Privacy Policy

Last updated: [DATE] — placeholder, set this when this page is actually published.

Before you publish this: this reflects what CastMaster actually collects and how it's actually handled today, not filler text. It is not a substitute for legal review — if you expect users in the EU/UK or California, have someone qualified confirm GDPR/CCPA-style obligations (data subject requests, a lawful basis for each use, etc.) before publishing this as your real policy.

1. What this covers

This Privacy Policy explains what data CastMaster collects when you use the Service, why, and what choices you have. It applies to the CastMaster web application at [DOMAIN].

2. Data you give us directly

  • Account data: username, email address, and a hashed password (we never store your password in plain text).
  • Production Data: information you or your team enter about a production — actor names, dates of birth, nationality, gender, biography text, headshots and reference photos, role details, scene and blocking information, wardrobe/makeup/décor/lighting notes, call sheet details, and cast/crew scheduling.
  • Payment data: for crypto payments, the wallet address and transaction hash you submit, which we verify on-chain — we never see or store a private key or seed phrase. [If/when card payment is enabled: billing details are handled directly by Stripe; we store a Stripe customer/subscription reference, not your card number.]

3. A note on actor and cast data specifically

Most personal data in CastMaster belongs to people who aren't the account holder — the actors, crew, and collaborators you're managing a production for. You (the account holder) are responsible for having a lawful basis to collect and store that data and for telling those individuals how their information is being used. We act as a processor of that data on your behalf — we don't use it for our own marketing, don't sell it, and only access it to operate, secure, and support the Service.

4. Data collected automatically

  • Basic technical logs (IP address, request timestamps, user agent) for security, debugging, and abuse/rate-limit prevention.
  • A single functional cookie used only during scheduled maintenance windows, to let our team verify a deploy before reopening the Service to everyone. It carries no tracking or advertising purpose.
  • We don't use third-party advertising trackers or sell data to data brokers.

5. How we use data

  • To provide and operate the Service (storing and displaying your Production Data, authenticating your account, generating call sheets, etc.).
  • To process and verify payments and maintain your subscription status.
  • To secure the Service (rate limiting, fraud/abuse prevention).
  • To communicate with you about your account, billing, or material changes to the Service — not for marketing unless you opt in.

6. Who we share it with

We don't sell your data. We share it only with the service providers needed to run CastMaster — our hosting/database provider, and, for payments, the blockchain network you pay on [and, once enabled, Stripe for card payments] — each bound to use it only to provide that service, and with law enforcement if we're legally required to.

7. Data retention & deletion

We keep your account and Production Data for as long as your account is active. If you delete your account or a production, we remove it from active systems within a reasonable period, though it may persist briefly in backups until those cycle out. You can request full deletion by contacting us at [SUPPORT EMAIL].

8. Your choices and rights

  • You can access, correct, or export your account and Production Data from within the app, or by asking us directly.
  • You can request deletion of your account and associated data.
  • If you're in a jurisdiction with statutory data rights (GDPR, CCPA, or similar), those rights apply in addition to the above — contact us to exercise them.

9. Children's data

CastMaster accounts are for adults (see Terms of Service, age 16+). That said, Production Data may legitimately include information about minors — e.g. a young actor cast in a role. If you're entering data about a minor, you're responsible for having the appropriate consent from a parent or guardian to do so.

10. Security

Passwords are hashed, not stored in plain text. Access to the application requires authentication, and API access is rate-limited. No method of storage or transmission is 100% secure, but we take reasonable, industry-standard steps to protect your data.

11. Changes to this policy

If we make a material change to how we handle your data, we'll make a reasonable effort to notify active accounts before it takes effect.

12. Contact

Questions about this policy, or to make a data request: [SUPPORT EMAIL].