Privacy Policy

Effective Date: October 25, 2025

1. Introduction

CHALC Social Limited respects your privacy and complies with POPIA (2013), UK GDPR, the Data Protection Act 2018, GDPR (EU), COPPA, CCPA/CPRA, and other applicable US state privacy laws where applicable.

This Policy explains how we collect, use, store, and protect your data.

2. Information We Collect

• Name, email, phone (optional), date of birth

• Guardian name/email (for users 13–17)

• Videos, images, challenge submissions

• Device type, IP address (anonymised), analytics

• Consent records (timestamp, status)

2.1 Data Classification (for App Stores)

Data Type	Collected	Linked to Identity	Purpose	Shared With
Name	Yes	Yes	Account	S3 Amazon (If Uploaded)
Email	Yes	Yes	Login Alerts	None
Phone	Optional	Yes	2FA	None
Guardian Info	Yes	Yes	Consent	None
Videos/Images	Yes	Yes	Hosting & Moderation	S3 Amazon
Device IP	Yes	No	Analytics	Firebase
Crash Logs	Yes	No	Safety & Improvement	Firebase

3. Children’s Data & Consent

• Users 13–17: Verifiable guardian consent via email link

• Users under 13: Prohibited. Accounts deleted immediately

• Personal information collected from users under 16 is treated as sensitive personal information under CCPA/CPRA.

• Guardians can withdraw consent or request deletion: [email protected]

4. How We Use Information

• Operate the App

• Verify age and consent

• Host videos via S3 Amazon API

• Moderate content

• Send safety alerts

• Improve performance (anonymised)

5. Sharing of Information

• S3 Amazon (video hosting) — under S3 Amazon ToS

• Firebase (analytics/crash reporting) — anonymised

• Legal authorities (if required)

• We do not sell or share your personal information for cross-context behavioral advertising or any other purposes as defined under CCPA/CPRA. No advertising use.

5.1 S3 Amazon API Disclosure

By uploading a video, you agree to S3 Amazon’s Terms (https://docs.aws.amazon.com/managedservices/latest/userguide/key-terms.html) and Privacy Policy.

S3 Amazon may collect: video metadata, IP, watch time.

Upload requires explicit opt-in. No auto-upload.

5.2 Community Marketing Sharing

If you opt in during Community join, your uploaded content (videos, images, username) may be shared with the Community Owner for external promotional use. No contact info (email/phone) is shared. You can revoke consent anytime.

6. Data Retention & Deletion

• Active account: Retained as needed

• Inactive: Deleted after 12 months

• Deletion request: In-app (Settings > Delete Account) or email

• Response: Within 45 days (or as required by applicable law)

• Confirmation sent via email

7. Security

• Encryption in transit (TLS) and at rest (AES-256)

• Access controls, 2FA for staff

• Regular audits and breach response (POPIA §22)

8. Your Rights

• Access, correct, delete data

• Withdraw consent

• Object to processing

• Lodge complaint: Information Regulator (SA), the UK Information Commissioner’s Office (ICO) for UK residents, or EU DPA as applicable.

Additional Rights for California Residents (and Residents of Other US States with Similar Privacy Laws) under CCPA/CPRA:

In addition to the rights above, you have the right to:

• Know what personal information we have collected about you (categories and specific pieces).

• Delete your personal information.

• Correct inaccurate personal information.

• Opt out of the sale or sharing of your personal information (we do not sell or share for targeted advertising).

• Limit the use and disclosure of your sensitive personal information.

• Not be discriminated against for exercising these rights.

To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within 45 days (or as extended by law where permitted).

9. Analytics & Cookies

• Firebase Analytics & Crashlytics (anonymised)

• No tracking cookies

• No cross-app tracking

10. International Transfers

Data may be transferred to the US (S3 Amazon, Firebase) under appropriate safeguards compliant with POPIA §57, UK GDPR (including the UK International Data Transfer Agreement or UK Standard Contractual Clauses), GDPR Standard Contractual Clauses, or other approved mechanisms where required.

11. Updates

Changes posted at https://chalc.world/privacy with in-app notice.

12. Contact

Support: [email protected]

Address: 11 Erica Heath, Brackenridge, Plettenberg Bay, 6600