Privacy Policy

1. Who We Are

This Privacy Policy is issued by Cherniak B ("we," "us," or "our"), and explains how we collect, use, share and protect information about you when you use any site in our network (together, "the Network," and each one a "Site").

These sites are run by one team on one shared platform. This single policy applies to all of them — and it applies automatically to any Site we add to the Network in future, from the moment it launches, on the same terms set out here. See also section 3 of our Terms of Service.

Our postal address:
81 Binscarth Cres
Thornhill, Ontario
Canada L4J 4S7

2. One Account, One Set of Data, Several Sites

This is the most important thing to understand about privacy across our Network, so we'll be direct about it.

• There is one database. Your account, profile and history are stored once and used by every Site in the Network. Signing up on one Site creates an account that works on all of them.
• Signing in carries across. When you move between our Sites while signed in, we may pass a short-lived, single-use, signed token between the domains so you arrive already signed in. It identifies you to us, isn't shared with anyone else, and expires within a couple of minutes.
• Each Site sets its own cookie. They're separate domains, so each keeps its own session cookie on your device.
• We record which Site you joined on. That's how we know which brand to use when we email you.
• Your public profile may be shown on more than one Site. What's public stays public in the same way on each — cross-listing shows the same profile to a wider audience, it doesn't expose anything new about you.
• This isn't sharing with a third party. The Sites are all us. Moving your data between them isn't a disclosure to anyone else, and doesn't make your information more widely available than your profile's visibility already allows.

3. Information We Collect

a) Information you provide

• Account registration: Email address, password (stored hashed, never in plain text), role (performer or planner), and which Site you registered on
• Performer profile: Name, headshot, biography, performer and act types, fees, location, travel and technical requirements, social media links, video URLs, testimonials, past clients
• Planner profile: Name, organisation, location, contact details
• Directory listings: For agencies, bureaus and planners listed on our directory Site — business name, contact name, email, phone, website, location and a description. This information is published deliberately: the point of a directory is that people can contact you. Rosters are never published.
• Bookings, events and requests: Event details, dates, budgets, and messages exchanged through the platform
• Payment information: Payments are handled by our payment providers (currently PayPal; potentially others such as Stripe). We do not store card numbers. We receive confirmation of payment status and provider reference IDs, and we store the payout address you give us.
• Contact form: Name, email and message content when you contact support

b) Collected automatically

• IP address and approximate location
• Browser type and operating system
• Pages viewed and time spent on a Site
• Referring URLs
• Session data (stored server-side)

c) Analytics

We may use Google Analytics to understand aggregate traffic. It uses cookies and may transfer data to Google's servers. In the EU and EEA, analytics cookies stay off until you accept them. You can opt out anywhere via the Google Analytics opt-out browser add-on.

d) Announcement emails

Occasional announcement emails — the kind we send by hand, like a service update or a notice that these documents changed — contain a small invisible image. When your email program loads it, we record that the message was opened and when. It tells us whether an announcement actually reached people, which is the only way we can tell a quiet inbox from a broken one. We record the fact and the time, nothing else: no location, no device, no reading history. Many email programs block these images by default, and if yours does, nothing is recorded at all. The everyday emails — bookings, payments, messages, password resets, account notices — carry no such image.

e) Information from a previous site of ours

Some accounts were created by importing an existing profile from a site we already operated, so long-standing members keep their profile and history rather than starting over. Imported data — profile details, photos, videos, links and sign-in credentials — came from that site and is covered by this policy from the moment it was imported. We keep a marker recording that an account was imported, and its original identifier, for traceability. If you'd rather we didn't hold an imported profile, tell us and we'll remove it.

4. How We Use Your Information

• Create and manage your account across the Network
• Display your profile to event planners on each Site it qualifies for
• Publish directory listings, where you asked to be listed
• Facilitate bookings, requests and messaging between users
• Process subscription and booking payments through our payment providers
• Send transactional email — booking confirmations, messages, reminders, invoices, password resets
• Respond to support requests
• Improve the platform using aggregate usage data
• Enforce our Terms of Service and prevent fraud
• Comply with legal obligations

Which brand emails you

Email from us is sent in the name of the Site the message relates to — the Site where the action happened, or, for scheduled messages like reminders and invoices, the Site your account belongs to. It's the same team and the same platform behind every one of them, and every email tells you who it's from and how to reach us.

4B. AI and Automated Processing

How we use automation. Parts of the Network run on automated systems, and some of those may use AI: matching performers to event requests, ranking search results, spotting spam and fraud, moderating content, generating promotional images and copy for listings, and sorting incoming support messages. Where a third-party tool is involved, it acts as our processor and may not use your data for its own purposes — see section 5B.

