Privacy Policy

1. Who we are

Charky Labs Pvt Ltd operates Character XYZ Academy. We are the data fiduciary under India's Digital Personal Data Protection Act, 2023, and the controller under the UK and EU GDPR where those apply to you.

Charky Labs Pvt Ltd, 4 Thendral Nagar, Vilankurichi P.O., Coimbatore 641035, Tamil Nadu, India. Email hello@character.xyz. Telephone +91 72005 80713.

2. What we collect, and when

We collect only what the programme needs. There is no account to create and nothing is collected before you choose to type it.

• When you complete the enquiry step: your name, email address, WhatsApp number, the name of your business, and your answer to what you would hand over to an agent first.
• When you pay: the payment identifier, the amount, the currency and the coupon code if you used one. We never see or store your card, UPI or bank details. Those go directly to our payment gateway.
• Automatically, on every visit: the pages you view and the technical information any web server receives, including your IP address and browser user agent.
• Automatically, on every visit: a random identifier that your browser keeps for that tab and nothing else, so that a visit, an enquiry and a payment can be counted as one journey rather than three separate ones. It is not a cookie, it is erased when you close the tab, and it cannot recognise you on a later visit, in another tab, or on another site.
• If you book an onboarding call: whatever the scheduling provider collects to make the booking.

3. Why we hold it, and for how long

Your enquiry details are used to follow up about the programme you enquired about, and to run the programme if you enrol. Your payment record is used to give you a seat, answer questions about the charge, and meet accounting and tax obligations.

Enquiries that do not become enrolments are deleted within twelve months. Enrolment and payment records are kept for eight years, which is what Indian tax law requires of them. Nothing is kept longer because it might be useful one day.

The visit counts described above are kept for ninety days and then deleted. They record the page, the tab identifier, the site you arrived from, the campaign tag on the link if you arrived from one of our advertisements, and, where there was one, the payment reference. They deliberately hold no name, email address, phone number, IP address or browser user agent, so they can tell us how many people reached the payment step without telling us who they were.

The campaign tag is a label we write into our own advertisement links, such as the name of the campaign the link belongs to. Everyone who clicks the same advertisement carries the same label, so it tells us which advertisement worked and nothing about you. Where an advertising network adds its own per-click identifier to the link, we discard it rather than store it, because that one would be capable of recognising you.

4. Advertising, measurement, and what we send to Meta

This site runs advertising measurement, and this section describes exactly what that means rather than gesturing at it. It applies to the programme pages only. The privacy policy, terms and contact pages carry no tracking of any kind.

We advertise these programmes on Facebook and Instagram. To know which advertisements lead to enrolments rather than guessing, we report three moments back to Meta: that a page was viewed, that somebody completed the enquiry step, and that somebody paid.

These are reported in two ways, because one of them is unreliable. The first is the Meta pixel, a script in your browser, which sets a cookie named _fbp to recognise the same browser across visits and reads a cookie named _fbc if you arrived from an advertisement. The second is Meta's Conversions API, which sends the same three events directly from our server, because browsers, privacy settings and ad blockers frequently stop the first one from sending anything at all. Both carry the same identifier for a given event so that Meta counts it once and not twice.

The server-side report includes your email address, phone number, name and country. Before any of it leaves our server it is hashed with SHA-256, which is a one-way transformation: Meta receives a fingerprint that can be compared against a fingerprint it already holds, and cannot be turned back into your email address. Your IP address and browser user agent are sent unhashed, because Meta requires them in that form and they cannot be usefully hashed anyway. We do not send your business name, your answer about what you would hand over, or anything you say to us afterwards.

Meta uses this to attribute the enrolment to an advertisement and to find people who resemble our customers. Meta's own handling of it is governed by their policies, not this one.

You can stop the browser half by using a browser that blocks it, an ad blocker, or your browser's own tracking protection; many already do this by default. You can limit what Meta does with the server half through the ad preferences in your Facebook or Instagram account. You can also ask us directly to stop sending your data, using the contact details in section 10, and we will exclude you.

5. What we never do

• We do not sell your personal data to anyone, for any price, in any form.
• We do not share it with data brokers or list resellers.
• We do not use anything you tell us to train a machine-learning model.
• We do not advertise to, profile, or track anyone we know to be a child. The programme is sold to adults running businesses.

