Charmy Privacy Policy
Effective date
Effective 25 August 2026. Last updated 25 August 2026.
About this policy
Charmy ("we", "us") provides staff management software — the Charmy web dashboard, Charmy Manager app, and Charmy Kiosk app — to businesses ("employers") in the Philippines. This policy explains what we collect, why, and your choices. We process personal data under the Data Privacy Act of 2012 (RA 10173). For employee data, the employer is the data controller and Charmy is the processor acting on the employer's instructions.
What we collect
Account data includes the business owner's or managers' name, email, and login credentials. Employee records entered by the employer include names, contact numbers, roles, pay rates, schedules, and leave. Attendance data includes clock-in and clock-out events, timestamps, the kiosk device that recorded them, and one selfie photo per clock-in used solely so managers can verify who started a shift. We do not perform facial recognition; selfies are stored as images, not biometric templates. Employee kiosk PINs are stored only as salted hashes, so we cannot read them. We also collect technical logs necessary to operate and secure the service.
What we don't do
We do not sell personal data, show ads, or use third-party advertising or tracking SDKs. Selfies are never used for anything except attendance verification by the employer.
Service providers (sub-processors)
Supabase provides database, authentication, and storage infrastructure; Vercel provides web hosting; Expo/EAS provides app builds and over-the-air app updates without receiving Charmy account or employee records; and Semaphore provides SMS delivery in the Philippines, receiving the recipient phone number and message content when an employer enables SMS notifications. Each provider processes data only to deliver its service to us.
Retention
Attendance records and payroll history are retained while the employer's account is active, as employers are required to keep employment records under Philippine labor regulations. Clock-in selfies are retained for the employer's verification window and deleted with the employer's account. When an employer closes their account, associated personal data is deleted within 30 days, except records we must keep to comply with law.
Your choices and rights
Under RA 10173, you may access, correct, or request deletion of your personal data. Employees should direct requests to their employer first because the employer controls their data; we will assist the employer in fulfilling those requests. Employers and account holders can request deletion of their account and associated data by emailing support@charmy.team from their account email with the subject "Account deletion". We complete deletion within 30 days and confirm it in writing. You may also complain to the National Privacy Commission.
Security
Data is encrypted in transit using TLS and protected at rest by our hosting providers. Access is restricted per business through row-level security. No method is 100% secure, but we notify affected employers of any breach as required by law.
Children
Charmy is a workplace tool for adults and is not directed at children under 18, other than lawfully employed minors registered by their employer.
Contact
Email support@charmy.team · Dumaguete, Philippines. We'll announce material changes to this policy on this page.