Privacy Policy
Last updated: July 11, 2026
1. Who we are
Charlie OÜ ("Charlie", "we", "us") provides an AI email marketing platform for e-commerce brands, delivered primarily as an embedded app for Shopify stores.
Charlie OÜ
Lahepea 9, 10617 Tallinn, Estonia
Reg. 17461722 | VAT: EE102966275
Email: hello@charlieai.co
2. The two roles we play
Processor — your store's data. When a merchant installs Charlie on their Shopify store, we process that store's data (customers, orders, products, checkouts, theme and content data) strictly on the merchant's behalf and instructions, to generate and send email campaigns. For this data the merchant is the data controller and Charlie is a data processor under Article 28 GDPR. Our Data Processing Addendum governs this processing and forms part of our terms with every merchant.
Controller — merchant account data. For the merchant's own account information (store domain, contact email, billing status, support conversations), Charlie is the data controller. The rest of this policy covers both roles and says which applies where relevant.
3. What data we process
As processor (store data, on the merchant's behalf):
- Customer records synced from Shopify: name, email address, country, language, marketing consent status and its provenance (when and how consent was given), order counts and revenue totals.
- Order, checkout, and refund events used to drive email flows (e.g. abandoned-cart, post-purchase).
- Product catalog data (titles, descriptions, images, prices) used in generated emails.
- Theme and store content (colors, fonts, logo, pages) used to extract the store's brand kit.
As controller (merchant account data):
- Store domain, the store owner's email address, and workspace settings.
- Campaign briefs and instructions the merchant sends us (via the embedded app, chat, or connected AI assistants).
- Subscription plan and billing status. Payment for the Shopify app is handled entirely by Shopify's billing system — we never see card details.
- Support correspondence.
4. What we deliberately do not do
No open or click tracking. Emails sent through Charlie contain no tracking pixels and no per-recipient click-tracking redirects. We believe recipient surveillance is neither necessary for good email marketing nor compatible with the spirit of the ePrivacy rules. We measure campaign success through delivery, bounce, complaint, and (where the merchant connects it) store order data instead.
No selling or sharing of data. Store data is never sold, never used to train AI models, never shared across merchants, and never used for our own marketing.
No advertising cookies on this site. charlieai.co uses only cookies strictly necessary for the service to function.
5. Why and on what legal basis
- Contract performance — operating the service a merchant has installed and subscribed to (processor activities are governed by the merchant's instructions under the DPA).
- Legal obligation — retaining invoices and transaction records as required by Estonian accounting law.
- Legitimate interest — service security, abuse and fraud prevention, deliverability protection (e.g. suppression lists, bounce handling).
6. AI processing
Charlie uses large language models from Anthropic to generate email content. What is sent to Anthropic is limited to the content needed to write the email: the campaign brief, brand kit, and relevant product information. We do not send customer lists or individual customer records to Anthropic. Under our commercial agreement, Anthropic does not use this data to train its models.
7. Subprocessors
We use a small number of service providers to run Charlie. As required by our DPA, we maintain this list and notify merchants of changes.
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Cloud hosting of application and databases | EU (Amsterdam, Netherlands data center) |
| Mailgun Technologies, Inc. / Twilio SendGrid | Email transmission (delivery of merchant emails and service notifications) | EU sending regions where available; US entity — SCCs in place |
| Anthropic, PBC | AI content generation (briefs, brand kit, and product content only — no customer lists) | USA — SCCs / EU-US Data Privacy Framework |
8. Data residency and international transfers
Charlie's application and databases are hosted in the European Union (DigitalOcean, Amsterdam). Store data is stored and processed in the EU. Where a subprocessor is established outside the EU/EEA (see table above), transfers are protected by the European Commission's Standard Contractual Clauses or an applicable adequacy decision such as the EU-US Data Privacy Framework.
9. Data retention and deletion
- While the app is installed: store data is retained as needed to provide the service.
- On uninstall: the workspace is marked for offboarding immediately and our API access is revoked by Shopify. When Shopify sends the shop/redact compliance webhook (48 hours after uninstall), we hard-delete the workspace and all store data in it.
- Customer erasure requests: when Shopify sends a customers/redact webhook, we delete that customer's data immediately and keep only a one-way hash of the email address to prevent accidental re-import.
- Data access requests: when Shopify sends a customers/data_request webhook, we compile what we hold about that customer and send it to the merchant the same day.
- Billing records: retained for 7 years as required by Estonian tax law.
10. Security
All traffic is encrypted in transit (HTTPS/TLS). Shopify access tokens and other credentials are encrypted at rest. Every request from the embedded app is authenticated with short-lived Shopify session tokens, and workspace data is strictly isolated per merchant at the database-access layer. Access to production systems is limited to authorized personnel. No system is completely secure; if a breach affects personal data we will notify affected merchants and, where required, the supervisory authority without undue delay.
11. Your rights (GDPR)
If you are a merchant (or a merchant's customer), you have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR, and the right to withdraw consent where processing is based on consent.
If you are a customer of a store that uses Charlie, please direct your request to that store — they are the controller of your data, and Shopify's compliance tooling routes their instructions to us automatically. We fulfil merchant-routed requests within the timelines described in section 9.
If you are a merchant, contact us at hello@charlieai.co. We respond within 30 days.
12. Children
Our service is a business tool and is not directed at individuals under 18. We do not knowingly collect data from children.
13. Changes to this policy
We may update this policy from time to time. Material changes are communicated to merchants by email at least 14 days before taking effect. The "Last updated" date above reflects the most recent revision.
14. Supervisory authority
You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, or with your local supervisory authority.
15. Contact
Charlie OÜ
Lahepea 9, 10617 Tallinn, Estonia
Email: hello@charlieai.co