Privacy Policy

• We collect what we need to run your portfolio, nothing more.
• Site analytics are cookieless — we never track your visitors across sites or days.
• We never sell data. Directory listing is strictly opt-in.
• You can export or delete everything yourself, from the dashboard, anytime.

Account: your email address (for sign-in and notifications) and plan status. Content: everything you add to your portfolio — text, images, videos, packages, rates. Leads: when someone submits your contact form we store their name, email, message and optional company/budget so you can respond. Analytics: aggregate daily counts of views, unique visitors, contact clicks and enquiries for your site.

We don’t set analytics cookies on published sites, and we never store visitor IP addresses. To count unique visitors, we compute a one-way hash of technical request data with a salt that changes every day — so a visitor can’t be recognised tomorrow, or across different sites. Only aggregate numbers are kept.

Pitch links. Creators can share their portfolio through trackable links. When a portfolio is opened through one, we record the open with a timestamp, approximate location (city and country derived from the network request — never precise location or IP address), device class (phone / desktop / tablet), the referring page, time spent on the page and which sections were scrolled into view. This uses the same daily-rotating hash as above — no cookies, no persistent identifiers, and it tells the creator that their link was opened, never who opened it.

To provide the service (host your site, deliver leads, process subscriptions), to secure it (fraud and abuse prevention, content reports), and to communicate service messages (sign-in links, lead notifications, billing). If you opt into the creator directory, the profile data you chose to publish becomes searchable by brands — you can switch this off in settings at any time. Legal bases under UK GDPR: contract performance, legitimate interests (security, service improvement), and consent (directory listing).

Carefully-chosen processors, each under their own data-protection terms:

• Supabase — database, authentication and image storage
• Vercel — hosting and content delivery
• Stripe — payments (we never see your card details)
• Resend — transactional email
• Cloudflare — video storage and streaming
• Anthropic — AI copy drafting, only on the details you provide during onboarding

We don’t sell personal data to anyone, ever.

Your data lives for as long as your account does. Deleting your site or account from the dashboard removes your content, uploads, leads and analytics immediately (a copy served by content-delivery caches can persist briefly). You can download a complete export first — also from the dashboard.

Under UK GDPR you can access, correct, export, restrict, object to processing of, or delete your personal data. Export and deletion are self-serve in the dashboard; for anything else email hello@mail.callsheet.site. You can also complain to the ICO (ico.org.uk) — though we’d love the chance to fix things first.

If you submit a contact form on a creator’s portfolio, your message goes to that creator — they’re responsible for how they handle it. We store it on their behalf and count the submission in their (aggregate, cookieless) analytics as described above.

If we materially change this policy we’ll flag it by email or in the app before it takes effect. Questions or concerns: hello@mail.callsheet.site. See also our Terms of Service.