Privacy Policy

Who is responsible for your data

The data controller is Castalio, which operates the Castalio platform.

Our person in charge of the protection of personal information is [responsable à nommer]. You can reach them at [email protected] with any question or request about your data. Address: [adresse à confirmer après l’immatriculation].

Representative in the European Union (Article 27 GDPR): [représentant à désigner avant l’ouverture dans l’UE]. Representative in the United Kingdom: [représentant à désigner avant l’ouverture au Royaume-Uni].

Castalio welcomes members worldwide. We use the European Union's General Data Protection Regulation (GDPR) as our baseline and add the requirements of each jurisdiction, including Québec's Law 25, Canada's PIPEDA, California's CCPA/CPRA and other US state laws, and Brazil's LGPD. When several regimes apply, we apply the one most favourable to you.

The data we collect

• Account: email address, password (stored only in hashed form that no one can read back), security settings such as two-factor authentication.
• Profile: photos, videos, audio, bio, location and travel areas, rates, role-specific details, availability, declared work preferences.
• Identity verification: a non-reversible biometric template, meaning a set of numbers computed from your face that cannot be used to rebuild it. The live capture is processed in memory and deleted immediately; only the encrypted template is kept. No photo of your face is kept for verification. This verification is never mandatory: a manual verification without biometrics is always offered. It will only be switched on after a privacy impact assessment and its prior declaration to Quebec's Commission d'accès à l'information, as required by the Act to establish a legal framework for information technology.
• Age verification: the result (above the threshold or not) and the level of check reached.
• Messages, references, castings, bookings and image releases signed on the platform.
• Payments: payments are handled by our payment providers. We never store your card number. We keep your subscription, invoice and refund history.
• Technical data: login logs, device, IP address, approximate country, security events.
• Cookies: according to your choices, see our Cookie Policy.

Why we use it and on what basis

How long we keep it

Deletions are carried through to our backups according to our retention schedule.

Our service providers

We rely on providers bound by contract, who may use your data only to provide their service to us.

Transfers outside Québec and Canada

Some of our providers are based in or process data outside Québec and Canada, notably in the United States. As required by Québec's Law 25, we are telling you so explicitly.

Before any transfer, we assess the protection offered and cover the transfer by contract (for example the European Union's standard contractual clauses), with encryption in transit and at rest.

Location, profiling and artificial intelligence

We use no precise location technology and no advertising profiling. The only location signal is the approximate country derived from your IP address, used for your account security (new sign-in alerts) and legal compliance (geographic blocking). Your city is only visible if you add it to your profile yourself.

We do not sell your data, and we do not use your media or messages to train artificial intelligence models.

Your rights

• Access your data and get a copy.
• Have it corrected.
• Have it erased.
• Receive it in a readable format (portability).
• Withdraw your consent at any time, including for biometrics and cookies.
• Object to processing or ask for it to be restricted.
• Be informed of any decision based solely on automated processing (for example a verification result, the automatic suspension of an account matching known illegal content, or a suspicious message being blocked), know the information and main factors used, and submit your observations to a member of our team who can review the decision.
• Opt out of the sale or sharing of your data. We do not sell your data.
• Lodge a complaint with the competent authority, such as Québec's Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada or your country's data protection authority.

How to exercise your rights

Most rights are self-service from your data management page: export your data, delete your account, view and change your consents.

You can also write to [email protected]. We answer within 15 days, for every member, whatever their country. We may verify your identity before answering, to protect your account.

Security

• Encryption of data in transit and at rest; stronger encryption for the biometric template.
• Two-factor authentication available to everyone, mandatory for staff.
• Access partitioning: each staff member can reach only what their task requires.
• No default access to private conversations or verification data. Any exceptional access requires a reason, is time-limited and is recorded in a log no one can alter.
• Login history visible to you, with one-click sign-out of all sessions.

If an incident occurs

Every incident involving personal information is recorded in our incident register. When it poses a risk to you, we notify you and the competent authority within the time required by law, explaining what happened and what you can do.

Minors

Castalio is for people aged 18 and over. If we learn that an account belongs to a minor, it is removed. Any content involving a minor is blocked, preserved as evidence and reported to the authorities. You can report such a case to [email protected].

Changes to this policy

If we change this policy, we notify you before significant changes take effect. The version history remains available, and the version you accepted is kept on record.