No decisions made by machine alone. We don't use automated processing on its own to make decisions that have a legal or similarly significant effect on you — suspending an account, holding a payout, removing a listing. A person is involved, and you can ask for a human review of anything an automated system has flagged. Under UK and EU law you have an explicit right to that; we extend it to everyone.

AI search engines can read your public profile — deliberately. We allow AI crawlers and answer engines to access the public parts of our Sites, so that performers and listings can be surfaced and cited when someone asks an assistant for a recommendation. This is a choice we've made in your favour, and it has consequences worth stating plainly.

• They see only what any visitor sees. The same rules that keep every other crawler out of dashboards, messages, bookings, leads, payment pages and admin apply to them identically. Private data — your address, phone, email, payment details, private messages, booking records — is not exposed to them.
• Once read, it's out of our hands. What an AI company does with public content it has read — summarising, quoting, caching, or training a model on it — is governed by that company's own policies, not this one. We can stop granting access going forward; we can't recall what has already been collected.
• You can ask us to limit it. Contact us and we'll talk through the options. We'll be honest that they involve reducing how visible you are, because the same openness that makes you findable by an assistant is what makes you findable at all.

Terms of Service, section 24, sets out the same position from the agreement's side, including the rules on content you create using AI.

5. How We Share Your Information

We do not sell your personal information. We share it only in these situations:

• Across our own Sites: As described in section 2. That's us using your data on our own platform, not disclosure to an outside party.
• With other platform users: Public profile information (name, bio, photo, videos, fees, location) is visible to any visitor on the Sites your profile appears on. A planner's contact details are shared with performers who respond to their booking request with a fee quote, and with the parties to a confirmed booking; private messages are visible only to the people in the conversation. Directory listings publish the contact details you gave us for exactly that purpose.
• With service providers: Payment providers (PayPal, and any additional provider we enable, such as Stripe), email delivery, hosting and analytics. They receive only what they need to do their job and may not use it for anything else. Payment providers handle your payment details under their own privacy policies.
• For legal reasons: Where required by law, subpoena or government request, or to protect our rights, our users or the public.
• On a business transfer: If the Network, or a Site in it, is merged, acquired or reorganised, user data may transfer to the new owner, who will remain bound by this policy or one materially as protective.

5B. Who Else Handles Your Data, and In What Role

Our role. For the personal data you give us as a user of the Network, Cherniak B is the data controller — we decide what is collected and why, and this policy is the explanation. The companies listed below act as our processors: they handle data on our instructions, to do a specific job, and are not permitted to use it for their own purposes.

Who they are. We'd rather name them than leave you guessing:

• Hosting. Our servers, databases and file storage sit with our hosting provider. Everything you store with us lives there.
• Payment providers. PayPal, and Stripe where we have it enabled. They handle card and bank details directly — those never reach our database. See section 5.
• Email delivery. Our host's mail service, or an SMTP provider where one is configured. They see the address we're writing to and the contents of the message.
• Analytics. Google Analytics, for aggregate traffic measurement. It loads only after you accept analytics cookies — decline and it is never initialised. See section 6.
• Video platforms. When a video player actually loads on a page, the platform hosting that video (YouTube or Vimeo) receives your request and may set its own cookies under its own policy. Thumbnails alone don't load a player.

If you're a business and need a data processing agreement. Some organisations — agencies, bureaus, corporate planners — need a written DPA before passing us personal data belonging to their own clients or staff. We're a controller rather than your processor for ordinary use of the Network, so one usually isn't required. If your compliance team needs the position in writing, or you have a specific arrangement in mind, contact us and we'll deal with it properly rather than pointing you at boilerplate.

International transfers. Our hosting and the providers above are US-based, so data you give us is stored and processed in the United States. If you're in the EU or UK, see section 13.

6. Cookies

We use cookies for:

• Session management — keeping you signed in. Each Site sets its own session cookie on its own domain.
• Security — CSRF tokens that prevent cross-site request forgery.
• Remembering your device — if you choose "keep me logged in".
• Analytics — Google Analytics, where enabled and (in the EU/EEA) where you've accepted them.

You can disable cookies in your browser, but some things — signing in, most obviously — won't work without session cookies.

7. Data Retention

• Account data is retained while your account is active.
• Booking, payment and commission records are retained indefinitely for accounting, tax and dispute-resolution purposes.
• Messages and booking history are retained for at least 7 years for dispute resolution and tax purposes.
• Email logs and read notifications are purged on a rolling schedule set by our team (180 days by default).
• The short-lived tokens used to sign you in across our Sites are single-use and expire within minutes.
• On account closure we anonymise or delete personal data as described in section 9B, except where retention is legally required.

