Privacy Notice

Charlie Miller trading as Phantiq Studios is the controller for personal information processed to provide Charlie.ai. Contact: charlie.ai@phantiqstudios.com, 138 Rowney Avenue, CB10 2YE, United Kingdom.

Information we process

We process account and organisation details, authentication and security records, plan and payment status, feature usage, first-touch campaign or referral labels, AI model and token-cost metadata, support communications, business-profile details, and the customer opportunity information you choose to enter, such as names, contact details, enquiry text, quote context, follow-up drafts, and recorded outcomes. If you activate a private Charlie forwarding address, we process the selected emails you forward to it, including sender and recipient addresses, subject, bounded plain-text body, message identifiers and time. We do not retain the raw MIME message, HTML body or attachments through that forwarding route. If you connect Google Workspace, Microsoft 365, HubSpot or Xero, we also process the connected account identifier, encrypted access credentials, selected inbox message and thread data, recipients, subjects, bounded message bodies, provider identifiers, synchronisation state, approved calendar-event details, exact CRM contact updates, and draft-invoice details. Charlie-native quote and invoice drafts may also contain seller and customer contact details, addresses, dates, line items, prices, tax values, notes, terms, recorded quote decisions, business logos, payment instructions, private generated PDF artifacts, and approved email-attachment details. Existing Workspace content is also retained where you use those advanced features. The AI usage ledger intentionally excludes raw prompts and responses.

Why we process it

We use information to perform our contract with you, operate and secure Charlie.ai, enforce plan allowances, process payments, respond to support and legal requests, prevent abuse, and improve reliability. You are responsible for having a lawful basis to enter your customers' personal information and use it for follow-up. Where our processing is based on legitimate interests, those interests are running a secure, useful service and understanding aggregate product performance.

Campaign and referral measurement

When you follow a Charlie.ai campaign or partner link, we may store bounded source, medium, campaign, content, partner-code, landing-page-path, and referring-domain labels against the organisation created at signup. This lets the owner measure registrations and activation without installing third-party behavioural tracking. We do not store a full referrer URL or your browsing history for this purpose.

Who receives information

We use carefully selected service providers for hosting, database operations, storage, payments, connected email/calendar access, and AI processing. This currently includes Railway, Cloudflare, Stripe, Google, Microsoft, HubSpot or Xero where you connect them, and configured AI providers such as OpenAI or Anthropic. We share only what is needed for the relevant service and do not sell personal information. Customer opportunity context may be sent to the configured AI provider when you ask Charlie to prepare a draft or enable automatic draft preparation.

International transfers

Some providers may process information outside the United Kingdom. Where required, we rely on an applicable adequacy decision or approved contractual safeguards.

Retention

We keep account, customer-opportunity, connected-message, and Workspace information while your account is active and for only as long afterward as needed for legal, security, backup, and dispute purposes. Disconnecting immediately removes Charlie.ai's stored OAuth access and refresh credentials; imported records and action receipts remain subject to the normal account retention and deletion process. Charlie only reports a connection as disconnected after it has confirmed provider access is already invalid or has been revoked; if that confirmation fails, the connection remains visible and requires attention. Turning off a private forwarding address immediately prevents new delivery to that address, while already imported records remain subject to the normal retention and deletion process. A self-service deletion request revokes connected-service access immediately, then begins a 14-day grace period for the Charlie.ai account and stored customer content. Cancelling the deletion does not silently restore provider access; the service must be reconnected. Payment records may be retained for longer where tax or accounting law requires it.

Google API data

Charlie.ai's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google Workspace data is used only to provide and improve the user-facing connected-email and calendar features you request, protect those features, and meet legal obligations. It is not used for advertising, sold, or used to train general-purpose AI models. Human access is prohibited except when you give specific consent for support, when required for security or legal reasons, or where the data has been aggregated and anonymised.

Your rights

Depending on the law that applies, you may ask for access, correction, deletion, restriction, portability, or objection. You can export account data and request deletion from Account. You may also complain to the UK Information Commissioner's Office.

Automated processing

Charlie.ai uses AI to prepare customer follow-up drafts and other reviewable outputs. Connected inbox checks, reply detection, and optional draft preparation can run automatically. Charlie sends a customer email, creates a calendar event, updates a CRM contact, creates a draft invoice, or emails a quote/invoice PDF only after an authorised user approves the exact persisted content and attachment; the provider receipt is then recorded. Quote acceptance or decline is recorded from the user's instruction and is not inferred by Charlie. Generated Workspace resources and other consequential actions retain their approval controls. We do not use solely automated processing to make legal or similarly significant decisions about you.

Contact

Send privacy questions or rights requests to charlie.ai@phantiqstudios.com. We may update this notice as Charlie.ai adds capabilities; material changes will be clearly communicated.