We're not your lawyer; this is an operational explanation. If statutory privacy windows or Data Protection Board timelines differ from anything here after rules fully operationalise, the statute / official Board guidance prevails.

1. Who controls your data

The operator of the Cast My Show Platform (“we”, “us”) is responsible for decisions described here. Contact: support@castmyshow.in (Contact). For privacy-specific requests, email the same inbox with subject line Privacy Request; we route internally to the team accountable for redress.

2. Scope

This Policy applies to our website, authenticated web app areas, administrative tools, and integrations that display our branding. Third parties (e.g. Google sign-in) apply their own notices concurrently.

3. Data we collect

3.1 Account & identity

• Email address (and display name where you provide it).
• Authentication identifiers from our auth provider (Firebase / Google etc.), including login timestamps.
• Optional phone where you later supply it (if product fields exist for recovery or verification).
• Role / persona data (talent, producer, advertiser) you select during onboarding flows.

3.2 Profile & professional information

• Structured profile fields: skills, bios, verticals, geography, availability text, education, credits, links.
• Structured project fields: titles, descriptions, categories, stages (as your product surfaces them).
• Messages or operational notes you submit inside forms (applications, contact flows, support tickets).

3.3 Media uploads

Photographs, logos, cover images, hero marketing panels, gallery items, and attachments you upload are processed first into secured object storage (Amazon S3 buckets in India – ap-south-1 unless we notify redundancy regions). Automated checks may scan file types; human moderators sometimes review thumbnails and metadata referencing Terms of Use compliance.

3.4 Advertising & billing (if activated)

• Campaign creatives, advertiser legal name, GSTIN where invoiced domestically.
• Limited billing contact identifiers and transactional records required by bookkeeping / tax audits.

3.5 Technical usage data

• IP address, coarse geolocation inferred at city / region granularity, browser type, referrer, timestamps.
• Diagnostic logs across web servers / API gateways showing route paths, anonymised identifiers, latency.
• Security artefacts (failed logins, suspicious bot scores) that help protect accounts.

3.6 Cookies & local storage

We use cookies or browser storage for session continuity, CSRF protection, analytics we might later enable, and UX toggles you pick (collapsed hero banners, etc.). You can disable non-essential cookies through browser controls; essential cookies maintain login security.

4. Purposes & lawful bases

Under India's Digital Personal Data Protection Act 2023 framing, we rely on combinations of consent (explicit where required), legitimate usesfor service delivery & security, and legal obligation pathways when statutes or binding orders require retention or disclosure.

5. Sharing & processors

We share personal data only as needed with:

• Google Firebase / Google Cloud for authentication, possibly hosting adjacent services under their Data Processing terms.
• Amazon Web Services (Mumbai / ap-south-1) for application compute, databases, object storage, logging.
• Operator staff & moderated contractors under confidentiality commitments (engineering, moderation, bookkeeping).
• Authorities in India when lawful, proportionate demands compel disclosure after lawful process and review (except emergency child-safety doctrines may accelerate narrow disclosures when statute demands).

We don't sell mailing lists of individual résumés to speculative data brokers.

6. Cross-border transfers

Primary storage targets India (ap-south-1). Certain subprocessors maintain disaster recovery / redundancy or corporate support footprints abroad; contractual clauses endeavour to uphold Indian transfer expectations as DPDP rules crystallise specifying standard contractual clauses white-listed by regulators.

7. Retention

• Account core data: retained while active + reasonable wind-down backups after deletion initiation.
• Billing artefacts: statutory books / tax durations (typically multi-year horizons under Income-tax/GST).
• Moderation & complaint logs: longer where dispute or regulatory investigation persists; minimized after closure.
• Technical logs (rolling truncation): weeks to limited months depending on storage class tiers.

8. Security

We encrypt data in transit (HTTPS TLS), segregate production environments, restrict database credentials via secrets managers, apply least-privilege IAM policies on cloud resources, and conduct periodic dependency & configuration reviews. No method is perfect; report suspected incidents immediately to support@castmyshow.in.

9. Your rights (India-oriented)

You may request:

• Access to categories & key items of personal data we still hold about you.
• Correction of inaccurate fields not locked for audit reasons.
• Deletion / account closure—subject to lawful retention carve-outs (tax, court holds, ongoing fraud probes).
• Withdrawal of marketing consent (where used) without retroactively voiding prior lawful processing.
• Nomination right once productised per DPDP portal flows (placeholder: email us nominee details meanwhile).

We respond within timelines reasonable under evolving Data Protection Board rules (interim SLA: substantive reply within 30 days for non-complex requests). Escalations: regulatory authorities once fully appointed if unsatisfied subject to prerequisites.

10. Children's data

Today's default account creation pathway targets adults (18+). If minors appear in cinematic content you publish, guardians hold responsibility for lawful participation documentation. We'll remove CSAM / grooming vectors aggressively and cooperate under Indian IT Act / specialised child safety statutes mandates.

11. Automated decision-making

We neither conduct solely automated adjudications materially affecting lawful opportunities with no humans in loop for hiring decisions affecting users (we're not an employer). Risk scoring for abuse may trigger queue priority but isn't a final employment determination.

12. Changes

We'll update the Last updated date and, for material changes, display on-site notice or email where appropriate. Continued use after notice may constitute acceptance except where fresh consent is legally required.

13. Complaints channel

Email support@castmyshow.in (subject Privacy Grievance). Postal address notices will be posted when statutory registration formalities require a physical grievance desk location for Indian users beyond email.

14. Relationship to Terms

Operational rules—including acceptable content responsibilities—sit in our Terms of Use.