Privacy Policy

This Privacy Policy explains how Atla collects, uses, and shares information when you use the beta of The Board / Atla (the "Service"). Because Atla connects Talent with Casting Professionals, sharing certain information is the core function of the Service: when you submit to a casting, your profile is shown to the Casting Professional running it. Please read this policy together with our Terms of Service. 1. WHO CAN USE ATLA / CHILDREN. Talent must be at least 13 years old. We do not knowingly collect personal information from children under 13; if we learn that we have, we delete it — contact team@atla.space. Talent aged 13–17 ("Minors") may only be submitted with the involvement and verified consent of a parent or legal guardian, who provides their own name, email, and phone and confirms consent as part of the submission. A parent or guardian may review, correct, or request deletion of a Minor's information at any time by emailing team@atla.space. Casting Professional accounts are for adults acting in a professional capacity. 2. INFORMATION WE COLLECT. a. Talent profile & casting information you provide: name, email, phone, date of birth (used to determine age and Minor status), pronouns/gender, city or region, Instagram/TikTok handles and portfolio/website links, agency and agent contact details, union status, physical characteristics and sizing (such as height, measurements, and dress/shoe size), ethnicity and other self-described attributes, skills, languages, hobbies, and free-text notes. b. Photos and video ("Media"): headshots, images, and reels you upload or that an agent submits for you. Media may include images of your face and body. We treat Media as sensitive personal information. We store and display Media so Casting Professionals can review it; we do not use facial-recognition or other biometric-identification technology on your Media, and we do not create biometric identifiers from it. c. Casting Professional & account information: name, business and contact details, email, password (stored in hashed form by our authentication provider), and billing information for paid features. d. Submissions & activity: the castings you submit to, roles selected, answers to casting questions, and the projects, rosters, presentations, shortlists, notes, and confirmations created on the Service. e. Presentation viewer information: when a Casting Professional shares a presentation and a viewer identifies themselves in order to shortlist Talent, we collect the name/email they enter and the selections they make. f. Information from others: agents may submit Talent information on their behalf, and we may receive or synchronize information with affiliated casting tools that we operate. g. Information collected automatically: log and device data (such as IP address, browser and device type, pages viewed, and timestamps) and limited analytics used to operate and improve the Service. 3. HOW WE USE INFORMATION. To create and manage accounts and verify age and Minor status; to operate, maintain, secure, and improve the Service; to display Talent profiles and Media to the Casting Professionals to whom they submit or who are shared a presentation; to build rosters, presentations, and confirmation charts; to process payments for paid features; to detect and prevent duplicate profiles, fraud, and abuse; to communicate with you (service messages, casting-related notifications, and, where permitted, updates about the Service); and to comply with legal obligations. 4. HOW WE SHARE INFORMATION. • With Casting Professionals. This is the purpose of the Service: when you submit to a casting or are added to a project, your profile and Media are visible to the Casting Professional running it and to their authorized team members, and may be included in presentations shared with their clients and production. • With agents. If you are represented, your agent may view and manage your submissions. • With service providers (subprocessors) who process information on our behalf under confidentiality obligations — see Section 5. • For legal and safety reasons — to comply with applicable law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and security of our users and the public. • In a business transfer — as part of a merger, acquisition, financing, or sale of assets, subject to this policy. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. 5. SERVICE PROVIDERS / SUBPROCESSORS. We rely on a small set of vendors to run the Service, each bound to process personal information only to provide services to us: • Supabase — database, authentication, and file/Media storage. • Vercel — application hosting and privacy-friendly usage analytics. • Stripe — payment processing for paid features (Stripe handles card details; we do not store full card numbers). • Resend — delivery of transactional and account emails. 6. YOUR RIGHTS & CHOICES. You can view, edit, or delete much of your information directly in the Service, and you can request deletion of your account. Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to opt out of certain processing, and not to be discriminated against for exercising these rights. To exercise any right, email team@atla.space; we will verify your request and respond as required by law. How we handle requests: to protect your information, we take reasonable steps to verify your identity before acting (for example, by confirming control of the email associated with your account); for a Minor, we verify the requesting parent or guardian. We aim to respond within 45 days and will let you know if we need additional time as permitted by law. If we decline a request, we will explain why, and you may appeal by replying to team@atla.space; we will review the appeal and respond within the period your state's law allows. 7. U.S. STATE PRIVACY RIGHTS (INCLUDING CALIFORNIA). Residents of California and of other states with comprehensive privacy laws have the rights described in Section 6. We do not "sell" personal information or process it for "cross-context behavioral advertising" as those terms are defined under the California Consumer Privacy Act (as amended by the California Privacy Rights Act). We collect the categories of personal information described in Section 2, use them for the purposes in Section 3, and disclose them as described in Section 4. We collect certain sensitive personal information (such as Media and, where you provide it, ethnicity) only to provide the Service, and we do not use it to infer characteristics about you. You may designate an authorized agent to make a request on your behalf. Do Not Sell or Share; Global Privacy Control. We do not sell your personal information or share it for cross-context behavioral advertising, so there is no such opt-out to exercise. Where your browser or a browser extension sends an opt-out preference signal such as Global Privacy Control (GPC), we treat it as a valid request not to sell or share, consistent with applicable law. 8. USERS OUTSIDE THE UNITED STATES (EEA / UK). The Service is operated from the United States, and your information will be processed there. Where the EU or UK GDPR applies, our legal bases for processing are: performance of a contract (providing the Service you request); our legitimate interests (operating, securing, and improving the Service and preventing abuse); your consent (for example, for submitting Media and sensitive information, and for Minor submissions made through a guardian); and compliance with legal obligations. You have the rights of access, rectification, erasure, restriction, portability, and objection, and you may lodge a complaint with your local supervisory authority. International transfers are made with appropriate safeguards. 9. RETENTION. We keep your information while your account is active and as needed to provide the Service. After your account is closed or the information is no longer needed, we delete or de-identify it within a reasonable period (generally no later than 12 months), unless a longer period is required by law or to resolve disputes and enforce our agreements. In general: active profiles and their Media are kept while the account is active; a casting submission and the roster, presentation, notes, and confirmations tied to a project are kept for as long as the Casting Professional keeps that project, then deleted or de-identified; account, log, and security records may be retained for up to 12 months after an account is closed; and billing records are kept for as long as tax and accounting law requires. We honor deletion requests as described in Sections 1 and 6, subject to these legal exceptions. 10. SECURITY. We use reasonable technical and organizational measures, including encryption in transit and at rest, access controls, and least-privilege data access. No method of transmission or storage is completely secure, and Atla is in beta and may be more exposed than a mature production service. If we become aware of a security breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law, without undue delay. 11. COOKIES & ANALYTICS. We use cookies and similar technologies for authentication, to remember your preferences, and for basic usage analytics. You can control cookies through your browser settings; disabling some may affect how the Service works. 12. THIRD-PARTY LINKS. The Service may link to third-party sites (for example, portfolio or social media links). Their privacy practices are governed by their own policies, not this one. 13. CHANGES. We may update this policy from time to time. We will post the revised policy with a new "Last updated" date and, for material changes, provide additional notice or ask you to re-accept it. 14. CONTACT. Tasha Tongpreecha LLC — team@atla.space.