Privacy Policy

TakeOne is owned and operated by SYNERRA SOLUTIONS PRIVATE LIMITED ("TakeOne", "we", "us"). This Privacy Policy describes how we collect, use, store and share information when you use the TakeOne platform at takeonehq.com (the "Service"). It applies to actors, casting directors, production houses, and any visitor to the Service.

SYNERRA SOLUTIONS PRIVATE LIMITED is the data fiduciary for the personal data described in this policy. You can reach us at support@takeonehq.com.

We collect information in three buckets:

1. Information you give us

• Account details: name, email, phone number, date of birth.
• Portfolio content: profile photos, showreels, gallery images, filmography credits, skills, languages, physical stats, work preferences, social links.
• Identity verification documents (when you opt into KYC) - these are stored encrypted and never shown publicly.
• Payment details - processed by our payment gateway Cashfree Payments India Private Limited; we do not store card numbers.

2. Information collected automatically

• Device, browser, IP address, and approximate location.
• Pages visited, time on page, and interactions (collected via PostHog and Sentry).
• If you accept analytics, session recordings of how you use TakeOne - see the session recording section below.
• Cookieless visit statistics collected by TakeOne itself: pages visited, referring site, campaign tags, device type, browser family, time on page, and approximate city-level location. No cookie or identifier is used and your IP address is never stored (a daily-rotating one-way hash is used instead). Raw records are deleted after 90 days, Do Not Track and Global Privacy Control are honoured, and when you create an account we record which source (for example a search engine or a campaign) your visit came from.
• Cookieless page-view and page-speed statistics through Vercel Web Analytics and Speed Insights (our hosting provider): the kind of page visited (names, IDs and query strings removed), the referring website, device type, browser, operating system, country and page speed. Nothing is stored in your browser; Vercel tells visits apart with a one-way hash it replaces every day. Nothing is sent from staff pages, or under Do Not Track or Global Privacy Control.
• Cookies and similar technologies - see our cookies section below.

3. Information from third parties

• For filmography credits, we may pull poster art and metadata from TMDb (themoviedb.org).

• To create and operate your account.
• To make your profile discoverable by casting directors and houses (only data you mark public).
• To process payments and credits.
• To send transactional emails (signup confirmation, OTPs, casting alerts).
• To prevent fraud, abuse, and impersonation.
• To improve the Service through aggregate analytics.
• To comply with legal obligations.

Two features on TakeOne process your data with AI in ways that warrant separate disclosure under DPDP § 5(1):

Face embeddings (face similarity search)

When you upload a profile photo, we generate a numerical representation of your face (a face embedding vector) and store it in our database. Casting directors can upload a reference photo and find actors whose embeddings are mathematically close. We use a hosted face model (on Modal, with Replicate as a fallback) to compute the embedding. We do not retain the original uploaded reference photo from directors after the search runs. Your embedding is deleted with your account.

AI image generation (TakeOne Studio)

When you opt into Studio, your headshot is sent to our image- generation provider (currently Higgsfield) to produce stylized portraits. Inputs and generated outputs are tied to your account; outputs you choose to publish appear on your gallery like any other photo. We never use your photos to train any public AI model.

Casting brief auto-fill (Sonnet 4.6 vision)

When you paste a webpage, video, image, or Instagram post URL into the casting form, we send the content to Anthropic’s Claude model to extract role details (title, audition date, contact). Anthropic does not use API content to train its public models. The extracted text is stored on your draft casting; the source file itself is not retained beyond the request.

You can withdraw consent for any of these AI features at any time by deleting the relevant data (gallery image, casting draft) or your account from Settings.

When you leave a review on another user’s profile, we store the review together with your identity as its author - always, and even when you choose to display the review anonymously. Displaying a review anonymously only hides your name, username, and photo from the people who read it; it does not make you anonymous to TakeOne.

We retain the reviewer’s identity so we can investigate complaints, meet our grievance-redressal duties, and comply with legal obligations - including notice-and-takedown under the Information Technology Act, 2000 and the IT Rules 2021. We may disclose who wrote a review to our Grievance Officer and moderators, to the person reviewed where that is needed to resolve a grievance, and to legal authorities where required by law. We do not otherwise reveal the author of an anonymously-displayed review.

We do not sell your personal information. We share data only with:

• Other users - when you make your profile public, casting directors and houses can see it.
• Service providers - Supabase (database & auth), Vercel (hosting), Resend (email),Cashfree Payments India Private Limited (payments), Cloudflare (CDN), Meta (WhatsApp messaging), PostHog (analytics), Sentry (error monitoring), Upstash (rate limiting), Modal & Replicate (face embedding), FAL (AI image generation), Higgsfield (AI image / video generation), Apify (Instagram post extraction when you paste a URL into the casting form), TMDb (filmography data), Anthropic (AI features). Payments are processed by Cashfree Payments India Private Limited, our payment gateway: we share your name, email address and phone number with it for each payment, and it receives the payment details you enter on its checkout page and handles your UPI AutoPay or card mandate for recurring plans.
• Legal authorities - if required to comply with applicable law or a valid legal process.

We use cookies for authentication, fraud prevention, and analytics. Essential cookies (e.g., your login session) are required to use TakeOne. Non-essential cookies (analytics) are loaded only after you accept them, never before.

