[](/)

[Templates](/#templates)[For work](/work)[Pricing](/pricing)[Sign in](https://charm.ing/auth/login)

[Build your first app](https://charm.ing/auth/signup)

[Templates](/#templates)[For work](/work)[Pricing](/pricing)[Sign in](https://charm.ing/auth/login)

[Build your first app](https://charm.ing/auth/signup)

On this page

# Charming Privacy Notice

**Last Updated:** October 26, 2026

Welcome to Charming, a hosted Model Context Protocol (MCP) server that generates, stores, and renders interactive web apps that you can call from MCP clients such as Claude.ai, ChatGPT, Claude Desktop, and other compatible agents. This Privacy Notice explains how Fractal Dynamics, Inc. d/b/a Charming ("Charming," "we," "our," or "us") collects, uses, discloses, and otherwise processes personal data in connection with the Charming Platform (as defined in the Charming Terms of Use).

This Privacy Notice does not address our privacy practices relating to Charming job applicants, employees and other employment-related individuals. Data that is not subject to applicable data protection laws (such as deidentified or publicly available information) is also out of scope.

This Privacy Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

## 1\. Our Role in Processing Personal Data

Data protection laws sometimes differentiate between "controllers" and "processors" of personal data. A "controller" determines the purposes and means (the why and how) of processing personal data. A "processor," which is sometimes referred to as a "service provider," processes personal data on behalf of a controller subject to the controller's instructions.

This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. It does not cover or address how our customers may process personal data when they use our services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. We recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. We are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.

## 2\. Our Collection and Use of Personal Data

The categories of personal data we collect depend on how you interact with us and our services. For example, you may provide us your personal data directly when you create an account or connect Charming from an MCP client.

### 2.1 Personal Data Provided by Individuals

*   **Contact Information**, including first and last name, email address, and communication preferences. We use this information primarily to fulfill your request, to communicate with you directly, and to send you product communications in accordance with your preferences.
*   **Account Information**, including account credentials, OAuth tokens, one-time passcodes, and the products or services you are interested in or have used. We use this information to administer your account, provide you with our Platform, communicate with you regarding your account, and for customer support.
*   **App Data** you create, generate, or modify on the Platform, including the source of generated apps (modules, UI, styles), saved app state, and metadata about apps (titles, descriptions, timestamps, versions). We use this information to render apps for you, persist your apps across MCP clients, and improve the Platform. App Data is described in further detail in our Terms of Use as "User Data."
*   **Don't share secrets in prompts.** Charming does not collect your raw chat messages. When you ask an AI assistant to build something with Charming, your assistant sends Charming only the structured arguments each tool needs to run — for example the generated app code, a short app description, and identifiers — not a copy of your conversation. Even so, your assistant may incorporate text from your message into the app code or description it generates and sends to us. So do not include passwords, API keys, access tokens, or other credentials in messages you send to AI assistants when using Charming. Treat prompt input as you would a public chat; anything that ends up in your generated app content may be retained and reviewed for product improvement and abuse prevention.
*   **Tool Response Snippets.** To evaluate whether the Platform is producing the right answers, we retain a truncated preview (up to 2 KB) of the text Charming returns in response to most tool calls. For example, success confirmations, app listings, and error messages surfaced to your AI assistant. Snippets are omitted for tools whose responses contain your full app source or arbitrary application output (today: `get_app_source`, `query_app`, and `mutate_app`). The full source of your apps and the data your apps store remain App Data and continue to be governed by the bullet above.
*   **Connected Account Information.** When you connect a third-party service such as Gmail, Google Calendar, Slack, or GitHub to your Charming account (a "Connection"), we keep a record of the Connection, the name and identifier the service gives the account (for example its email address or workspace ID), and which apps you approved to use it and at which access levels (read, write, or delete). Our subprocessor Composio stores the OAuth tokens for the Connection and makes each request to the service; Charming does not hold those tokens. When an app you approved calls the service, the request and the service's response pass through Charming and Composio to the app, and the app may keep what it receives in its app state. We log which app called which service and tool, what kind of caller made the call, and whether it succeeded, and we count calls toward the app owner's plan, but we do not log the request's arguments or the service's response.
*   **Payment Information**, including payment card information, billing address, usage credits, and other financial information. We use third-party payment processing providers, including Stripe, to process payments. We do not retain personally identifiable financial information such as payment card numbers; that information is provided directly by you to our third-party payment processors. The payment processor's use of your personal data is governed by its privacy notice (see [Stripe's privacy policy](https://stripe.com/privacy)).
*   **Feedback and Support Information**, including the contents of messages sent through our forms, chat, or email, as well as recordings of calls with us where permitted by law. We use this information to investigate and respond to your inquiries and to improve our Platform.

