Privacy Policy

Last updated October 10, 2026

Draft. These terms have not been reviewed by a lawyer yet. Have them reviewed, then set LEGAL_REVIEWED=true to remove this notice.

Who is responsible

FYND runs FYND and decides how your information is used. Contact: hello@fyndagency.com.

What we collect

• Talent: name, email, password (stored only as a salted hash), date of birth (used to check you are 18 or over; never shown on your card), the photos and details you put on your cards, your choices (published, findable by agencies), messages, applications, verification requests, and how many times your card was opened per day (a count, not who looked).
• If you choose to connect Instagram: your Instagram username, account type, and your follower and post counts at that moment. We do not keep your Instagram login. You can disconnect at any time.
• Agencies: your organisation’s name, your name and work email, your password hash, your team, your workspace (lists, notes, saved searches, roster, casting calls, messages), plan and billing status.
• Everyone: technical data needed to run the service, such as your IP address in short-lived security and rate-limit records and in server logs.

What we do not collect

We do not use advertising or analytics trackers. We do not sell your information. We do not record who opens a comp card.

How we use it

To run your account, show your comp card the way you chose, deliver messages and applications, send the emails you need (confirm your address, reset your password, notify you of a message), keep FYND safe and stop abuse, process payments, and meet legal duties.

Who can see what

• Anyone with the link can see a published comp card: the details you put on it, but never your date of birth or account email.
• Agencies on FYND can find your card in search only if you tick “let agencies find my card” and it is published. Your email address is never shown to them.
• The agency you talk to sees the messages in your conversation and your applications to its casting calls.
• FYND staff can see reported cards and conversations when reviewing a report.

Public Instagram profiles

Agencies can look up public Instagram profiles. When an agency does, we fetch the public information on that profile (name, bio, counts, link) from a data provider, keep a copy for up to 30 days so it is not fetched again, and show it to agencies. These people have not joined FYND. Private profiles, and profiles that appear to belong to someone under 18, are not shown. To have your profile removed and never looked up again, contact hello@fyndagency.com.

Services that help us

Hosting and the database: Railway. Email delivery: Resend (when enabled). Instagram connection: Meta (when you choose to connect). Public profile lookups: Apify (when enabled). Payments: Stripe (when enabled); Stripe handles card details and we never see them. Fonts: Google Fonts, which means your browser requests font files from Google when you open our pages. These providers process information only to provide their service to us.

Cookies

We use only essential cookies to keep you signed in. They are not used for tracking or advertising.

How long we keep it

We keep your information while your account exists. When you delete your account we delete your cards, photos, messages, applications and account details. An agency’s own roster notes about someone it signed stay with that agency. Reports we received about a card or conversation may be kept for safety. Backups are overwritten on their normal schedule.

Your rights

You can see and change your details in your account, download a copy of your data (Account, “Download my data”), and delete your account yourself. Depending on where you live you may also have the right to object to or restrict some uses, and to complain to your data protection authority. Contact hello@fyndagency.com and we will help.

Age

FYND is only for people aged 18 and over. We do not knowingly keep information about anyone under 18; if you think we have, tell us and we will delete it.

Security

Passwords are salted and hashed, sessions are signed and can be ended everywhere, connections use HTTPS, and sign-in attempts are rate limited and locked after repeated failures. No system is perfectly secure; tell us at once if you think your account was used by someone else.

Changes

If we change this policy in a way that matters we will tell you before it takes effect.