Privacy Policy

At signup — name, email, phone number, password (stored as a bcrypt hash, never plaintext), account type (TALENT / COMPANY / MEMBER), and for talents and companies: discipline, sub-category, location, services offered, and basic profile fields.

KYC documents — passport / Emirates ID / company trade license / selfies, uploaded for identity verification. KYC documents are encrypted at rest, accessed only by the SUPPORT / FULL admin tier for face-match review, and never shipped to public profile responses.

Operational data — bookings, offers, jobs you post or apply to, transactions (Stripe IDs only — we do not store full card numbers), messages between platform users, notifications, reviews, reports, wishlist + saved searches, and cart contents (saved to your account so they follow you between devices).

Push notification data — if you enable push notifications, we store the endpoint your browser issues and its encryption keys against your account, purely to deliver the notification. Disabling notifications deletes it.

Audit + security data — sign-in IP / user agent, failed login counts, token version, account lockout timestamps, rate-limit counters, and an admin audit trail recording which administrator opened which record and when.

To run the platform: authenticate you, route bookings + payments, send notifications + email receipts (via Resend), translate public content (via Google Translate), and prevent fraud. KYC data is used only for identity verification + admin moderation; we do not use document OCR for marketing.

Our legal bases for processing are: performance of a contract (operating your account, bookings, payouts), legal obligation (KYC / anti-money-laundering, tax and accounting record-keeping), legitimate interests (fraud prevention, platform security, anonymised analytics), and consent (non-essential cookies and optional marketing communications, which you can withdraw at any time).

Talent contact info (email, phone, full name) is sealed from companies until a Work Contract is signed. Company identity is sealed from talents on the public job feed (postings render as "Hashtags posted a job" or anonymised by company sub-type). Admin notes, internal flags, parent contact info (for under-18 talents), payout IBAN / bank details, and basic credit balances never appear on public surfaces.

Platform administrators can open records that are not public, and this is worth stating plainly rather than leaving to inference:

• Private messages — an administrator at the required tier can read the message thread between two users when investigating a dispute, a report, or a safety concern. Every such view is written to the admin audit trail with the administrator's identity and the time.
• Deleted ("retracted") messages — a message you delete disappears for the other participant but is retained and remains visible to administrators, so that a dispute or harassment case cannot be erased by the party who caused it. Do not treat deleting a message as erasing it.
• KYC documents — SUPPORT / FULL tier only, for face-match review.
• Transactions and payout details — for refunds, disputes, and accounting.

Administrators are bound by internal policy and their access is logged. If you believe an administrator has misused access, write to privacy@hashtagsstudios.com.

A confirmed guardian of an under-18 talent can switch into that child's account to operate it. While switched, the guardian sees and can act on the child's data — profile, bookings, offers, and messages. The switch is recorded, and a managed child account has no separate login of its own. Parent contact details collected during the parental approval flow are never shown on public surfaces.

• Stripe — payments (Checkout, Connect transfers), identity verification, refunds. Stripe's privacy policy applies to data they process on our behalf.
• Resend — transactional email delivery.
• Google Translate (google-translate-api-x) — public content auto-translation across our supported locales.
• Hostinger — hosting + MySQL database.
• Cloudflare / image CDN — public image delivery.

We do not sell user data to third parties for advertising or any other purpose.

See the dedicated Cookies policy. We use session cookies for authentication, a locale cookie for language preference, a country cookie for where you are shopping from, and — only with your consent — a functional "recently viewed" store and first-party analytics. Analytics is anonymous, written to our own database, and never shared with third parties; no third-party tracking or advertising cookies are loaded by the platform.

Passwords are stored as bcrypt hashes and checked against the Have I Been Pwned breach list at registration and change. Optional two-factor authentication (TOTP) is available on every account type. KYC documents are encrypted at rest. Server actions are CSRF-protected and every response carries a strict Content Security Policy. Sign-in, KYC submission, message send, and report submission are rate-limited, and ten failed logins lock an account for thirty minutes.

If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the UAE Data Office and, where required, affected users, without undue delay.

Active accounts: data retained while the account is active. After account closure: PII is anonymised within 90 days, except where retained for legal, tax, or fraud-prevention reasons (financial records retained 7 years per UAE accounting standards). Admin audit logs are retained per platform settings (default 12 months).

• Access — request a copy of your data via /contacts.
• Correction — edit your profile in your dashboard, or request a correction for fields you can't self-edit.
• Deletion — request account deletion via /contacts. We honour requests within 30 days, subject to legal retention obligations.
• Portability — talent profile + booking history exports are available on request.
• Withdrawal of consent — disable optional notifications from your settings, or turn off analytics / functional / marketing cookies at the banner or the Manage cookies panel on the Cookies page.
• Objection + restriction — object to, or ask us to restrict, processing based on legitimate interests.
• Complaint — you may lodge a complaint with the UAE Data Office (or, if you are in the EU/EEA/UK, your local supervisory authority) if you believe your data has been mishandled.

We do not make solely-automated decisions that produce legal or similarly significant effects about you without human review.

Talents under 18 require parental approval. Members must be at least 13. We do not knowingly collect data from anyone under 13.

The Hashtags Studio app for iOS and Android shows this same platform inside a native shell. Everything in this policy applies in the app as well. In addition: (a) Push notifications — if you allow them, we store a device token for your account so we can send you booking, message, competition and event alerts. Delivery goes through Firebase Cloud Messaging (Google) and Apple Push Notification service. You can turn notifications off in the app's Me tab or in your phone settings, and the token is deleted when you log out. (b) Camera and photo library — used only when you choose to add a photo to your portfolio, comp card or identity check; images are uploaded the same way as on the website and nothing is read from your library otherwise. (c) Face ID, Touch ID and fingerprint — the app lock is checked by your phone; we never receive your biometric data. Your app PIN is stored only on your device. (d) Crash reports — anonymous crash diagnostics are sent to Firebase Crashlytics so we can fix problems; they contain no message content or payment details. (e) Analytics — the app does not run marketing or analytics tracking, and the cookie choice you see on the website is set to essential-only inside the app.

Data may be processed by our third-party processors (Stripe, Resend, Google Translate) in the EU, US, and other regions where they operate. We rely on the processors' contractual safeguards (DPAs, standard contractual clauses) for these transfers.

Material changes announced in-app + by email at least 14 days before effective. Questions: privacy@hashtagsstudios.com (or via /contacts).

This content can be updated live by an admin from /admin/settings (key: legal.privacy).