### 2.2 Personal Data Automatically Collected

We, and our third-party partners, automatically collect information about how you access and use our Platform when you engage with us, including via cookies, web beacons, pixels, embedded scripts, and logging technologies.

*   **Information About Your Device and Network**, including the device type, operating system, IP address, browser type, MCP client identifier (when applicable), and unique identifiers associated with you, your device, or your network.
*   **Information About How You Use Our Services**, including which apps you create, render, and call; how often you connect from each MCP client; pages you visit on our Website; and how you interact with our content, including links you click. When a hosted app is opened, we record a view event (including for visitors without a Charming account); for apps not yet claimed to an account we attribute these events to a non-identifying per-app identifier rather than to you, and we set a cookie to distinguish first-time from returning views.
*   **Information About Your Location**, including general geographic location derived from your IP address. We use this to optimize routing and reduce latency.

For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the "Your Privacy Choices" section below.

### 2.3 Personal Data from Other Sources and Third Parties

*   **Single Sign-On and OAuth Providers.** We may provide you the ability to log in to Charming through third-party identity providers (for example, Google), or to connect your Charming account to MCP clients (such as Claude.ai or ChatGPT) via OAuth 2.0 with Dynamic Client Registration. We do not receive your password from these providers; we receive identifiers, OAuth tokens, and basic profile information needed to identify you and provision access.
*   **MCP Client Metadata.** When you connect from an MCP client, that client registers with us and may transmit a client name, redirect URI, and capability metadata. We use this information to authenticate the client and route tool calls.
*   **Service Providers** who perform services on our behalf may share information with us, including analytics, error monitoring, and infrastructure providers.
*   **Our Affiliates.** Charming is provided by Fractal Dynamics, Inc. and its affiliates. Affiliates may share personal data with us for purposes consistent with this Privacy Notice.
*   **Other Sources**, including publicly available sources, third-party data providers, and transactions such as mergers and acquisitions.

### 2.4 Additional Uses of Personal Data

In addition to the primary purposes described above, we may also use personal data to:

*   Fulfill or meet the reason the information was provided;
*   Manage our organization and its day-to-day operations;
*   Communicate with you, including via email, chat, or social media;
*   Address inquiries or complaints about our products or services;
*   Create and maintain accounts for our users;
*   Verify your identity and entitlement to the Platform;
*   Develop, operate, improve, maintain, protect, and provide the features and functionality of our Platform;
*   Identify and analyze how you use our Platform;
*   Create aggregated or de-identified information that cannot reasonably be used to identify you;
*   Conduct research and analytics on our user base and our Platform;
*   Test, enhance, update, and monitor the Platform, or diagnose or fix technology problems;
*   Maintain the safety, security, and integrity of our property, products, services, technology, and business;
*   Defend, protect, or enforce our rights or applicable contracts and agreements;
*   Detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity;
*   Facilitate business transactions and reorganizations;
*   Comply with contractual and legal obligations; and
*   Fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.

## 3\. Our Disclosure of Personal Data

We disclose or otherwise make available personal data in the following ways:

*   **To MCP Clients You Connect.** When you connect Charming from an MCP client (such as Claude.ai or ChatGPT), we make available to that client the apps, tool definitions, and app state required for the client to render and operate your apps on your behalf. The MCP client's handling of that data is governed by its own privacy practices.
*   **To Services You Connect and the Apps You Approve.** When an app you approved uses a Connection, we send the service, through Composio, the request the app makes on your behalf, and we return the service's response to that app. The app's owner and anyone who can edit the app can see the data the app reads from your account, and we tell you so before you approve it. If you own an app and choose to share your Connection with the people you share the app with, those people can use the app to reach your account at the access levels you chose. Each service's handling of data is governed by its own privacy practices.
*   **To Service Providers**, including hosting and database providers, error monitoring, email delivery, analytics, and customer support tools.
*   **Subprocessors.** A current list of the subprocessors we use to operate the Platform is available at [usecharming.com/subprocessors](/subprocessors).
*   **To Our Affiliates**, for purposes consistent with this Privacy Notice.
*   **To Other Businesses as Needed to Provide Services**, including payment processing.
*   **In Connection with a Business Transaction or Reorganization**, such as a merger, acquisition, joint venture, financing, or sale of company assets.
*   **To Facilitate Legal Obligations and Rights**, including to legal advisors and law enforcement: in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal process; to protect our rights and property; to detect, suppress, or prevent fraud; to reduce credit risk and collect debts owed to us; to protect the health and safety of any person; or as otherwise required by applicable law.
*   **With Your Consent or Direction.**

