01Data controller
The data controller is Rearshot (details in the legal notice). For any question about your data: jass@rearshot.com.
02Data collected
Applications: declared identity, contact details, activity information and links you provide. Supported creators: legal identity and proof of age, contact details, public page content, imported revenue data (CSV). Visitors: aggregated, anonymous audience statistics (Vercel Analytics, cookieless).
03Legal basis
Performance of pre-contractual measures and of the contract (application, support); compliance with legal obligations (age verification, accounting); legitimate interest (security, abuse prevention, anonymous audience measurement); your consent where required.
04Sensitive identity data
Legal name, date and place of birth, and ID document (age verification) are encrypted, strictly access-restricted and NEVER published. A creator's public page only exposes the computed age and the country.
05Applications: no database storage
To minimize exposure of your data, recruitment applications are not stored in a database: they are sent to the team by email then handled in a restricted way.
06Recipients and processors
Hosting and technical services (Vercel, Neon, Cloudinary, Resend), audience measurement (Vercel Analytics), abuse limiting on forms (Upstash) and application error tracking (Sentry). Every processor is bound by the required contractual guarantees and only accesses the data it needs. Upstash only receives counters, keyed to a truncated IP address and to a non-reversible fingerprint of the email address, never the address itself. Sentry receives the site's technical errors; it is configured not to collect session identifiers or IP addresses.
07Transfers outside the EU
Some providers are located in the United States (Vercel, Cloudinary, Resend, Sentry, Upstash). Transfers are covered by appropriate safeguards (European Commission standard contractual clauses).
08Retention periods
Data is processed for the duration of the relationship, then archived for as long as required by legal obligations (notably accounting, up to 10 years). Unsuccessful applications are deleted after a reasonable period. Proof-of-age documents are kept only as long as strictly necessary.
09Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, objection and portability. Exercise them at jass@rearshot.com. You may also lodge a complaint with the competent supervisory authority: CNIL (France), APD (Belgium) or PFPDT (Switzerland).
10Security
Encryption of sensitive data, access restricted to what is necessary, two-factor authentication (2FA) on the admin. As no measure is infallible, we strive to protect your data as best we can.
11Adults only
The service is strictly reserved for adults. No minor's data is knowingly collected.