Privacy policy

Who we are

Filmme is an early-stage project run by Anton Stasyuk, an individual. There is no registered company behind it yet. That means one person, not a business entity, is responsible for your data and answers your requests. If a company is formed later, it takes over this service and these commitments, and we will tell you by email before that happens.

For anything in this policy, write to hello@filmme.io. A real person reads it.

The operator is based in Spain, so the GDPR and Spanish data protection law apply to everything Filmme does, wherever you live. We are the data controller for your account and your profile. An agency you join is a separate controller for what it does with the profiles it can see.

What we collect

Account details you give us when you sign up:

• Name and email address
• Phone number, if you add one
• Your password, stored only as a hash we cannot reverse
• Two-factor secret and backup codes, if you turn two-factor on
• Your measurement unit preference and the date of your last login

Performer profile details, all optional except date of birth, and all entered by you:

• Date of birth, which we use for your age
• Gender, height, weight and body measurements, clothing and shoe sizes
• Hair colour and length, eye colour, appearance, skin tone, build, tattoos
• Whether you are willing to cut, colour or shave your hair for a role
• Bio, skills, spoken languages and level, city, availability status
• Photos, headshot and showreel links you upload

Agency details, if you run one: agency name, address slug, logo, who the members are, their role in the agency, and invitations you send.

Technical records created by using the site:

• Session records, each with an IP address, browser user agent and timestamps
• Delivery events for emails we send you, such as delivered, opened or bounced
• Server logs kept by our hosting provider

We do not buy data about you from anyone, and we do not build a profile of you from other sites.

Sensitive details and what we deliberately leave out

Physical description and photos are the working material of casting, so a casting profile cannot avoid them. We keep the list as narrow as the job allows.

We do not ask for ethnicity, heritage, nationality, religion, health, sexual orientation, political views or trade union membership, and we will not add a field for any of them. Appearance and skin tone exist because casting briefs use them, and they are not a stand-in for ethnicity.

We do not run face recognition or any other biometric matching on your photos, so they are ordinary personal data rather than biometric data under the GDPR.

Your bio is a free text field. If you write something sensitive in it, that is your choice and your consent, and you can edit or clear it at any time.

Why we use it, and our legal basis

• To run your account, your profile and your agency memberships. Legal basis: performing our contract with you.
• To send service email you need, such as address verification, password resets and invitations. Legal basis: performing our contract with you.
• To show your profile publicly, or to an agency you joined. Legal basis: your consent, given by the visibility setting you pick and by joining the agency.
• To keep the service secure, stop abuse and fix faults. Legal basis: our legitimate interest in a working, safe service.
• To meet a legal obligation, if one ever applies to us. Legal basis: legal obligation.

We do not use your data to train machine learning models, and we do not use it for advertising.

Who can see your profile

Visibility is yours to set, and it starts at the most private useful setting:

• Private: only you, and any agency you belong to.
• Unlisted, the default for a new profile: reachable only by the exact link you share, and never listed in a public search.
• Public: your profile page can be found and indexed.

An agency you join always sees the profiles of its own performer members. That is a separate decision from your public visibility setting, and you make it by accepting the invitation. Leaving the agency ends that access.

The operator can access data in the database when needed to run the service, investigate a fault or answer your request. Nobody else has an account that can browse your data.

Companies that process data for us

We use as few outside services as we can, and each one is bound by a data processing agreement to act only on our instructions:

• Railway: application hosting, the Postgres database and the storage bucket holding your photos.
• Resend: sending service email, and reporting whether it arrived.
• Google Fonts: the site loads two fonts from Google's servers, which means Google sees the IP address of your browser when a page loads.

We do not sell your data, we do not share it with advertisers, and we do not use data brokers.

Our providers may store or process data outside the country you live in, including in the United States. Where the GDPR applies, those transfers rely on the European Commission's standard contractual clauses in our agreements with them.

Cookies and browser storage

• A session cookie that keeps you signed in. The site cannot work without it.
• Your theme choice, light or dark, kept in your browser's local storage.
• An unfinished sign-up form, kept in your browser's session storage so a refresh does not lose it. Your password is never part of that.

We run no analytics, no advertising pixels and no third-party trackers, which is why you are not being asked to accept cookies.

How long we keep it

• Account and profile data: while your account exists.
• Deleting your account: your profile, photos, memberships and account record are deleted from the live database straight away.
• Backups: deleted data can survive in encrypted database backups for up to 30 days, after which the backup rotates out.
• Session records: until the session expires or you sign out.
• Email delivery events: up to 12 months, so we can investigate mail that fails to arrive.

Your rights over your data

Under the GDPR you can ask us to do any of the following, free of charge:

• See what we hold about you.
• Get a copy in a portable, machine-readable format.
• Correct anything that is wrong.
• Delete your account and everything in it.
• Restrict or object to a use you disagree with.
• Withdraw a consent you gave, such as making your profile public, without affecting what was lawful before you withdrew it.

Most of this you can do yourself, right now: edit your profile, change its visibility, leave an agency, or delete your account from Settings. Deletion is confirmed by a link we email you, so nobody can delete your account by walking past your screen.

For anything you cannot do in the app, including asking for a copy of your data, email hello@filmme.io. We answer within 30 days.

If you think we have handled your data badly, please tell us first so we can fix it. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority in the country where you live or work.

How we protect it

• Passwords are stored as salted hashes, never in readable form.
• Everything travels over HTTPS.
• Two-factor authentication is available on every account, and we recommend turning it on.
• Photos are served through the application rather than from a public bucket, so a private profile's images are not left open on the internet.
• Database and storage credentials are held by the operator alone.

No service is perfectly secure, and a small project should not pretend otherwise. If a breach ever affects your data, we will email you without undue delay and notify the relevant supervisory authority within 72 hours where the law requires it.

Age

Filmme is for adults. You need to be 18 or older to create an account. We do not yet support profiles for performers under 18, because a minor's profile needs guardian consent and controls we have not built. If we learn that an account belongs to someone under 18, we delete it.

Changes to this policy

As Filmme grows, this policy will change. The date at the top always shows the current version. If a change materially affects your rights or how we use your data, we will email you before it takes effect.

Contact

Privacy questions, data requests and complaints: hello@filmme.io.