Privacy notice · effective 2026-05-25

Privacy.

This notice explains what CastrCastr collects, why, where it’s stored, and what rights you have over it. It applies to everyone who uses castrcastr.com, including waitlist signups, signed-in users (agencies, brands, casting directors), and models whose data agencies upload.

The data controller is CastrCastr. Contact us at hello@castrcastr.com.

What we collect

Waitlist signups. Just your email and a self-selected role (agency, brand, or casting director). We use this to send one confirmation email and to invite you when the platform opens. We do not run a newsletter or drip campaign against this list.

Signed-in users. Email, password (stored hashed by Supabase Auth — we never see it in plaintext), full name (optional), role, and the organisation you belong to. Plus any briefs, submissions, rate notes, and messages you create on the platform.

Models on the platform. When an agency adds a model, we store the model’s name, attributes (gender, age, height, physical measurements, skin tone, hair colour, eye colour), city, country, profile and comp-card images, and rate bands. This is first-party data the agency provides — either by hand or by connecting Syngency. Models are not direct CastrCastr users today.

Integration credentials. If you connect Syngency, we store your subdomain and API key. The API key is encrypted at rest with AES-256-GCM; only the sync engine (a server-side process) can decrypt it.

Technical data. Standard web-server logs (IP address, request path, user agent, timestamp) are kept by Vercel for operational and security purposes. We don’t run third-party analytics or ad pixels.

How we use it

To run the platform: serving your account, scoring matches against your brief, routing submissions, sending notification emails when something moves in your queue, and syncing rosters from connected integrations.

To improve the matching engine: every shortlist, offer, and booking through the platform is recorded with timestamps so the engine can learn what fits each brand. This is per-brand learning — your booking history is never used to inform another brand’s matches.

To talk to you: transactional notifications (status changes, rate negotiations, sync results), and the one-off waitlist confirmation.

We do not sell data. We do not use it for ad targeting. We do not train third-party models on it.

Who sees what

Brands see models that match their brief, with agency, criteria scores, and reasoning — but never the model’s rate. A model is only ever surfaced to a brand if the agency’s rate band sits within the brand’s ceiling.

Agencies see briefs and matches scored against their roster — but never the brand’s budget figure. The matching engine handles rate compatibility silently.

Casting directors see live briefs and a cross-agency directory.

Row-level security on the database enforces the above. The only code paths that bypass it are trusted server-side jobs (matching, sync, notifications).

Where it’s stored

On Supabase’s managed Postgres (EU region) and Supabase Storage for images. Transactional email is sent via Resend. Hosting is Vercel. Each of these providers is GDPR-compliant and has a Data Processing Agreement with us.

How long we keep it

While your account is active, plus a short retention window after closure for legal and audit purposes. Booking records are kept longer than account data for the same reason. You can request deletion at any time — see below.

Your rights

Under UK / EU GDPR you can:

• Request a copy of the personal data we hold about you;
• Ask us to correct anything that’s inaccurate;
• Ask us to delete your data (subject to records we’re obliged to keep);
• Object to processing or restrict it;
• Withdraw consent for processing where consent is the basis.

Email hello@castrcastr.com and we’ll respond within 30 days. If you’re not happy with our response, you can complain to the UK Information Commissioner’s Office (ico.org.uk).

Changes to this notice

If we change anything material, we’ll update the effective date at the top and notify signed-in users by email or in-app. Older versions are available on request.