Privacy Policy

How Men's Charm Academy handles your data — across US, EU, and China. Pick your region for the relevant section.

Last updated: 2026-08-05

United States · FTC
European Union · GDPR
China · PIPL

What we collect — and why

Account data. Your email (for login + receipt), your chosen display name (for leaderboard handles). We don't collect your real name, government ID, or physical address unless you provide them for Stripe/Alipay payout setup (Branch Managers only).

Local storage. Our three affiliate systems (Refer 20 → VIP, Share Hub, Branch Manager) use your browser's localStorage to track your referral code, share click count, and commission balance. This data lives in your browser, not our server — clear your browser cache and it's gone. We use this for system functionality, not profiling.

Payment data. Processed by Stripe (international) or Alipay (China). We never see your full card number — Stripe/Alipay tokenize it and return a token. Your payout method (Stripe email or Alipay account) is stored only if you're a Branch Manager who requested a payout.

Conversation data with AI Tutor. Your prompts and the AI's responses are sent to Puter.com's Claude API. We don't store these on our server — the conversation lives in your browser session and clears on refresh. Don't put sensitive info in your tutor prompts.

Cookies. A 30-day cookie tracks referral attribution — when someone clicks your invite link, the cookie remembers your referral code for 30 days so if they enroll later you get credit. No third-party advertising cookies. No Google Analytics. No Facebook Pixel.

What we don't do

United States — FTC compliance

This section applies to users accessing the service from the United States, in compliance with the FTC Act Section 5, COPPA (Children's Online Privacy Protection Act), and FTC 16 CFR Part 255 (guides concerning use of endorsements and testimonials).

Your rights under FTC

  • Right to know. You may request a summary of the data we hold about you. Email the DSAR contact below.
  • Right to delete. You may request deletion of your account data. Local storage data you can delete yourself by clearing browser cache; server-side data (email, payout history) we delete within 30 days of request.
  • Right to opt out of affiliate tracking. If you don't want your referral code tracked, don't share your invite link. Simple.
  • COPPA. We don't knowingly collect data from children under 13. If you believe we've collected data from a child under 13, email us and we'll delete it within 7 days.
  • FTC endorsement compliance. Testimonials are given in exchange for free beta access — disclosed as such. We never pay for fake testimonials. Research citations are public official sources, not paid endorsements.

Affiliate disclosure (FTC 16 CFR Part 255)

We operate single-tier affiliate programs (Refer 20, Share Hub, Branch Manager). Alumni operating Branch sub-stores earn 30% commission — disclosed at Branch Manager. Not MLM, not a pyramid scheme — single-tier, no downlines. See Disclaimer for full affiliate disclosure.

European Union — GDPR compliance

This section applies to users accessing the service from the European Union or EEA, in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation).

Legal basis for processing

  • Contract performance (Art. 6(1)(b)). Your email and payment token are processed to fulfill the $99 enrollment contract.
  • Legitimate interest (Art. 6(1)(f)). localStorage tracking of referral codes serves our legitimate interest in operating the affiliate program. You can opt out by clearing your browser cache.
  • Consent (Art. 6(1)(a)). AI Tutor conversation data is sent to Puter.com only after you voluntarily prompt the tutor.

Your GDPR rights

  • Access (Art. 15). Request a copy of your data.
  • Rectification (Art. 16). Correct inaccurate data.
  • Erasure (Art. 17) — "right to be forgotten." Delete your data, with exceptions for contract obligations and legal retention.
  • Restriction (Art. 18). Limit processing temporarily.
  • Portability (Art. 20). Receive your data in a structured, machine-readable format.
  • Objection (Art. 21). Object to processing based on legitimate interest.
  • No automated decisions (Art. 22). We don't make solely automated decisions about you.

Data transfers outside the EU

Stripe processes payment data under its DPA with Standard Contractual Clauses. Puter.com (AI Tutor) is a US-based service — your tutor prompts transfer to the US under Puter's privacy policy. We don't transfer EU data to jurisdictions without adequacy decisions.

Age gate

Module 8 (Intimate Sanctuary) is age-gated to 18+. We don't knowingly process data of anyone under 16 (GDPR Art. 8 age of digital consent).

Supervisory authority

You may lodge a complaint with your national Data Protection Authority. We hope you contact us first — see DSAR box below.

China — PIPL compliance (个人信息保护法)

本节适用于从中国境内访问本服务的用户，依据《中华人民共和国个人信息保护法》（PIPL）及《网络安全法》。

收集的个人信息

  • 账号数据。 邮箱（登录 + 收据）、显示名（榜单 handle）。
  • 支付数据。 由 Stripe 或支付宝处理，我们不存储完整卡号——仅持有令牌。
  • 分店佣金数据。 仅 Branch Manager 提现时收集：Stripe 邮箱或支付宝账号 + 实名。
  • 本地存储。 三个 affiliate 系统用 localStorage 跟踪邀请码、分享点击、佣金余额——数据在你的浏览器不在我们的服务器。

你的权利（PIPL 第 44–50 条）

  • 知情、决定（第 44 条）。 知道我们持有你什么数据，并决定是否同意。
  • 查阅、复制（第 45 条）。 申请获取你的数据副本。
  • 更正、补充（第 46 条）。 修正不准确的数据。
  • 删除（第 47 条）。 申请删除你的数据。
  • 可携带（第 45 条）。 以结构化格式获取你的数据。
  • 撤回同意（第 15 条）。 撤回你的同意——撤回不影响撤回前的处理。

未成年人保护

我们不收集 14 周岁以下未成年人的个人信息。Module 8（亲密圣域）成人内容仅限 18 周岁以上访问。

跨境传输（第 38–40 条）

Stripe（国际支付）跨境传输在 Stripe 的 DPA + 标准合同条款下进行。Puter.com（AI Tutor）为美国服务——你的 tutor prompts 会传输到美国。我们不向无适当保护的国家传输。

投诉

你可以向国家网信办或当地网信部门投诉。我们希望你先联系我们——见下方 DSAR 联系方式。

Data Subject Access Request (DSAR)

To exercise any right above (access, deletion, correction, portability, or objection), email:

privacy@mca-example.com (placeholder — replace with real address before deployment)

Include "DSAR" in the subject line. We respond within 30 days (US/EU) or 15 working days (China PIPL). No fee for reasonable requests; we may charge a reasonable fee for manifestly unfounded or excessive requests.

Data retention

Account data (email, enrollment status): retained for the life of your account + 7 years (tax record retention in most jurisdictions). Payout history (Branch Managers): 7 years (tax). localStorage: until you clear your browser cache. AI Tutor conversations: not retained server-side — ephemeral.

Security

Payment data is tokenized by Stripe/Alipay — we never see full card numbers. Server-side data is encrypted in transit (HTTPS) and at rest. localStorage is browser-local — your security is your browser's security. We don't store passwords (email-based login). No system is perfectly secure — if a breach occurs, we'll notify affected users within 72 hours per GDPR Art. 34.

Changes to this policy

We'll update the "Last updated" date above when we change this policy. Material changes (new data types, new sharing) will be notified to you by email before they take effect.

Contact

Questions about this policy or your data: email the DSAR contact above. For deployment, replace the placeholder email with your real privacy contact address before going live.