Privacy Policy

Effective Date: October 25, 2025

1. Introduction

CHALC Social Limited respects your privacy and complies with POPIA (2013), GDPR,

COPPA, and CCPA where applicable.

This Policy explains how we collect, use, store, and protect your data.

2. Information We Collect

• Name, email, phone (optional), date of birth

• Guardian name/email (for users 13–17)

• Videos, images, challenge submissions

• Device type, IP address (anonymised), analytics

• Consent records (timestamp, status)

2.1 Data Classification (for App Stores)

Data Type	Collected	Linked to Identity	Purpose	Shared With
Name	Yes	Yes	Account	S3 Amazon (If Uploaded)
Email	Yes	Yes	Login Alerts	None
Phone	Optional	Yes	2FA	None
Guardian Info	Yes	Yes	Consent	None
Videos/Images	Yes	Yes	A	S3 Amazon
Device IP	Yes	No	Analytics	Firebase
Crash Logs	Yes	No	S	Firebase

3. Children’s Data & Consent

• Users 13–17: Verifiable guardian consent via email link

• Users under 13: Prohibited. Accounts deleted immediately

• Guardians can withdraw consent or request deletion: [email protected]

4. How We Use Information

• Operate the App

• Verify age and consent

• Host videos via S3 Amazon API

• Moderate content

• Send safety alerts

• Improve performance (anonymised)

5. Sharing of Information

• S3 Amazon (video hosting) — under S3 Amazon ToS

• Firebase (analytics/crash reporting) — anonymised

• Legal authorities (if required)

• No sale of data. No advertising use.

5.1 S3 Amazon API Disclosure

By uploading a video, you agree to S3 Amazon’s Terms

(https://docs.aws.amazon.com/managedservices/latest/userguide/key-terms.html) and

S3 Amazon may collect: video metadata, IP, watch time.

Upload requires explicit opt-in. No auto-upload.

5.2 Community Marketing Sharing

If you opt in during Community join, your uploaded content (videos, images, username) may

be shared with the Community Owner for external promotional use. No contact info

(email/phone) is shared. You can revoke consent anytime.

6. Data Retention & Deletion

• Active account: Retained as needed

• Inactive: Deleted after 12 months

• Deletion request: In-app (Settings > Delete Account) or email

• Response: Within 30 days

• Confirmation sent via email

7. Security

• Encryption in transit (TLS) and at rest (AES-256)

• Access controls, 2FA for staff

• Regular audits and breach response (POPIA §22)

8. Your Rights

• Access, correct, delete data

• Withdraw consent

• Object to processing• Lodge complaint: Information Regulator (SA) or EU DPA

9. Analytics & Cookies

• Firebase Analytics & Crashlytics (anonymised)

• No tracking cookies

• No cross-app tracking

10. International Transfers

Data may be transferred to the US ( S3 Amazon , Firebase) under POPIA §57 adequacy or

Standard Contractual Clauses.

11. Updates

Changes posted at https://chalc.world/privacy with in-app notice.

12. Contact

Support: [email protected]

Address: 11 Erica Heath, Brackenridge, Plettenberg Bay, 6600