## 4\. Your Privacy Choices

### 4.1 Communication Preferences

You can stop receiving promotional email communications from us by clicking on the "unsubscribe" link in any of our email communications. You cannot opt out of service-related email communications such as account verification, transaction confirmation, or service update emails.

### 4.2 Withdrawing Your Consent

Where we have your consent for the processing of your personal data, you may withdraw your consent by following the instructions provided when your consent was requested or by contacting us as set forth in the "Contact Us" section below.

### 4.3 Automatic Data Collection Preferences

Most browsers allow you to change browser settings to limit automatic data collection technologies. Most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies. Many devices allow you to change device settings to limit automatic data collection. Blocking these technologies may negatively impact your experience using our services.

### 4.4 Disconnecting MCP Clients

You can revoke access for any connected MCP client at any time by disconnecting Charming from within the MCP client itself (where supported), or by emailing [legal@usecharming.com](mailto:legal@usecharming.com). Revoking access invalidates the OAuth tokens issued to that client; the client will no longer be able to read or modify your apps or app state until you reconnect.

### 4.5 Removing Connections and App Approvals

You can revoke an app's access to a Connection, or remove a Connection entirely, at any time in **Account settings → Connectors**. Removing a Connection deletes it from Charming at once and from Composio as soon as Composio confirms the removal; if Composio is unavailable, we keep retrying until it does. Where the service supports it, we also revoke Charming's access at the service; otherwise we tell you to remove Charming's access in the service's own account settings. Removing a Connection stops every app from using it. Data an app already received from a service stays in that app's app state until the app's owner deletes it or the app is deleted.

### 4.6 Modifying or Deleting Your Personal Data

You can permanently delete any individual app at any time through any connected MCP client (using the `delete_app` tool) or your Charming account. For all other requests (including modifying account information, deleting your account, or reviewing the personal data we hold about you), contact us at [legal@usecharming.com](mailto:legal@usecharming.com). We may not be able to modify or delete your personal data in all circumstances (for example, where retention is required by law).

## 5\. Children's Personal Data

Our services are not directed to children. As described in our [Terms of Use](/terms), you must be at least 18 years old to use the Platform. We do not intend to, or knowingly, collect or solicit personal data from children under the age of 13. If a child under 13 has provided personal data to us, we encourage the child's parent or guardian to contact us so that we can remove the personal data from our systems.

## 6\. Third-Party Websites and Services

Our services may include links to third-party websites, plug-ins, applications, and other services, including the MCP clients you connect Charming to and the third-party services you connect to your Charming account. Except where we post, link to, or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the privacy practices of third parties, please visit their respective privacy notices.

## 7\. Data Retention

We retain personal data for as long as necessary to provide the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements. App Data is retained while your account is active and for ninety (90) days after deletion of the App or your Account to allow recovery from accidental deletions, after which it is permanently purged, except where we are required to retain it for legal, tax, or fraud-prevention purposes. You can permanently delete an app at any time through any connected MCP client or your Charming account. Connections are deleted when you remove them or delete your Charming account.

## 8\. Your Privacy Rights and Legal Basis

Depending on where you reside, you may have specific rights regarding your personal data under applicable law.

### 8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal data we collect, use, and disclose; to request deletion or correction of your personal data; to opt out of the sale or sharing of your personal data (we do not sell or share personal data as those terms are defined under California law); and to not be discriminated against for exercising any of these rights. To exercise any of these rights, contact [legal@usecharming.com](mailto:legal@usecharming.com).

### 8.2 EU, UK, and EEA Residents (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You also have the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, contact [legal@usecharming.com](mailto:legal@usecharming.com).

