Privacy Policy
Draft — pending legal review
This policy is a working draft and is not yet final. It is awaiting review by a qualified solicitor. If anything here matters to a decision you are making, email [email protected] and ask us directly.
Who we are
StarX Management (“we”, “us”, “our”) is a creator management agency. We are the data controller for the information described in this policy.
TODO — company registration pending. Insert the registered company name, company number and registered office address once StarX Management is formally incorporated. Jurisdiction is shown as the United Kingdom throughout this document as a placeholder only and must be confirmed on registration.For any question about this policy or about your data, contact [email protected]. We do not currently have a separate Data Protection Officer.
What we collect
When you submit a creator application, we collect:
| Data | Required? |
|---|---|
| First and last name | Required |
| Age | Required |
| Email address | Required |
| Phone number | Required |
| Exactly three photographs of yourself | Required |
| Base location (city and country) | Optional |
| Instagram handle | Optional |
| Links to your profiles on other platforms | Optional |
| Free-text notes about your goals | Optional |
We also automatically record the country your submission came from, which advertising campaign or page referred you (UTM parameters in the link you arrived through), and the date and time you applied.
We do not ask for, and do not want, financial details, identity documents, or any special category data at the application stage.
Why we collect it
Solely to assess your application and to contact you about it. We do not use application data for advertising, we do not add you to a marketing list, and we do not sell it.
TODO — legal review. Confirm the lawful basis under UK GDPR Article 6 — likely legitimate interests for assessing an unsolicited application, and/or consent given by submitting the form — and settle the final wording of this section.Your photographs
Your three photographs are stored in private, access-controlled storage. They are visible only to the StarX Management review team.
We do not publish them, share them with third parties, sell them, or use them in advertising or marketing. They are used only to assess your application. Before upload, your photographs are resized in your own browser; the original full-size files never leave your device.
How long we keep it
We retain applications and photographs for 12 months from the date of application, after which they are deleted. If you ask us to delete your data sooner, we will do so — email [email protected] and we will confirm once it is done.
Who processes it on our behalf
We use a small number of service providers to run the application process. They act on our instructions and may not use your data for their own purposes.
- Cloudflare — website delivery
- hCaptcha (Intuition Machines, Inc.) — bot protection on the application form
- Supabase — application database and private photograph storage
- Resend — the notification email that tells our team you have applied
- Meta — advertising measurement, as described under Cookies below
We do not share your data with anyone else, except where we are legally required to.
TODO — legal review. Several of the processors above are US-based. Confirm the correct international transfer mechanism and wording (UK IDTA / Addendum to the EU SCCs, or adequacy where applicable), and whether a transfer risk assessment is needed.Cookies and tracking
Our application landing page uses the Meta Pixel to measure how our advertising performs. It sets cookies in your browser and reports to Meta when a page is viewed and when an application is submitted. It does not send Meta your name, your contact details, your photographs, or anything you typed into the form.
hCaptcha (operated by Intuition Machines, Inc.) also runs on this form to confirm you are not an automated bot. To do this it may collect information such as your IP address, browser and device details, and interaction patterns (for example, mouse movement and timing), and can set cookies as part of that check. This is strictly necessary for the form to work.
TODO — legal review, and a build task. The Meta Pixel is non-essential tracking. A cookie consent mechanism is likely required for UK and EU visitors before the Pixel fires, and this site does not have one yet. Confirm whether a banner is required and, if so, gate the Pixel behind consent before launching paid traffic. TODO — legal review. hCaptcha (replacing Cloudflare Turnstile as of this change) collects more than Turnstile's single token — IP address, device/browser data and interaction patterns. Confirm this still qualifies as strictly-necessary processing exempt from cookie-consent requirements rather than non-essential tracking like the Meta Pixel above, and that the international-transfer note further up (hCaptcha is US-based) covers it.Your rights
Subject to applicable law, you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- object to, or ask us to restrict, our processing of it;
- withdraw consent, where we relied on consent;
- complain to a data protection supervisory authority.
To exercise any of these, email [email protected]. In the United Kingdom you can also complain to the Information Commissioner’s Office at ico.org.uk.
TODO — legal review. Confirm the complete and correct rights list, response deadlines, and the named supervisory authority for the final jurisdiction of incorporation.Security
Data is transmitted over encrypted connections and photographs are held in a private storage bucket that is not publicly readable. Access is limited to the StarX Management review team. No system is perfectly secure, but we take the protection of application data seriously and will tell you promptly if a breach affects you.
Age
Our service is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it immediately.
Changes to this policy
If our practices change we will update this page and revise the date at the top.