prove it, the account is deleted, and nothing linked to a minor's email remains. If a parent or guardian tells us that a child has an account, we delete it the same way. If we detect child sexual abuse material, we keep it only to hand it to the authorities, we report it to the National Center for Missing and Exploited Children as the law requires, and we close the account.

Cookies

What the site and the app store in your browser or on your phone is in the cookie policy.

If this text changes

Each version has its date and stays published at its address. If what we keep, why, or who helps us changes, we tell you in the app and by email before it comes into force. We review this notice at least once every twelve months. This notice is published in English and in Spanish; both say the same, and if a difference appears, the English version governs, except for those who use Charla Club from Puerto Rico, for whom the Spanish version governs.