Privacy Notice

1. Controller and contact

The legal operator identified below is the controller for personal data used to operate JoinModels. Contact info@joinmodels.com or use the Contact page and select Privacy / data rights. If you deal with a business about a project, that business may separately control the information it receives for its own casting, contracting and record-keeping purposes.

This notice covers the platform's own processing. It does not replace the privacy notices of independent businesses, PayPal, social networks or other external services. Applicable requirements may include Albania's Law no. 124/2024 and the EU GDPR where its territorial conditions are met.

2. Information you provide

Account information includes your name, surname, email, password hash, adult date-of-birth information, account role and status. A business account can include company, registration and website details. Profile information can include gender, location, bio, measurements, appearance, skills, languages, experience, availability, fees, travel preferences and social links.

You may supply portfolio photographs, profile videos, audition videos, applications, invitations, messages and meeting responses. If you request identity verification, we process the document and selfie you submit, document type, review status and review notes. General contact requests contain your name, email, selected topic, message, submission reference and handling status. Do not send identity documents or payment-card data through the general contact form.

3. Information generated by use and payments

The platform generates records of account activity, saved profiles or searches, notifications, project workflows, acceptance of Terms, billing status and administrative actions. Security controls can use an IP-derived keyed hash for rate limiting. The hosting and network infrastructure may also record IP addresses, browser details, request times and error information for delivery and security.

PayPal supplies identifiers, subscription status, currency, amounts and transaction events needed to reconcile payments and determine paid access. We do not obtain your full card details or PayPal password. Optional web push uses a browser-issued endpoint and encryption keys together with device preferences and queued notifications.

4. Purposes and legal bases

We use account, profile and collaboration information to provide the service you request and administer the platform contract. Required fields support account access, adult eligibility, location matching, applications and communication. If you do not supply a required field, the relevant feature may be unavailable. Optional profile details remain your choice.

We use billing and related records to perform subscription contracts and meet applicable accounting or other legal duties. We process security logs, moderation reports and proportionate anti-abuse information for legitimate interests in protecting members, investigating misuse, defending claims and operating a reliable service, subject to the balancing and objection rights required by law.

Contact messages are processed to answer requests, take steps you ask for before a contract, provide support or handle legal obligations and legitimate interests in resolving complaints. Optional notification permission and an identity-verification request are handled on the basis applicable to the specific feature, including consent where required. We do not treat acknowledgement of this notice as blanket consent for unrelated uses.

5. What is public and what is restricted

An approved, published talent profile and its public portfolio can be viewed by visitors, including people outside your country, and may be indexed or copied by search engines or other users. Profile display can include age, city, country, measurements, professional details and social links. Do not put private contact information into a public bio if you do not want it public.

Telephone and WhatsApp fields are normally available to registered businesses only when the model has active Premium. Account email, password hashes and identity documents are not public profile fields. Private conversations and audition materials are accessible to their participants and authorised administrators as needed to operate, support or protect the service; they are not end-to-end encrypted. Verification documents and selfies are restricted to authorised administrative review. Access controls reduce exposure but cannot prevent every misuse of information a recipient is lawfully shown.

6. Identity verification

Verification is optional and involves manual document and selfie review. This version does not use automated facial recognition or a biometric matching/liveness provider. Do not submit more data than the review requires. The decision and limited review metadata may remain after the uploaded document and selfie files are removed.

The configured retention target for reviewed document and selfie files is 30 days after a decision. Pending or legally preserved records may need different handling. Scheduled cleanup and administrator processes implement this target. You may ask about the status of your request, withdraw consent where consent is the basis, or request deletion; we will explain any lawful reason preventing immediate removal. Withdrawal does not make earlier lawful processing unlawful.

7. Service providers and recipients

Authorised staff and providers supporting hosting, email delivery, backups, security and payment processing may receive the information needed for their function. PayPal handles payment processing under its own terms and privacy notice. Browser push services handle delivery if you enable notifications. Businesses receive the profile and application information you share or make available for casting.

