Privacy Policy

This policy explains what Charleston collects and how we use it. Charleston is booking and business software for mah jong teachers.

What we collect

• Account information — your name, email, username, and password (stored only as a secure hash).
• Billing information — handled by Stripe. We never see or store your full card number; we keep only a Stripe customer/subscription reference and your subscription status.
• Studio data you enter — your events, students, bookings, inquiries, and settings.
• Basic usage data — page visits and simple analytics, including IP address, browser/device type, referring page, and screen size, to help the Service work, prevent abuse, and improve.

How we use it

To provide and operate the Service: run your booking pages, manage your students, process your subscription, send transactional email (such as booking confirmations and password resets), and keep the system secure.

Payment processing

Subscriptions and any student payments are processed by Stripe, which handles card data under its own privacy terms. We only receive limited references and status, never raw card details.

Where data is stored

Data is stored in our managed database (Supabase) and application hosting (Render). Each studio's data is isolated so one studio cannot access another's records.

Your students' data

Information about your students is entered and controlled by you. Charleston processes it on your behalf to provide the Service. We do not sell it or use it for advertising.

Sharing

We don't sell your data. We share it only with the service providers needed to run Charleston — Stripe (payments), Supabase (database), Render (hosting), and Resend (transactional email) — and where required by law.

Cookies

We use a sign-in session cookie to keep you logged in. On public booking and inquiry pages we also set a first-party visitor cookie to count unique visits, and, if you arrive through a referral link, a short-lived referral cookie. We don't use third-party advertising cookies.

Security and retention

Passwords are hashed, connections are encrypted in transit, and access is scoped per studio. We keep your data while your account is active; you can request export or deletion by contacting us.

Your rights

You can access, correct, export, or delete your data. Email us and we'll help.

Changes

We may update this policy; material changes will be posted here with a new date.

Contact

hello@charlestoncrm.com