Privacy Policy
CastingSpotlight (“we,” “us,” or “our”) respects your privacy. This policy explains what personal data we collect, how we use it, and the choices you have.
You can download or delete your account data at any time from your account settings.
1Information we collect
- Account data: name, email, display name, role (actor / casting / agency / crew), organization, and password hash (never your plain password).
- Profile data: headshots, self-tapes, resumes, measurements, unions, credits, skills, and other fields you provide.
- Usage & device data: IP address, browser type, pages viewed, and interactions (for security and analytics).
- Communications: messages you send through the platform, support requests, and feedback.
- Payment data: handled by our payment processor (Stripe). We store limited billing metadata (e.g. plan, status) but never full card numbers.
2How we use information
- Provide, maintain, and improve the Service (search, listings, applications, messaging).
- Personalize features, recommend roles or talent, and operate safety / anti-abuse measures.
- Communicate with you (service notices, security alerts, changes to terms, optional marketing).
- Comply with law, enforce our Terms, and protect the platform and our users.
3Legal bases (EEA / UK)
- Contract: to provide the Service you requested.
- Legitimate interests: to secure and improve the Service, prevent abuse, and understand usage.
- Consent: for optional marketing or non-essential cookies, where required.
- Legal obligation: to meet applicable laws and regulations.
6Data retention
We keep data only as long as necessary to provide the Service and for legitimate business or legal purposes. The summary below shows our standard retention windows; full details are maintained in our internal Data Retention Schedule.
| Category | Retention | When it’s removed |
|---|---|---|
| Account identity (name, email) | Lifetime of account | On deletion or after 36 months of inactivity |
| Profile content (photos, resume, self-tapes) | Lifetime of account | Within 7 days of deletion (backups expire ≤ 30 days) |
| Listings & applications | 24 months after listing closes | Anonymized after the retention window |
| Messages | 24 months from last message | Auto-purged on schedule |
| Payment metadata (Stripe IDs, invoices) | 7 years | Required by tax / accounting law |
| Security audit logs | 24 months | Aggregated then deleted |
| Verification & password-reset tokens | ≤ 24 hours | On use or expiry |
| Backups | 30 days rolling | Overwritten daily |
Retention may be extended where required by law, by a legal hold, or to investigate fraud, abuse, or safety concerns.
7Your rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you (GDPR Art. 15).
- Receive a portable copy of your data in a machine-readable format (Art. 20).
- Correct inaccurate data (Art. 16).
- Delete your account and personal data (Art. 17, “right to be forgotten”).
- Object to or restrict certain processing (Art. 21 / 18).
- Withdraw consent at any time, where processing is based on consent.
You can exercise the access, portability, and deletion rights directly from your account settings. For all other requests, email privacy@castingspotlight.com.
8Children’s privacy
We do not knowingly collect personal information from children under the age required by local law without appropriate consent. If you believe a child has provided us personal data, please contact us so we can remove it.
9Security
We use reasonable technical and organizational measures to protect your data — including encrypted transport (HTTPS), hashed passwords (bcrypt), strict content-security policy, CSRF protection, rate limiting, and audit logging on administrative actions. No method of transmission or storage is 100 % secure.
10International transfers
Your data may be transferred to and processed in countries other than your own. We take steps to protect your data consistent with this Policy and applicable law.
11California privacy rights (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, disclose, and (if applicable) sell or share.
- Access a copy of the personal information we hold about you.
- Delete personal information we have collected, subject to legal exceptions.
- Correct inaccurate personal information.
- Limit the use of sensitive personal information.
- Opt out of sale or sharing of personal information for cross-context behavioral advertising.
- Non-discrimination for exercising any of the above rights.
We do not sell your personal information as the term "sell" is defined under the California Consumer Privacy Act (CCPA), and we do not "share" it for cross-context behavioral advertising. If this changes, we will update this policy and add a clear "Do Not Sell or Share My Personal Information" link.
To exercise any of these rights, use your account settings or email privacy@castingspotlight.com. We will verify your request and respond within 45 days (extendable once by 45 days where permitted).
12Breach notification
In the event of a personal-data breach likely to result in a risk to your rights or freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (per GDPR Art. 33) and notify affected users without undue delay where required by law (Art. 34, U.S. state breach laws).
13Changes to this Policy
We may update this Policy. If changes are material, we’ll provide notice as required by law. Your continued use after the effective date means you accept the updated Policy.
14Contact
Questions or requests? Email privacy@castingspotlight.com or visit our support page.
This document is provided for your convenience and does not constitute legal advice.