Privacy

Who operates the store

Charmingly is operated by Lithibithi, 3905 Tampa Rd Unit 1709, Oldsmar, FL 34677, United States. For privacy questions or requests, email hello@charmingly.me.

Photos & designs

We use your uploaded photos, subject descriptions, and selected options to create and store your personal rendering and manufacture your order. Upload only images you have permission to use. Customer photos and renderings are privately stored. Guest previews are accessible through a secure, essential browser cookie for up to 24 hours; saving a preview transfers it to your verified account. Authorized studio personnel can also access designs. We do not publish your uploads in the example gallery or use them in advertising without your permission.

When you request a preview, your image and subject description are sent to OpenAI for image processing. Website hosting and storage providers process these files to operate the service. Storefront examples are separate from private customer uploads.

Accounts, orders & emails

You can generate a free preview without an account. When you request one, a signed, secure, HTTP-only cookie protects your guest previews and enforces the daily limit. Daily keyed network hashes also prevent abuse; raw IP addresses are not stored in these quota records. This service protection is separate from traffic analytics and advertising.

We store your email and account identifier to save designs, authenticate you, and show your orders. Sign-in codes are sent by Resend; secure essential cookies keep you signed in for up to 14 days. Order records contain the selected design, options, requested changes, approval history, and contact and shipping details needed to fulfill your purchase.

Stripe processes payment details and calculates applicable checkout tax. This website does not store your card number. Resend processes your email address and transactional messages to deliver sign-in codes, order confirmations, and updates. Resend also delivers internal studio activity notifications, including selected options and rendered designs when available, to our authorized studio inbox in Zoho. These operational emails are not marketing messages. Zoho handles messages sent to our customer support inbox. These providers may process data in the United States or other countries under their applicable service and data-protection terms.

We use information to provide the service you request, meet contractual and legal obligations, and protect the store against fraud and misuse. In the United States, optional advertising measurement is enabled by default unless you opt out or your browser sends Global Privacy Control. Elsewhere, we require your opt-in before enabling it. Where applicable, you may object to processing based on legitimate interests.

Contact & chat help

Our chat menu provides automated answers from studio information. When you submit a contact form or ask to talk to the studio, we store your name, email, subject, and message and deliver the request through Resend to our branded Zoho inbox for contact forms or our studio Gmail inbox for chat handoffs. Contact-form replies continue by email. For website chat, Resend receives studio email replies and returns their message text to your private chat, without displaying the sender’s email address or email headers. A random access token stored in your browser lets you return to that chat on the same browser for up to 90 days; use End this chat to remove that browser access. Do not share your browser’s chat access token. Do not include payment details in messages.

Contact messages are accessible only to authorized studio personnel. Resolved website requests are removed after 90 days during inbox maintenance; unresolved requests remain available for follow-up. Email copies follow the studio mailbox’s retention practices. A daily hashed network identifier limits form abuse. Contact details and messages are not sent to advertising platforms.

Retention & your choices

Unpurchased designs that are not associated with an order or open checkout expire after 90 days and are removed, with any files no longer needed by another design, during routine maintenance when accounts or the studio are accessed. Purchased designs and order records are retained as needed for fulfillment, customer support, disputes, and applicable accounting or legal obligations. Shared files are retained while still needed for another saved design or order. Internal notification records and undelivered notification files expire after 90 days during routine maintenance; email copies follow the studio mailbox retention practices.

You can request access, correction, or deletion of your personal information by emailing hello@charmingly.me from the address associated with your account. We may verify your identity before acting and retain information we are required to keep. Depending on where you live, you may also have rights to portability, restriction, objection, withdrawal of consent, or a complaint to your local data-protection authority.

Store counts & optional advertising

When advertising measurement is allowed, we also keep first-party channel attribution for up to 90 days: the first and latest identifiable Google, Meta, or packaging-card referral, a campaign label, and a random browser identifier linked to preview requests, account creation, checkout and paid-order outcomes. Direct visits do not replace a known referral. These records help compare channel performance, are not additional events sent to advertising platforms, and are removed for this browser when you withdraw permission. Attribution may be incomplete across browsers or devices.

Manage advertising privacy choices

The advertising choice banner opens automatically for visitors identified as being in the UK or Europe. In the United States, advertising measurement is enabled by default unless you opt out or your browser sends Global Privacy Control. You can opt out using the button above. Outside the United States, measurement stays off until you choose to allow it; when your location cannot be determined, it also stays off.

We keep basic aggregate counts of public page views, photo selections, and preview-button clicks to understand use of the store and improve the service. These counts work without optional analytics consent. Each counter contains only a date, page category, action category, broad source category, and total. We do not use cookies, browser storage, persistent visitor identifiers, fingerprints, or IP addresses to identify or link visitors for these counters. We do not store full page URLs or send these aggregate records to advertising platforms. Repeat visits and reloads can be counted again, so these are not unique visitor counts. Signed-in studio traffic and recognized automated requests are excluded where possible.

Preview-request outcomes and checkout totals are summarized separately from the records required to provide those services. Aggregate counters and legacy consented analytics are removed after 90 days during routine maintenance. Hosting providers still process ordinary request information to deliver and secure the website.

Advertising measurement is a separate optional choice. When enabled by the studio and permitted under the regional choices described above, Meta Pixel measures public shop page views, product-page views and checkout starts. It may set Meta browser identifiers (_fbp and _fbc). It is not loaded on private image, design, account, studio or order pages. We also send checkout starts and confirmed live purchases through Meta’s Conversions API; browser and server checkout events share a random event identifier to avoid counting them twice. This includes purchase value excluding tax and shipping, generic charm category, event time, a random identifier, a hashed email address, browser information, IP address when available, and a Meta ad-click identifier when supplied in your visit. Hashing does not make an email anonymous: Meta can use it to match activity to an account for attribution and advertising. We do not send photos, renderings, design instructions, names, mailing addresses, or private account/order URLs. You can opt out or withdraw advertising consent through Manage advertising privacy choices on this Privacy page, linked in the website footer; this stops future sharing and cancels pending unsent events for this browser. Previously delivered events may remain with Meta under its privacy policy. We respect Global Privacy Control. Consent records and undelivered tracking data are retained for up to 90 days during routine maintenance; delivered event payloads are cleared after acceptance. We do not sell customer photos.

Google Ads purchase measurement

Under the same regional advertising choices and Global Privacy Control described above, Google Ads measures confirmed live purchases when you return from checkout. It receives the purchase value excluding tax and shipping, currency, a random order identifier to prevent duplicates, browser information and ad-click identifiers. Google may set _gcl_ cookies to connect purchases with ad clicks. We do not send customer photos, names, email addresses, design instructions or private order URLs to Google. Enhanced conversions and advertising personalization are not enabled by this integration. Browser blocking, privacy choices or not returning from checkout can prevent measurement. Withdrawing permission stops future conversion events and clears Google advertising cookies from this site.

Updates

We will update this page when our practices change. Last updated October 27, 2026.