This policy explains what Casting Platform does with personal data. It is written to be read, not to be survived.
What we collect
- Account data — name, email address, phone number, password (stored only as an argon2id hash), and the verification records that prove the email and phone are yours.
- Talent profile data — stage name, date of birth, gender, physical details, skills, languages, city, rate expectations, photographs and video, and for anyone under 18, a guardian’s name, relationship and contact details.
- Identity documents — where we verify identity or age. These are held separately from the profile, never shown to clients, and every single view of one is written to an access log with who looked and when.
- Client and company data — company name, GSTIN or PAN, and the details of the person commissioning work.
- Booking data — briefs, shortlists, bookings, contracts, invoices and payout records.
- Technical data — IP address, user agent and timestamps on security-relevant actions such as signing in, and on access to documents and media.
Why we hold it, and on what basis
To run the casting service you asked us to run: matching briefs to talent, confirming availability, papering bookings, taking payment and making payouts. Identity and age data is held to keep the roster safe and lawful, including the rules that apply to anybody under 18. Security logging is held because an unlogged platform cannot investigate its own incidents.
Who can see what
- The public sees an approved talent profile without any contact field: no phone number, no email, no social handle, no address — not on the page and not in its source or structured data.
- Clients see the same profile plus what a booking needs. They never see contact details, legal names, identity documents or another client’s data. This is enforced by separate database selectors, not by a template remembering to leave a field out.
- Agency staff see what their role requires. Casting managers see contact details because they run shoots; identity documents are restricted further and access to them is logged individually.
- Processors — the services that store our files, send our email and SMS, and take payments — see only what they need to do that job.
How long we keep it
- Account and profile data — while your account is open, and afterwards only where a booking, a tax record or a legal obligation requires it.
- Access logs — 90 days.
- Audit records — permanently, and they cannot be edited or deleted, including by us. That is deliberate: an audit trail that can be quietly rewritten is not one.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete your account. Deletion removes your profile and takes it off the public site; records tied to a completed booking, a payment or a legal obligation are kept, and we will tell you which ones and why. You can also withdraw a guardian’s consent, which immediately stops any further booking of the minor concerned.
Security
Passwords are hashed with argon2id and never stored in a readable form. Sessions are held server-side and referenced by a random token; only its hash is stored. Administrator accounts must use two-factor authentication. Media is stored privately and served through short-lived signed links rather than public URLs. Photographs have their EXIF metadata — including GPS coordinates — stripped on upload.
Cookies
We use cookies for signing in and for cross-site request protection. There are no advertising or third-party tracking cookies on this site.
Changes and contact
If this policy changes, the date at the top changes with it and registered users are told about anything material. To exercise a right or ask a question, use the account you registered with or the routes on our contact page.