6. Who else processes it

We use these services to run the programme. Each acts on our instructions and may use your data only to provide their service to us.

• Razorpay, our payment gateway, which takes the payment and holds the card details we never see.
• Meta Platforms, for the advertising measurement described in section 4.
• Vercel, which hosts this website and processes the technical request data any host does.
• Discord, where a new enquiry and a paid seat are posted into a private internal channel so a person sees it immediately. That message contains your name, email, WhatsApp number and business name.
• WhatsApp, operated by Meta, where the cohort group runs. See section 7 for what the other participants can see.
• Zoom, which hosts the live sessions and produces the recordings.
• Calendly, if you book an onboarding call.
• Google Workspace, for the email we send you.

7. The cohort group, and being in a recording

Two parts of the programme involve other people seeing something of yours, and both are worth saying plainly rather than leaving you to discover them.

The cohort runs a WhatsApp group. If you join it, the phone number you enrolled with becomes visible to every other participant in that group, along with your WhatsApp display name and picture. That is how the group works and we cannot make it otherwise. Joining is optional and you can leave at any time, or ask us not to add you at all and we will not. WhatsApp is operated by Meta and your use of it is governed by their terms, not ours.

The live sessions are recorded, and the recording is shared with the cohort. If you speak, ask a question, turn your camera on or share your screen, you will be in the recording that other participants receive and keep. If you would rather not be, you can keep your camera off and put your questions in the chat or the group instead, and we will not identify you by name in the recording.

We keep session recordings for as long as we run the programme they belong to, and no longer than three years. The WhatsApp group is closed and deleted when the cohort finishes.

8. Where it goes

We are in India and our hosting is provided by Vercel. Some of the services above are operated from the United States and elsewhere, so your data crosses borders. Where the UK or EU GDPR applies to you, those transfers rely on the standard contractual clauses those providers publish. If you would rather your data did not leave a particular jurisdiction, we cannot offer the programme on that basis, and you should not enrol.

9. Your rights

Whoever and wherever you are, you can ask us to show you what we hold, correct it, delete it, or stop using it for advertising measurement. We will do it, and we will not ask you to justify the request.

Under the DPDP Act you may also nominate somebody to exercise these rights if you cannot. Under the UK and EU GDPR you may additionally object to processing, ask for your data in a portable form, and complain to your national supervisory authority. In India you may complain to the Data Protection Board.

10. How to reach us, and how to complain

Write to privacy@character.xyz for anything about your data, or academy@character.xyz for anything about the programme. We acknowledge within two working days and resolve within fifteen, which is the period India's IT Rules 2021 set for a grievance.

Our Grievance Officer, as India's IT Rules 2021 and the DPDP Act require to be named, is Zeno Saviour, reachable at privacy@character.xyz or by post at 4 Thendral Nagar, Vilankurichi P.O., Coimbatore 641035, Tamil Nadu, India.

This notice is available in Hindi and Tamil on request, as the DPDP Act entitles you to ask.

11. Changes

When this policy changes materially, the date at the top of this page changes with it. If a change affects what we send to a third party, we will say so plainly rather than relying on you noticing the date.

12. If you bought a single live session

This section applies where you have bought a seat at one live session sold on its own, such as Agents, Live. Sections 1 to 11 otherwise apply to you in full, and this section says where they do not.

There is no recording. A single live session is not recorded, so nothing in section 7 about being in a recording, about what other participants receive and keep, or about how long we hold recordings applies to you. There is also no cohort WhatsApp group and no onboarding call, so the parts of sections 6 and 7 covering those do not arise. Zoom still hosts the session itself.

The businesses worked on during the session are volunteers, chosen in advance and asked first. We read what people wrote on the enrolment form about what they would like an agent to do, pick two or three, and write to those people to ask whether we may use their business on the call. We prepare only the ones who say yes. If you have not agreed, your business is not named, shown or worked on during the session, and what you wrote on the form is used only to run your booking and to answer you.

Other attendees can see the name your video app displays for you and anything you type into the chat, in the same way as anyone else on a group call. We do not publish an attendee list.

We keep what you send us about your business for as long as we run this series of sessions, and no longer than three years, on the same footing as everything else in section 3.