Privacy Policy

[COMPANY_NAME](“we”, “us”, “our”) is the data controller responsible for the personal data you provide when using the Models Around Me platform (“Platform”).

Data Protection Officer (DPO)

We have appointed a Data Protection Officer who is responsible for overseeing questions about this Privacy Policy and our compliance with applicable data protection law. You may contact the DPO at any time:

DPO Email: [DPO_EMAIL]

This policy applies to all personal data processed by [COMPANY_NAME] in connection with the Platform, including data collected from models, visitors, and prospective users worldwide.

We collect personal data in the following categories:

For users in the EU, EEA, and UK we are required to identify a lawful basis for each category of processing. The table below maps each data category to its primary legal basis:

Where processing is based on legitimate interests, we have carried out a balancing test and determined that our interests do not override your rights. You may object to such processing at any time (see Section 8).

Profile Display

Profile and listing data is displayed publicly on the Platform to allow visitors to find and contact models. You control what information appears in your profile via your account dashboard.

Account Management

Account data is used to authenticate you, manage your session, send account-related notifications (e.g. password reset, email verification), and provide customer support.

Payment Processing

Payment data is used to process Premium Membership subscriptions, generate invoices, and handle billing disputes. We transmit only a minimal identifier to our payment processor; we retain only transaction references and plan details.

Analytics & Platform Improvement

Where analytics consent is given, usage and technical data are used to understand how visitors use the Platform, identify popular pages, diagnose performance issues, and plan improvements. Analytics data is aggregated and anonymised after 90 days.

Content Moderation & Fraud Prevention

Technical and account data are used to detect and prevent fraudulent accounts, enforce our Terms of Service, review reported content, and comply with law enforcement requests. This processing is based on our legitimate interest in operating a safe and lawful platform.

Legal Compliance

We process data as required to comply with applicable law, including age verification obligations, tax and accounting requirements, and responses to valid legal process from courts or regulatory bodies.

Communications

We use your email address to send transactional messages (receipts, security alerts, account updates) and, where you have opted in, promotional communications about features and offers. You can unsubscribe from marketing emails at any time via the link in the email or in your account settings.

We do not sell, rent, or trade your personal data. We share data only with the following categories of trusted third-party service providers, and only to the extent necessary for them to provide their service to us:

We may also disclose personal data where required by law, court order, or regulatory demand; to protect the rights, property, or safety of [COMPANY_NAME], our users, or the public; or in connection with a merger, acquisition, or asset sale (in which case we will notify affected users).

Because we operate a global platform, your personal data may be transferred to and processed in countries other than the one in which you are resident, including countries that may not provide the same level of data protection as your home country.

Primary Processing Locations

Data stored on Supabase may be located in the EU (where the project is configured to use an EU region), or in the United States. Vercel edge nodes are distributed globally and may process request metadata in any region.

Safeguards for Transfers

For transfers from the EU/EEA or UK to countries without an adequacy decision, we rely on one or more of the following safeguards:

• Standard Contractual Clauses (SCCs)— the European Commission’s approved model clauses incorporated into our Data Processing Agreements with sub-processors.
• UK International Data Transfer Agreements (IDTAs) — for transfers from the UK where SCCs do not apply.
• Adequacy decisions— where the European Commission or UK Information Commissioner’s Office has recognised the destination country as providing adequate protection.

For transfers from Brazil under LGPD, we rely on standard contractual clauses and contractual guarantees with sub-processors. You may request a copy of the relevant transfer safeguards by emailing [DPO_EMAIL].

We retain personal data only for as long as necessary for the purpose for which it was collected, to provide our services, and to comply with legal obligations. The schedule below summarises our standard retention periods:

When you delete your account, your profile and listing data are removed from public view immediately and permanently deleted from our systems within 30 days, except where retention is required by law (e.g. payment records) or where data has been included in an aggregated anonymised dataset.

Depending on where you are located, you have various rights over your personal data. We honour all of the following rights for all users regardless of jurisdiction, to the extent technically feasible:

Rights Under GDPR / UK GDPR (EU, EEA, UK)

• Right of access (Art. 15) — obtain a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure / “right to be forgotten” (Art. 17) — request deletion of your data where there is no lawful reason for us to continue processing it.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to restriction of processing (Art. 18) — ask us to pause processing while a dispute is resolved.
• Right to object (Art. 21) — object to processing based on legitimate interests, including profiling.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — with your national supervisory authority (see the Regional Addendum).

