Privacy Policy

This Privacy Policy explains what data CastModel (the “Service”) collects, why we collect it, and what rights you have under the EU General Data Protection Regulation (GDPR) and other applicable law.

1. Data controller

The controller of your personal data is CastModel, based in Poland. For all privacy questions and to exercise your rights, contact us at the email address on our Contact page.

2. What we collect

• Account: email address, authentication identifier provided by our identity provider (Clerk), sign-up date, last login timestamp.
• Model profile (if you create one): display name, age, gender, country, city, shoot type, willingness to travel, optional physical measurements (height, bust, waist, hips), social media links, photos you upload, and your consent record.
• Payments: handled by Stripe. We never see or store your full card details; we only keep subscription identifiers, status, and billing period end.
• Activity: profile view counts, contact unlocks you performed, and abuse reports you submit or receive.
• Cookies: strictly necessary cookies for authentication (session/Clerk). We do not run third-party analytics or advertising trackers.

3. Legal bases

• Contract (Art. 6(1)(b) GDPR): to provide the Service you signed up for — account, profile, subscription, unlocks.
• Consent (Art. 6(1)(a) and 9(2)(a) GDPR): for publishing your photos and any physical measurements you choose to share; consent is confirmed via a checkbox on the profile form and can be withdrawn at any time by deleting your profile.
• Legitimate interest (Art. 6(1)(f) GDPR): abuse moderation, security, and preventing fraud.
• Legal obligation (Art. 6(1)(c) GDPR): tax and accounting records for payments.

4. Who processes data on our behalf

• Clerk — user authentication.
• Stripe — payments; card data handled solely by Stripe under their PCI-DSS certification.
• Cloudflare R2 — photo hosting.
• Railway — application and database hosting.

These providers act as data processors under GDPR. Some may transfer data outside the EEA under Standard Contractual Clauses.

5. Retention

Account and profile data are kept until you delete your profile via the dashboard (or ask us to). Payment records are retained for the period required by Polish tax law (currently five years). Aggregated, non-personal statistics may be kept longer.

6. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you (Art. 15).
• Correct inaccurate data (Art. 16).
• Erasure — you can delete your profile and all associated personal data yourself from the dashboard (“Delete my profile and data”), which removes profile fields, photos, unlocks tied to you, and the account itself (Art. 17).
• Restrict or object to processing (Art. 18, 21).
• Data portability — ask for a copy of your data (Art. 20).
• Withdraw consent at any time, without affecting past processing.
• Lodge a complaint with a supervisory authority. In Poland this is the Personal Data Protection Office (UODO).

7. Age policy

The Service is for adults only. You must confirm you are at least 18 to create a profile. We reject profiles we cannot reasonably verify as adult and cooperate with authorities where required.

8. Cookies

We use only strictly necessary cookies to keep you signed in. We do not currently use analytics or advertising cookies. If we add analytics later, a cookie consent banner will appear and non-essential cookies will be off by default until you opt in.

9. Security

We store data in EU-region infrastructure, encrypt in transit (HTTPS) and at rest, and limit access to a minimum. No system is perfect; if we become aware of a breach that materially affects you, we will notify you and the appropriate authority.

10. Changes

We may update this Policy. Material changes will be announced on this page with a new “Last updated” date.

11. Contact

Privacy questions or to exercise your rights: contact us.