Introduction
CharaClub ("we", "us", or "our") respects and protects your privacy. This Privacy Policy ("this Policy") explains how we collect, use, store, and share your personal information when you use CharaClub ("the Service"), as well as your rights regarding your data.
Please read this Policy carefully before using our Service. By using our Service, you acknowledge that you have read and agree to this Policy. We may update this Policy from time to time, and any material changes will be communicated to you in advance via email.
1. Data Controller
The data controller for this Service is:
- Legal Entity Name: CharaClub (Individual Developer)
- Contact Email: characlub@163.com
- Data Protection Officer: No dedicated DPO has been appointed at this time
2. Personal Information We Collect
2.1 Information You Provide
- Account Information: Email address, password (encrypted storage), account settings preferences.
- Payment Information: Transaction amount, payment status, purchased product information. We do not store complete payment card numbers — payment data is processed exclusively by our PCI-DSS compliant payment processor.
- Feedback and Communication: Emails, tickets, and feedback content you send to us.
2.2 Information We Automatically Collect
- Service Logs: Device model, OS version, browser version, error logs, operation records (for troubleshooting and service optimization).
- IP Address: When you log in or use features requiring internet connectivity, we record your IP address for security verification.
- Cookie Data: Used to maintain login sessions and preferences (see Section 4).
2.3 Your Published Creative Content
As a content community platform, character cards, skills, conversations, and images you publish on CharaClub are public content that may be viewed, favorited, and interacted with by other users. We do not proactively review or modify legitimate content you publish, but reserve the right to handle violations in accordance with our Acceptable Use Policy.
3. How We Use Your Personal Information
| Purpose of Use | Legal Basis |
|---|---|
| Account registration, login, and identity verification | Contract performance |
| Billing and payment processing | Contract performance |
| Account security and fraud prevention | Legitimate interest |
| Service notifications (billing, security, policy updates) | Legitimate interest |
| Customer support and issue resolution | Contract performance / Legitimate interest |
| Product optimization and analysis (anonymized data) | Legitimate interest |
| Legal compliance | Legal obligation |
We may aggregate or de-identify data for statistical analysis. Such data cannot be used to identify specific individuals.
5. Sharing and Disclosure of Personal Information
We do not sell your personal information, including "sale" as defined by applicable laws (such as CCPA). We only share your information in the following circumstances:
- Payment Processors: Payment card data is processed exclusively by our PCI-DSS compliant payment processor and is not stored on our servers.
- Cloud Service Providers: Subject to confidentiality agreements, used for infrastructure hosting.
- Legal and Regulatory Requirements: As required by law, court orders, or legitimate requests from authorities.
- Business Transactions: In cases of mergers, acquisitions, etc., with advance notice and ensuring continued protection obligations.
- With Your Consent: For other purposes, with your explicit prior consent.
6. Data Security Measures
- Transmission Encryption: HTTPS/TLS encrypted transmission.
- Storage Security: Sensitive data such as passwords is encrypted or hashed.
- Access Control: Principle of least privilege. Only authorized personnel can access necessary data.
- Regular Security Assessments: We continuously evaluate and improve security measures.
In the event of a security incident affecting your rights, we will notify you and relevant regulatory authorities within 72 hours of discovery. Please keep your account credentials safe and do not share them with others.
7. Personal Information Retention Period
| Data Type | Retention Period | Action Upon Expiry |
|---|---|---|
| Account Information | During active period; 90 days after account deletion | Delete or anonymize |
| Transaction Records | As required by regulations, typically 5 years | Delete or archive |
| Service Logs | 12 months | Securely delete |
| Creative Content | During account lifetime; deleted together with the account | Delete |
You may back up or export your creative content at any time before account deletion.
8. Your Data Rights
To exercise the following rights, please contact us. We will process your request within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete information |
| Right to erasure | Request deletion of data under specific conditions |
| Right to restriction | Pause data processing under specific circumstances |
| Right to portability | Obtain your data in machine-readable format |
| Right to object | Object to processing based on legitimate interest or marketing |
| Right to withdraw consent | Withdraw consent for processing based on consent |
| Right to lodge complaint | You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data properly |
If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.
9. Marketing Communications and Unsubscription
We do not send unsolicited marketing information. If you choose to subscribe to our membership service, we will only send service notifications related to your subscription, including billing, security, and policy updates.
You may contact us at any time to unsubscribe from any non-essential service notifications.
10. Cross-border Data Transfer
Our servers may be located inside or outside of China. When transferring data across borders, we ensure data security through the following measures:
- Signing data processing agreements that comply with applicable laws.
- Transferring only to recipients with equivalent protection levels.
- Implementing necessary technical and organizational security measures.
11. Protection of Minors
This Service is intended for users aged 18 and above. We do not knowingly collect information from minors below this age. If you believe your child has provided us with information, please contact us immediately, and we will delete it as soon as possible.
12. Third-Party Links and Services
This Service may contain links to third parties (such as friendly links to charaimage.com, charastudio.net and other sister projects) or integrate with third-party services. This Policy only applies to information we collect directly. We are not responsible for third parties' data practices, and we recommend reviewing their policies before use.
13. Changes to This Policy
If material changes occur, we will notify you via email at least 15 days in advance and update the "Last updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
14. Contact Us
If you have any questions about this Policy or data processing, please contact us:
- Official Website: www.characlub.com
- Privacy Contact Email: characlub@163.com
- Customer Support Email: characlub@163.com