01Data controller
The data controller is Rearshot (details in the legal notice). For any question about your data: jass@rearshot.com.
02Data collected
Applications: declared identity, contact details, activity information and links you provide. Supported creators: legal identity and proof of age, contact details, public page content, imported revenue data (CSV). Visitors: aggregated, anonymous audience statistics (Vercel Analytics, cookieless).
03Legal basis
Performance of pre-contractual measures and of the contract (application, support); compliance with legal obligations (age verification, accounting); legitimate interest (security, abuse prevention, anonymous audience measurement); your consent where required.
04Sensitive identity data
Legal name, date and place of birth, and ID document (age verification) are encrypted, strictly access-restricted and NEVER published. A creator's public page only exposes the computed age and the country.
05Applications: no database storage
To minimize exposure of your data, recruitment applications are not stored in a database: they are sent to the team by email then handled in a restricted way.
06Recipients and processors
Hosting and technical services (Vercel, Neon, Cloudinary, Resend), audience measurement (Vercel Analytics). Each processor is bound by the required contractual safeguards and only accesses the data necessary.
07Transfers outside the EU
Some providers are located in the United States (Vercel, Cloudinary, Resend). Transfers are framed by appropriate safeguards (European Commission standard contractual clauses).
08Retention periods
Data is processed for the duration of the relationship, then archived for as long as required by legal obligations (notably accounting, up to 10 years). Unsuccessful applications are deleted after a reasonable period. Proof-of-age documents are kept only as long as strictly necessary.
09Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, objection and portability. Exercise them at jass@rearshot.com. You may also lodge a complaint with the competent supervisory authority: CNIL (France), APD (Belgium) or PFPDT (Switzerland).
10Security
Encryption of sensitive data, access restricted to what is necessary, two-factor authentication (2FA) on the admin. As no measure is infallible, we strive to protect your data as best we can.
11Adults only
The service is strictly reserved for adults. No minor's data is knowingly collected.