TalentCastIQ ("TalentCastIQ," "we," "us," or "our") operates a marketplace that connects Talent (individuals and pet owners who license their likeness) with Businesses seeking to license imagery for commercial use. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our website, mobile application, and related services (the "Service"). We are the data controller for your personal data within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and other applicable privacy laws. To contact us, use the in-app Help / Support feature.

1. What This Means in Plain Terms

When you join as Talent, the details and photos you give us are used primarily to generate the AI imagery (character sheets) for your specific talent listing — the panels, angles, and attributes that represent you on the platform. This generated imagery and a limited public profile (your stage/pseudo name, photos, physical attributes, and pricing) are what approved Businesses can see. The underlying reference photos and the personal data behind your listing are not necessarily shared with Businesses. We use them to build and maintain your listing, not to expose your private information.

2. Personal Data We Collect

• Account data: email address, hashed password, display name, and account role (talent or business).
• Profile data: bio, birthday, age, gender, ethnicity, height, weight, location, physical attributes, profile photos, and the reference photos you upload.
• Consent and signature records: signed consent forms, typed digital signatures, acceptance timestamps, and the IP address recorded when you sign.
• Payment data: we do not store full card numbers. Payments are processed by Stripe. We retain Stripe customer and Connect account identifiers and transaction records needed to fulfil contracts and legal obligations.
• Usage and device data: IP address, browser type, device identifiers, and interaction data collected through analytics.
• Communications: messages, support requests, and notifications you send or receive through the Service.

3. How & Why We Use Your Data

We process your personal data only where we have a lawful basis under Article 6 of the GDPR:

• To create and manage your account — based on the contract with you (Art. 6(1)(b)).
• To generate AI imagery (character sheets and variants) for your talent listing from your reference photos and physical attributes — based on your consent (Art. 6(1)(a)). This data is used to build your listing; it is not necessarily shared with Businesses except for the limited public profile described above.
• To facilitate licensing transactions (usage requests, talent approvals, payments) — based on the contract with you (Art. 6(1)(b)).
• To maintain legal records (consent forms, signatures, project completion) — based on our legal obligations (Art. 6(1)(c)).
• To provide support and respond to inquiries — based on our legitimate interests (Art. 6(1)(f)) and the contract with you.
• To prevent fraud and keep the Service secure — based on our legitimate interests (Art. 6(1)(f)) and legal obligations.
• To improve and develop the Service — based on our legitimate interests (Art. 6(1)(f)), using pseudonymised data where possible.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, nor any processing based on a different legal basis.

4. Who We Share Your Data With

We do not sell your personal data. We share it only as follows:

• Your public listing: your stage/pseudo name, generated photos, physical attributes, and pricing are visible to approved Businesses so they can find and request your talent. Your real name and contact details are kept private unless you choose to disclose them. The reference photos and detailed profile data used to generate your imagery are not necessarily shared with Businesses.
• Service providers (processors): we use third parties acting as processors under Article 28 GDPR — including Stripe (payments), analytics providers, and hosting infrastructure — bound by contracts requiring confidentiality and GDPR-level protection.
• Legal compliance: we may disclose data when required by law, court order, or to protect the rights, property, or safety of TalentCastIQ, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, data may be transferred subject to the protections of this policy.

5. AI Generation & Your Likeness

TalentCastIQ uses artificial intelligence to generate character sheets, variants, and AI-generated characters from your reference photos and physical attributes. The purpose is to produce the imagery that represents your specific talent listing on the platform. This processing is based on your explicit consent and is a creative production tool — the decision to license, approve a usage request, or make a payment always involves human review and approval (by you, the talent, or by our administrators). We do not use your likeness to train external models, and we do not share your photos with third parties for their own AI training purposes.

6. International Data Transfers

Your personal data may be processed and stored outside the EEA, the UK, or Switzerland — including the United States. We transfer personal data outside these regions only where appropriate safeguards are in place, as required by Chapter V of the GDPR, including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement / Addendum, an adequacy decision, or another recognised transfer mechanism. You may request a copy of the safeguards used by contacting us.

7. How Long We Keep Your Data

We keep your personal data only as long as necessary to fulfil the purposes in this policy and to meet our legal and evidentiary obligations:

• Account data is kept while your account is active and for a reasonable period after closure to handle disputes and legal obligations.
• Consent forms, signature records, transaction records, and project-completion documentation are retained permanently as part of TalentCastIQ's legal record, to evidence consent, licensing, and compliance.
• Usage and device data is kept for the minimum period necessary, unless a longer retention is required by law.

When data is no longer needed, we delete or irreversibly anonymise it in accordance with the GDPR's storage-limitation principle.

8. Your GDPR Rights

If you are a resident of the EEA, the UK, or Switzerland, you have the right to:

• Access your data and receive a copy (Art. 15).
• Rectify inaccurate data and complete incomplete data (Art. 16).
• Erasure — request deletion, subject to the legal retention obligations in Section 7 (Art. 17).
• Restrict processing of your data in certain circumstances (Art. 18).
• Portability — receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests and to direct marketing (Art. 21).
• Withdraw consent for any processing based on consent, without affecting prior lawfulness (Art. 7(3)).

To exercise any right, contact us through the in-app Help / Support feature. We will verify your identity before responding and reply within one month, extending where necessary for complex requests, in accordance with Article 12(3) GDPR.

9. Automated Decision-Making

We use AI to generate imagery as described in Section 5, but we do not use solely automated processing that produces legal or similarly significant effects concerning you. Licensing, approvals, and payments always involve human review. You are therefore not subject to the right under Article 22 GDPR beyond what is described here.

10. What Happens If You Don't Provide Data

Providing your personal data is not a legal requirement, but it is necessary to use the Service. Without account data, profile data, and the reference photos needed to generate your talent listing, we cannot create your account or your listing, and you will not be able to use the Service. There are no other consequences beyond not being able to use it.

11. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect data from children under 16 without verified parental or guardian consent. Talent users under 18 must have their account managed by a parent or legal guardian, who must accept this Privacy Policy and the Terms & Conditions on the minor's behalf, provide consent, and manage all earnings and approvals. Where the age of digital consent under national law is higher than 16, that higher age applies.

12. Security

We use appropriate administrative, technical, and physical measures to protect your data, including encryption in transit, access controls, audit logging, and staff training, in accordance with Article 32 GDPR. No method of transmission or storage is completely secure, but we take reasonable steps to safeguard your data.

13. Right to Lodge a Complaint

You may lodge a complaint with your local data-protection supervisory authority if you believe our processing infringes the GDPR or other applicable data-protection law. We would appreciate the opportunity to address your concerns first — please contact us before approaching a supervisory authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the Service and updating the "Last updated" date. Where a change requires new consent, we will seek that consent before it takes effect.