Rights Under CCPA / CPRA (California Residents)

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to delete — request deletion of personal information we hold about you, subject to certain exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising. See “Do Not Sell My Personal Information” in the Regional Addendum.
• Right to limit use of sensitive personal information — we do not use sensitive personal information beyond the purposes permitted by the CPRA.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

Rights Under LGPD (Brazilian Residents)

• Confirmation & access (Art. 18 I–II) — confirm the existence of and access your personal data.
• Correction (Art. 18 III) — correct incomplete, inaccurate, or outdated data.
• Anonymisation, blocking, or deletion (Art. 18 IV) — request anonymisation, blocking, or deletion of unnecessary or excessive data.
• Portability (Art. 18 V) — receive your data in an interoperable format.
• Deletion of consent-based data (Art. 18 VI) — request deletion of data processed on the basis of consent.
• Consent information (Art. 18 VII–VIII) — obtain information about third parties with whom we have shared your data and about your ability to withdraw consent.
• Review of automated decisions (Art. 20) — request review of decisions made solely through automated processing.

How to Exercise Your Rights

You may exercise any of the above rights through the following channels:

• By email: [DPO_EMAIL] — include your full name, email address, a description of your request, and (if possible) proof of identity.

We will respond to all requests within 30 calendar days. Where a request is particularly complex or numerous, we may extend this by up to a further 60 days. We will inform you of any extension within the initial 30-day period. We will not charge a fee for reasonable requests; we reserve the right to charge a reasonable fee or refuse manifestly unfounded or excessive requests.

The Platform is strictly for adults aged 18 and over. We do not knowingly collect, use, or store personal data from anyone under the age of 18.

All model accounts require age verification before a listing becomes active. Visitor access to the Platform requires confirmation of adult status. If we become aware that we have inadvertently collected personal data from a person under 18, we will delete that data immediately, terminate the relevant account, and — where required by law — notify the appropriate authorities.

If you believe a person under 18 has created an account or appears in content on the Platform, please contact us immediately at [DPO_EMAIL] with the subject line “Minor — Urgent”.

Technical Safeguards

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Database storage and file storage are encrypted at rest by our hosting provider (Supabase).
• Password hashing: Passwords are hashed using a strong adaptive hashing algorithm (managed by Supabase Auth); we never store or transmit plaintext passwords.
• Access controls: Access to personal data is restricted to personnel who require it to perform their duties. All internal access is authenticated and logged.
• Verification documents: ID documents and selfies are stored in a private, non-public storage bucket inaccessible without authenticated, time-limited signed URLs.

Organisational Safeguards

• Regular internal security reviews and audits of data handling practices.
• Staff involved in data processing are trained on data protection obligations.
• Data Processing Agreements (DPAs) are in place with all sub-processors.

Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay in accordance with Article 34.

No security system is impenetrable. While we take appropriate measures to protect your data, we cannot guarantee absolute security against all threats.

We use cookies and similar tracking technologies to operate the Platform and, where you consent, to analyse usage. A brief summary:

• Strictly necessary cookies are set automatically and cannot be disabled — they are required for authentication and security.
• Analytics cookies are only set after you explicitly consent via our cookie banner.
• Marketing cookies are only set after explicit consent and are not currently active.

For a full list of cookies, their purposes, providers, and durations, and for instructions on managing your preferences, please see our Cookie Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we do:

• We will update the “Last updated” date at the top of this page.
• For material changes (i.e. changes that significantly affect how we use your data or your rights), we will provide at least 30 days’ notice by email to registered models and by a prominent notice on the Platform.
• For minor clarifications that do not affect the substance of the policy, we may update the page without individual notification.

Your continued use of the Platform after the effective date of a revised policy constitutes your acknowledgement of the changes. If you do not agree with a material change, you should delete your account before the change takes effect.

For any privacy-related questions, data subject requests, or complaints, please contact our Data Protection Officer:

We are committed to responding to all privacy enquiries within 30 calendar days. For urgent matters (e.g. a potential data breach involving your account), please mark your email with the subject line “URGENT — Privacy”.