Privacy Policy — Charlora

Last updated: July 8, 2026

This Privacy Policy explains what information Charlora — operated by Moonshadow Strategies LLC, an Arizona limited liability company based in Arizona, USA ("we," "us," "our") — collects, how we use it, your choices, and your rights, including specific rights for residents of California, the EU, and the UK.

1. Information We Collect

Account information: Email address and password (stored securely; we don't have access to your plaintext password).

Photos you scan: Images you take or upload for analysis. These are sent to our AI processing provider to generate your Results and are kept in your scan history so you can look back at past scans.

Scan history and results: The item/shelf details, verdicts, price estimates, and other Results generated from your scans.

Payment information: If you subscribe, payment is handled entirely by Stripe. We receive confirmation of payment and subscription status, but we do not receive or store your full card number.

Usage data: Basic information like scan counts (to enforce plan limits) and timestamps.

Device / log data: Standard technical information our hosting provider records to run the Service securely (e.g., IP address, browser type, request timestamps).

2. How We Use Your Information

  • To provide the Service — running your scans and returning Results
  • To manage your account, subscription, and billing
  • To enforce free-trial and plan usage limits
  • To improve, troubleshoot, and secure the Service
  • To communicate with you about your account (e.g., billing issues, service changes)
  • To comply with legal obligations

We do not sell or "share" (as those terms are defined under the California CCPA/CPRA) your personal information or your photos, we don't run ads in the Service, and we don't use your photos to train AI models.

3. Legal Bases (EU/UK Users)

If you're in the EU/EEA or UK, we rely on the following lawful bases under the GDPR/UK GDPR:

  • Contract — to provide the Service you signed up for (accounts, scans, billing).
  • Legitimate interests — to secure, troubleshoot, and improve the Service, and to prevent abuse.
  • Legal obligation — to keep tax/payment records and respond to lawful requests.
  • Consent — where required (e.g., for optional marketing emails, if we ever add them). You can withdraw consent at any time.

4. Who We Share Information With (Subprocessors)

We share personal information only with vendors that help us run the Service, under confidentiality and data-protection obligations:

  • Anthropic, PBC (United States) — AI processing of the photos you submit, to generate Results.
  • Stripe, Inc. (United States) — payment processing and subscription management.
  • Supabase, Inc. (United States) — database, authentication, and file storage for your account, scan history, and photos.
  • Lovable / Cloudflare — application hosting and edge network.

We may disclose information if required by law, court order, or valid legal process, or to protect the rights, safety, or property of us or others.

5. International Data Transfers

We're based in the United States and our subprocessors listed above primarily process data in the United States. If you access the Service from outside the U.S. (including from the EU/EEA or UK), your information will be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards for those transfers (such as the Standard Contractual Clauses adopted by the European Commission and the UK Addendum) as offered by our subprocessors.

6. Data Retention

We retain your account information and scan history for as long as your account is active. You can delete individual scans in-app at any time, and you can request full account deletion — we'll delete your account data within 30 days, except records we're required to keep for legal, tax, or fraud-prevention purposes (e.g., billing records).

7. Your Choices & Rights

Everyone using the Service can:

  • View and delete individual scans from your history in-app.
  • Request full account deletion at any time.
  • Cancel your subscription at any time; this stops future billing but doesn't automatically delete your account or data.

California residents (CCPA/CPRA) — you have the right to (a) know what personal information we collect and how it's used, (b) access a copy of your personal information, (c) request deletion, (d) request correction of inaccurate information, and (e) not be discriminated against for exercising these rights. We do not sell or "share" personal information for cross-context behavioral advertising, and we do not process "sensitive personal information" for purposes that would trigger the right to limit under the CPRA.

EU/EEA and UK residents (GDPR / UK GDPR) — you have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data-protection supervisory authority.

How to exercise your rights. Email support@charlora.com from the address on your account. We'll respond within the time required by applicable law (generally 30–45 days). You may use an authorized agent; we may need to verify their authority and your identity.

8. Cookies & Local Storage

We use only strictly necessary browser storage (cookies and localStorage) required for the Service to function — for example, keeping you signed in, remembering your recent scans, and CSRF protection. We do not use advertising cookies, cross-site tracking, or third-party analytics that build a profile of you. Because we only use essential storage, no cookie-consent banner is required in most jurisdictions.

9. Security

We take reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS/TLS), hashed passwords via our authentication provider, and access controls on our database. No system is 100% secure, and we can't guarantee absolute security. If a security incident affects your personal information, we will notify affected users and, where required, regulators, in line with applicable law.

10. Children's Privacy

The Service is not intended for anyone under 18. We don't knowingly collect information from minors. If you believe a minor has provided us with personal information, contact us and we'll delete it.

11. Do Not Track

The Service does not respond to browser "Do Not Track" signals, because we don't engage in cross-site tracking to begin with.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated in-app or by email at least 14 days before they take effect. Continued use after the effective date means you accept the updated policy.

13. Contact

Questions about this policy, your data, or to exercise your rights: support@charlora.com