If country suggestions are enabled, your IP address may be sent to Country.is to obtain an approximate country, or a country indication may be provided through Cloudflare. You can change the country and choose your city yourself; this is not identity verification. The platform's successful country cache uses an IP-derived keyed hash and expires after 24 hours; failed lookups have a shorter expiry.

External videos and social links lead to third-party services only when you choose to open them. Those providers can receive connection information and apply their own policies. We may disclose information when lawfully required by a competent authority, to protect legal rights or in a properly safeguarded business transfer. We do not authorise unrelated resale of members' portfolios or use them for AI training under this notice.

8. International processing

Public profiles can be accessed internationally. Infrastructure and external services such as PayPal, Country.is and services you choose to open may process information outside your country. Where a restricted international transfer is involved, the operator must use an applicable lawful mechanism, such as a recognised adequacy decision or appropriate contractual safeguards, and any supplementary protections required by law. Contact us for the relevant recipient locations and safeguards, or a copy subject to legitimate confidentiality restrictions.

9. Cookies, local storage and notifications

The application uses a session cookie to maintain sign-in and protect form submissions, and an English-language preference cookie. The language preference lasts up to one year. Browser local storage can keep an installation-prompt preference and a random device identifier used for notification settings. The optional installed web app can cache an offline page and icons; it is not designed to cache private profiles, messages or payment pages.

The supplied application does not include advertising or behavioural-analytics trackers. If optional non-essential tracking is introduced, this notice and any required consent controls must be updated before it runs. You can clear cookies and local storage through your browser, although this may sign you out or reset preferences. Push requires browser permission and can be disabled in Notifications or browser settings. Notification previews may be visible on your device's lock screen.

10. Retention

Account and collaboration records are kept while needed to provide the account and relevant project history. After a closure or deletion request, we assess what can be removed and what must be retained for billing duties, legal claims, fraud prevention or the rights of other participants. Where a specific period depends on applicable tax or limitation rules, those rules determine the period rather than an unlimited right to retain data.

Ordinary contact requests are kept while open and for up to 12 months after resolution, unless a relevant legal hold or duty requires longer retention. Completed or failed push jobs are normally cleaned after 30 days; time-limited security counters and reset tokens expire according to their purpose. Reviewed verification files and the country cache have the periods described above.

Restricted backups may retain earlier copies until the relevant backup is securely retired. Backups must not be used to reintroduce data that should remain deleted without applying the deletion again. Contact us if you need the retention criteria for a particular record. A request is not automatically refused merely because the data appears in a backup.

11. Your rights

Depending on applicable law, you may request access and a copy, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent for processing that relies on consent. These rights can have lawful exceptions; we will explain a restriction rather than claim that acceptance of the Terms waives your rights.

Use Contact or info@joinmodels.com and identify your account and the request. We may ask for proportionate information to verify identity without routinely requiring a new copy of an identity document. We aim to respond within the applicable legal deadline, generally within 30 days or one month as the governing law provides. Where a lawful extension is needed, we will explain it within the initial deadline. Requests are normally free; any legally permitted exception will be explained.

You may complain to the relevant supervisory authority without first using our support process. In Albania this is the Commissioner for the Right to Information and Protection of Personal Data, whose website is https://idp.al and contact email is info@idp.al. Where the GDPR applies, you may also complain to the competent supervisory authority in the EEA, including where you live or work, as provided by that law.

12. Security, automation and age limits

We use access restrictions, password hashing, protected sessions and other technical and organisational measures appropriate to the processing. No service can promise absolute security. Report suspected unauthorised access through Contact; do not include your password.

Filters, profile matching and Premium ordering organise opportunities and visibility. They do not make the business's final casting decision or guarantee selection. We do not use solely automated decisions intended to produce legal or similarly significant effects on members in the supplied casting workflow. The service is for adults only; report an underage account so it can be investigated and handled appropriately.

13. Updates and questions

The date and revision shown on this page identify this notice. We will update it when the processing changes and provide additional notice or obtain consent where legally required. For account closure, deletion, a complaint or questions about recipients and safeguards, use Contact and select Privacy / data rights.