8. Security

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS encryption on all pages of every Site
• Passwords stored using bcrypt hashing — never in plain text, and never visible to us
• CSRF token protection on forms
• Parameterised database queries to prevent SQL injection
• Signed, expiring, single-use tokens for cross-site sign-in and for links we email you
• Admin access restricted by role

No method of internet transmission is 100% secure, so we can't guarantee absolute security.

8B. If Something Goes Wrong

No one can promise a breach will never happen, so here is what we will do if one does.

• We investigate immediately and take what we've found to be the fastest route to closing the hole — which may mean taking a feature or a Site offline while we do it.
• We tell you. If a breach is likely to put your rights or your data at real risk, we will notify you directly, without undue delay, and tell you what happened, what was affected, and what you should do — most often change your password. We won't wait until we have a complete picture to warn you about something urgent.
• We tell the regulators where the law requires it, within the deadlines it sets — for users covered by UK or EU law, that means the relevant supervisory authority within 72 hours of becoming aware.
• What we'd never ask you. We will never email or message you asking for your password, and we will never ask you to pay anything to resolve a security incident. Anything that does is not from us — please report it.

If you think you've found a security problem on any Site in the Network, please tell us before telling anyone else, and give us a reasonable chance to fix it. Contact us with the detail and we'll take it seriously.

9. Your Rights

Depending on where you live, you may have the following rights over your personal data. Because there's one account and one database, exercising a right applies across the whole Network — you don't need to ask each Site separately.

• Access: Request a copy of what we hold about you.
• Correction: Update or correct inaccurate information — most of it you can edit yourself in your profile settings, from any Site.
• Portability: Request a structured export of your data. We provide it in JSON format within 30 days.
• Objection: Object to certain kinds of processing.
• Restriction of listing: Ask us to show your profile on fewer Sites in the Network. See Terms, section 6.
• Deletion / account closure: See section 9B below for exactly what happens.

To exercise any of these, contact us. We respond within 30 days.

9B. Account Closure & What Happens to Your Data

Can I close my account?

Yes. Log in, go to Close Account in your dashboard navigation, and submit the request. Our team reviews and processes it within 3–5 business days, and you'll get a confirmation email.

You can't close your own account instantly — every closure is reviewed to confirm there are no outstanding bookings, pending payments or unpaid commission balances to settle first. And because one account covers the Network, closing it closes your access to every Site.

You have two options

What's kept after permanent closure?

If your account has any history — bookings, requests, payments or reviews — some records are retained even after closure. This is required by law and protects everyone involved:

• Booking, payment and commission records are retained indefinitely for accounting and tax.
• Your email address is anonymised — replaced with a reference code. We keep the original only for legal dispute resolution.
• Reviews you wrote or received remain, attributed to an anonymised account.
• Your public profile, photo and personal details are removed from all public pages across the Network.

Accounts with no booking, payment or review history can be fully and permanently deleted on request.

Outstanding obligations

Closure doesn't cancel financial obligations. Unpaid platform commissions remain due. Accrued payout balances owed to performers are held and released once a valid payment account is provided, even after deactivation. See Terms — Payout Policy.

10. Children's Privacy

Our Sites aren't directed at children under 13, and we don't knowingly collect personal information from them. If we learn that we have, we delete it promptly. You must be 18 or over to hold an account.

11. Third-Party Links

Profiles and listings may link to external sites — video platforms, social media, a business's own website. We're not responsible for the privacy practices of those sites. Links between our own Sites aren't third-party links; they're all covered by this policy.

12. California Privacy Rights (CCPA/CPRA)

If you're a California resident, you have the right to know what personal information we collect, to request its deletion, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law. Using your data across the Sites in our Network is internal use by one operator, not a sale. To exercise your rights, contact us.

13. Users in the EU and UK (GDPR)

If you're in the EU, EEA or UK, we process your personal data on these legal bases: performance of a contract (running your account, profile, bookings and payments), legitimate interests (operating, securing and improving the Network, and showing your profile across the Sites it qualifies for — which is the service you signed up for), consent (analytics cookies and marketing email, which you can withdraw at any time), and legal obligation (accounting and tax records).

You have the rights listed in section 9, plus the right to complain to your local data protection authority. Our servers are in the United States, so using our Sites involves transferring your data there.

14. Changes to This Policy

We may update this policy as the platform develops — including when we add a Site to the Network. Every version carries a Last updated date and a version identifier at the top of this page, so the current status is always visible. We notify registered users of material changes by email, and may ask you to accept the updated version when you next sign in. We record which version your account accepted, and when.

15. Contact Us

Questions, concerns or requests about your privacy? Contact us — a real person will read it, and we respond within 30 days.

81 Binscarth Cres
Thornhill, Ontario
Canada L4J 4S7