Last updated: May 3, 2026 · Working draft pending legal review
Profile data you provide: name, email, phone, location, job title, expertise tags, categories of interest, day rate, project history, headshot, portfolio link, free-form bio.
Authentication data: sign-in email, hashed Google OAuth identifier (if you use Google sign-in), session timestamps, last sign-in time.
Usage analytics: page views, filter usage, feature interactions — collected via Google Analytics 4 with IP anonymization enabled. We do not record session replays or keystrokes.
Inquiry-form submissions: if you submitted the public form at /apply, we retained the full form payload (your role, day rate, specialty, portfolio link, additional notes) to give admins context when verifying your application.
What we don't collect: we don't access your email inbox, calendar, contacts, or files. We don't track you across other websites. We don't fingerprint your device.
Palette Group admins (@palettegrp.com staff): can view your full profile including email, phone, day rate, project history, inquiry payload, and admin notes. They use this to staff productions and manage the directory.
Other talent in the directory: see your name, title, location, expertise, availability, verification status, portfolio link, bio, and categories of interest. They do not see your phone, day rate, full inquiry data, or any admin notes.
Producers outside Palette Group: may receive your contact info from a Palette admin if you've opted in to "Share contact info with producers" on your profile. Without that opt-in, your phone and email are admin-only.
Third-party service providers (see §7) process data on our behalf under their own privacy terms. They do not use your data for their own purposes.
We do not sell your data.
If you're in the EU/EEA, we process your data under:
/me page; for the rest (audit logs, broadcast history) email usFor any of the above, email [email protected]. We respond within 30 days.
Active profiles are retained as long as your account exists. Deleted accounts are soft-archived for 90 days (recoverable on request), then permanently removed. Approved project-history records may be retained indefinitely as part of Palette Group's production records. Audit log entries are retained for 1 year. Anonymized analytics data may be retained indefinitely.
We use the following third-party services to run the dashboard. Each operates under its own privacy policy and processes only the data needed for its function:
/apply) — collects the initial inquiry, then forwards to our databaseThe Service uses only essential cookies required for sign-in (Supabase session) and a small first-party analytics cookie (Google Analytics with IP anonymization). No advertising cookies. No cross-site tracking. No cookie consent banner because we don't use any non-essential cookies.
Your data is processed primarily in the United States (Supabase US-east, Cloudflare's global edge network). For EU/EEA users, transfers to the US are covered by Standard Contractual Clauses with each service provider. If you'd like a copy of the relevant SCCs, email us.
We use industry-standard security: HTTPS everywhere, magic-link / OAuth authentication (no stored passwords), database row-level security so you can't accidentally see another user's private fields, daily database backups, audit logging on admin actions. No system is 100% secure — if you suspect your account has been accessed without authorization, email us immediately.
The Crew Dashboard is for adults 18+ only. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, email us and we'll delete the account.
We will email registered users about material changes. Continuing to use the Service after a change is in effect means you accept the change.
Privacy questions or data requests: [email protected].