### 8.3 Legal Basis for Processing

Where GDPR applies, our legal basis for processing personal data depends on the purpose: we process personal data necessary to provide the Platform on the basis of contract performance; we process personal data for security, fraud prevention, product improvement, and analytics on the basis of our legitimate interests; and we process personal data for marketing communications on the basis of your consent (which you may withdraw at any time).

### 8.4 International Data Transfers

Charming is based in the United States, and personal data we process may be transferred to, stored in, and processed in the United States and other countries. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses or other appropriate safeguards as required by applicable law.

## 9\. Updates to This Privacy Notice

We may update this Privacy Notice from time to time. When we make changes, we will change the date at the top of this Privacy Notice. If we make material changes, we will notify individuals by email to their registered email address, by prominent posting on this website, or through other appropriate communication channels. All changes are effective from the date of publication unless otherwise provided.

## 10\. Contact Us

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please contact [legal@usecharming.com](mailto:legal@usecharming.com).

[](/)

The collaborative cloud for apps you build.

[System status](https://status.usecharming.com)[support@usecharming.com](mailto:support@usecharming.com)

## Product

[How it works](/how-it-works)[Templates](/#templates)[Pricing](/pricing)[Works with](/works-with)[Security](/security)

## For work

[Charming for Work](/work)[Finance](/work/finance)[Marketing](/work/marketing)[Recruiting](/work/recruiting)[Consultants](/work/consultants)[IT and security](/work/it)[Internal tools](/work/internal-tools)

## Developers and AI

[Docs](https://charm.ing/docs)[AI client setup](https://charm.ing/docs/clients)[MCP reference](https://charm.ing/docs/technical-reference/mcp)[ChatGPT app](https://chatgpt.com/plugins/plugin_asdk_app_6a56c533cd7c8191b9a16cb7973a65e6)[Claude connector](https://claude.ai/directory/charming)[llms.txt](/llms.txt)[GitHub](https://github.com/tambo-labs/charming-mcp)

## Company

[About](/about)[Blog](/blog)[Guides](/guides)[Contact](/contact-us)

## Legal

[Terms](/terms)[Privacy](/privacy)[Fair use](/fair-use)[Subprocessors](/subprocessors)

## Guides

All guides (21)

### Building and sharing apps

[Does ChatGPT Canvas persist?](/does-chatgpt-canvas-persist)[Do Claude Artifacts save data?](/do-claude-artifacts-save-data)[Can you build an app inside ChatGPT?](/can-you-build-an-app-inside-chatgpt)[Can ChatGPT build and host a website?](/can-chatgpt-build-and-host-a-website)[What personal apps can I build for myself with AI?](/personal-app-ideas)[Which AI tool should I use to build an app?](/which-ai-tool-to-build-an-app)[Claude Artifacts vs Replit vs Charming: which should I use?](/claude-artifacts-vs-replit-vs-charming)[Where do I host an app I built with AI?](/where-to-host-an-app-you-built-with-ai)[Can I share a Codex Sites app with people outside my company?](/can-i-share-a-codex-sites-app)[How to build an app with AI](/build-an-app-with-ai)[How do I share an app I built with friends safely?](/share-an-app-with-friends-safely)[Why did my Lovable bill jump?](/why-did-my-lovable-bill-jump)

### For IT and security

[How should IT govern apps employees build with AI?](/govern-ai-built-apps)[What should an AI-built app policy include?](/ai-built-app-policy-template)[How do you stop vibe coding from becoming shadow IT?](/vibe-coding-shadow-it)[Which platform should a company use for AI-built internal apps?](/ai-internal-app-platforms)[Lovable Enterprise vs Charming: which should your company use?](/lovable-enterprise-vs-charming)[Which AI-built apps belong in your code review pipeline?](/which-ai-built-apps-need-code-review)[How many hosting accounts hold company apps right now?](/ai-app-discovery-checklist)[Does an enterprise AI subscription govern the apps employees build?](/does-enterprise-ai-govern-the-apps)[How do you give a team answers from company data without granting warehouse access?](/give-answers-not-warehouse-access)

[Guides hub](/guides)

© 2026 Charming

[](https://x.com/usecharming)[](https://www.linkedin.com/company/usecharming)[](https://github.com/tambo-labs/charming-mcp)

[Build your first app](https://charm.ing/auth/signup)