Privacy Notice

1. What we collect

• Your account: your name and email address, from your Character XYZ account, which you use to sign in.
• Your partner record: your company, contact person and email, region, rank, status, who recruited you, area roles, credentials and the history of changes to them.
• What you submit: onboarding requests, including the prospective client's company, contact name and email, the products and trial asked for, and your note.
• Programme activity: points, badges, achievements logged for you, clients credited to you (by name and the products they hold, never their people or their data), monthly scorecards, and the ratings and testimonials your clients give about you.
• Your acceptance of the Partner Programme Agreement: which version, when, through which screen, and the network address and browser it came from.
• For clients you introduce: how their invitation is progressing (delivered, opened, accepted), as section 3 describes.
• Technical data: the session cookie that keeps you signed in, and server logs of requests (address, time, page) kept for security.

2. Why we use it

• To run the partner programme: decide requests, credit clients, calculate ranks, points and shares, and pay you.
• To communicate with you: requests, decisions, scorecards and notices, sent by email from onboarding@character.xyz.
• To ask your clients for a review of your work, as the programme describes.
• To keep Charter secure, prevent fraud and abuse, and keep evidence of what was agreed.
• To meet our legal, tax and accounting obligations.

We process this data to perform our agreement with you, for the legitimate uses the Digital Personal Data Protection Act, 2023 allows, to comply with law and, where those do not apply, with your consent. For partners in the European Economic Area or the United Kingdom, the legal bases are performance of a contract, our legitimate interests in running the programme securely, and legal obligation.

3. Contact details you give us about others

When you submit a prospective client's contact details, you confirm that you are allowed to share them with us for that purpose and that you have told the person. We use them only to evaluate and onboard that client, and to invite them.

When we invite that client, we record whether the invitation email was delivered or bounced (reported by our email provider) and each time the invitation link is opened on our site, with the time and the browser used. We do not put tracking pixels in our emails. The partner who introduced the client sees only the stage reached and its date; the browser details are seen only by Charky Labs staff, to follow up at the right moment.

4. Who we share it with

• Amazon Web Services, which hosts the database behind Charter in its Mumbai region (India).
• Vercel, which serves Charter's pages from its Mumbai region.
• Resend, which sends Charter's email.
• Other partners see only what the leaderboard shows: your company name, rank, badge and points. Published testimonials appear only with the client's consent.
• Professional advisers, auditors, payment and tax authorities, and anyone the law requires us to disclose to.

We do not sell personal data, and Charter runs no analytics, advertising or tracking of any kind.

5. Transfers outside India

Charter's data is stored in India. Some service providers may process it outside India, under contracts that require them to protect it, and only to countries to which the law permits transfer. For partners in the European Economic Area or the United Kingdom, transfers rely on the appropriate safeguards those laws require.

6. How long we keep it

We keep your partner record and programme activity for as long as you are a partner and for eight years after, because they support payments and tax records the Companies Act, 2013 and tax law require us to keep. Acceptances of the Partner Programme Agreement are kept for the same period, since they are the evidence of what was agreed. Onboarding requests are kept with your partner record. Server logs are kept only as long as our hosting providers retain them for security.

7. Cookies

Charter sets only cookies it needs to work: `charter-session`, which keeps you signed in and ends with your browser session, and, for Charky Labs staff only, `charter-view-as`, which lasts at most two hours while they view Charter as a partner. There are no analytics or advertising cookies.

8. Your rights

You may ask to access, correct, complete, update or erase your personal data, to withdraw a consent you gave, and to nominate someone to exercise your rights if you die or become incapable. Partners in the European Economic Area or the United Kingdom may also object to or restrict processing and ask for portability. Write to privacy@character.xyz. We may need to keep some data where the law requires it, and will tell you if so.

9. Security

Charter is reachable only by signed-in, authorised people; every request for data is checked by our identity service; data is encrypted in transit; only authorised staff can administer the programme, and their changes to partner records, and each time they view Charter as a partner, are recorded. No system is perfectly secure, and we will tell you and the authorities as the law requires if a breach affects your data.

10. Grievance Officer

Our Grievance Officer is Zeno Saviour, Charky Labs Private Limited, 4 Thendral Nagar, Vilankurichi P.O., Coimbatore 641035, Tamil Nadu, India, email privacy@character.xyz. We acknowledge a grievance within 24 hours and resolve it within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India or, in the European Economic Area or the United Kingdom, to your local supervisory authority.

11. Changes

We will update this notice when what Charter does changes, and show the date here. This version is dated 5 October 2026.