Privacy

What this covers

This draft covers the product site at www.casttool.net, signing in and the account on app.casttool.net, the subscription and the reporting channel. It applies to you as a visitor, as someone interested in CastTool and as a contact person at an agency or casting office that uses CastTool.

Each agency is responsible for its own website and for everything an agency or casting office manages in CastTool, such as models, applications, clients and bookings. CastTool processes that data on the agency's behalf under the data processing agreement (DPA). The agency can tell you more, and its legal notice is on its website.

Controller

The controller is the operator named above and in the legal notice, once entered there. open: company, address and data protection contact

Whether a data protection officer has to be appointed hasn't been checked yet. open: data protection officer

Visiting the pages

When you visit, the server processes technically necessary data such as your IP address, the time, the address requested and your browser identifier. The pages are delivered through Cloudflare, which acts as the delivery network, provides DNS and protects against attacks. Cloudflare receives this data as well.

Legal basis: open, proposed for review: legitimate interest in running the service securely, Art. 6(1)(f) GDPR. Retention of the logs on the server and at Cloudflare: open.

Cookies and analytics

The product site itself sets no cookies and includes no analytics or advertising services. Fonts are served from our own server.

Cookies only come into play when you sign in on app.casttool.net, and only those that signing in technically needs. The link in the confirmation email and the log-in link take you there.

Forms and bot protection

The pages for signing up and for reporting content each have a form. When you submit it, Cloudflare Turnstile checks that the request comes from a person. Only then does your browser load a script from challenges.cloudflare.com, and Cloudflare receives technical data such as your IP address. The review will add exactly what Cloudflare processes and whether anything is stored in your browser.

To stop anyone from using the forms in bulk, the server counts requests per IP address and per email address. All it stores for this is a key from which the address can't be worked out, and only for as long as the count runs.

Signing up and your account

When you sign up, we process your email address to send you the confirmation link. The link is valid for 24 hours. When you create the account, your name, a password, the name of the agency or casting office and the chosen subdomain are added. We only store the password as a hash. We record which version of the terms you agreed to and when.

Each time you sign in, we store the time, IP address and browser identifier so that you and we can spot unauthorised access. A second factor is available. Retention of this data: open.

Legal basis: open, proposed for review: contract and pre-contractual steps, Art. 6(1)(b) GDPR, and legitimate interest for the sign-in log, Art. 6(1)(f) GDPR.

Subscription and payment

The subscription runs through Stripe. You enter payment details such as your card number directly with Stripe, and CastTool neither sees nor stores them. CastTool stores the Stripe customer and subscription identifiers and the status of the subscription.

If an agency accepts payments from its clients through CastTool, it does so through its own Stripe account, and the agency is responsible for that. open: what agencies and their clients need to be told about Stripe

Emails

Emails from the platform and from agencies are sent by Mailgun in its EU region. Mailgun tells us when an address can't be reached or a recipient has complained, and no further mail goes to that address. Opens and clicks aren't tracked.

Reports about content

When you report content, we process the address of the page, the type you chose, your description and, if you provide them, your name and email address. Only platform staff can see the text, after signing in with a second factor. If you give your email address, you get a confirmation of receipt.

Legal basis: open, proposed for review: legal obligation under Art. 16 DSA, Art. 6(1)(c) GDPR. Retention: open. How reports are handled is described on the page “Notices and moderation”.

Error tracking

If error tracking is switched on, a technical error sends a report to GlitchTip with details such as the address requested, the time and the browser. open: who runs GlitchTip and where, what reports contain and how long they are kept

Recipients and transfers to third countries

We use these service providers. The list with purpose and location is also in the DPA.

Cloudflare, Mailgun and Stripe are companies based in the USA or with a US parent company. The basis on which data may go there still has to be checked for each provider. open: adequacy decision or standard contractual clauses for each provider

• Server and database: open: provider and location of the server
• Backups: Hetzner Storage Box according to the operations documentation, open: location
• Delivery, DNS, protection and Turnstile: Cloudflare
• Sending email: Mailgun, EU region
• Subscription and payment: Stripe
• Error tracking: GlitchTip, open: who runs it

Retention

We keep data for as long as the account exists and the purpose requires it. Periods already built into the product are listed below. They are proposals and part of the review. How long backups and invoices are kept is still open. open: backups, invoices, logs

• Confirmation link when signing up: 24 hours
• Finished export of an account: 7 days to collect
• Deleting an account: 30 days after the request, and it can be undone until then
• Account suspended for non-payment: the deletion period starts by itself 60 days after the suspension

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time with effect for the future. You can complain to a data protection supervisory authority.

To do so, contact the data protection contact named above. If it's about data an agency manages in CastTool, contact the agency. We forward requests that reach us to the agency. open: competent supervisory authority

Changes

Every version of this information has a label, shown above. Earlier versions are kept in the archive.