How we ask depends on your device. On desktop we show a cookie banner. On phones, where a banner covers much of the screen, we instead offer the same choice as an optional checkbox while you create your account. It is unticked by default, and leaving it unticked is a valid answer that we record so you are not asked again. Either way you can change your mind any time through Cookie preferences, in the footer and in your dashboard settings.

If you choose “Accept analytics” (or tick the optional analytics box when you sign up), we use PostHog to measure how TakeOne is used and to record sessions. We ask for this separately from everything else, you can use TakeOne fully without it, and nothing in this section runs until you accept. It runs only on our public website and the TakeOne app, not on our internal staff tools.

What a session recording captures

• The pages you visit.
• Your clicks and taps, and how you scroll.
• What is shown on screen as you use TakeOne. This can include profile content, photos and conversations that are displayed to you while a recording is running.
• Your analytics are linked to your account id once you sign in.

What it does not capture

• Text you type into fields. Passwords, OTP codes, payment details and message drafts are masked in the browser before anything is sent, so they are never recorded.

Why we do this

To diagnose bugs and errors, to understand where people struggle, and to improve the product experience.

Who processes it, and for how long

Children are never included: for someone we know is under 18 we do not run PostHog, record sessions or keep behavioural analytics (see Children below).

Recordings are processed by PostHog, our analytics provider, on servers in the United States. Data is sent through our own domain rather than directly to PostHog. Our PostHog project keeps session recordings for 30 days. If you accept analytics, the identifier of your recording is also attached to our own aggregate analytics, so our team can find the matching recording for a visit.

Legal basis and your choices

We rely on your consent (DPDP Act 2023, sections 5 and 6). You can withdraw it at any time, as easily as you gave it: choose “Essential only” in Cookie preferences, in the footer and in your dashboard settings. Recording stops straight away and is not started again unless you accept again. Withdrawing does not affect recordings made before you withdrew. If you previously accepted or declined analytics, we ask again once under this notice (version 2026-10-11), because earlier notices did not mention session recording.

To ask for access to, or deletion of, data we hold about you from analytics, raise a grievance on WhatsApp or email grievance@takeonehq.com.

We keep your account data while your account is active. If you delete your account, we remove personal data within 30 days, except where we are legally required to retain it (e.g., financial records for taxation purposes).

Deleted data can remain in the encrypted database backups kept by our hosting provider for up to 7 days, after which those backups are overwritten. We do not restore deleted accounts from backups. Copies of public photos that browsers and content delivery networks have already cached can stay visible for up to 1 minute after deletion; copies that other people or services saved or shared are outside our control.

Under India’s Digital Personal Data Protection Act 2023 and similar laws elsewhere, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (subject to legal retention).
• Withdraw consent for non-essential processing.
• File a grievance with our Grievance Officer (below).

To exercise any of these rights, message us on WhatsApp starting with "Grievance:" (you get a reference number straight away), or email grievance@takeonehq.com.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (DPDP § 6(5)).

Accounts on the TakeOne website and app are for adults 18 and older only. Dates of birth under 18 are rejected there, and a web account is never created for someone we know is under 18.

The one exception is our WhatsApp casting-alert service. A person under 18 (a "child") may use it only to receive casting calls for child artist roles, and only after their parent or lawful guardian has given a declaration in the WhatsApp chat: the parent’s or guardian’s own name, their relation to the child, and an explicit "I agree". Until that declaration is given we send the child no casting calls of any kind. The declaration is given in the chat; we record it but do not currently verify the identity of the person who gives it, so please give it only if you are the child’s parent or lawful guardian.

What we collect about a child, and why

• The child’s date of birth or age: so we only ever send roles meant for children of that real age, and never adult roles. We keep it for as long as the child uses the service, because the child-only rule depends on it. It is not shown to casting directors and is not added to any web profile.
• The child’s city, gender, languages and the kinds of work they are interested in: to match casting calls.
• The WhatsApp number and the messages in the chat: to deliver the casting alerts and reply to questions. Messages travel through WhatsApp (Meta), and replies are written with the help of our AI providers named in "Who we share with", only to answer in the chat.
• The parent’s or guardian’s name, their relation to the child and the time of the declaration: as the record of their agreement.
• Which casting calls we have sent: so none is sent twice.

How we protect children

• Only explicit child artist roles whose age range fits the child’s real age are sent. Castings that mention nudity, intimate, bold or adults-only content, swimwear or lingerie, or a fee to apply are never sent to a child.
• No tracking, behavioural monitoring or targeted advertising of children (DPDP Act 2023, section 9(3)). Children are excluded from our product analytics and session recordings (PostHog), we keep no behavioural or funnel analytics about how a child uses the chat, and we do not profile them for advertising. We keep only the operational records needed to run the service and keep it safe: which messages we sent and whether they were delivered, the parent’s or guardian’s declaration, and opt-outs.
• No upselling: we never show a child a paid-plan offer, an upgrade button or a checkout link, and paid plans are not sold to children.
• We do not sell a child’s data, and we do not show it to casting directors.

The parent’s or guardian’s role and choices

Under the DPDP Act 2023, section 9, a child’s personal data may be processed only with the consent of their parent or lawful guardian. The parent or guardian who gives the declaration is responsible for the child’s use of the service and for any audition, application or work the child takes up. They can at any time:

• Stop all messages straight away by replying STOP in the chat.
• Withdraw their consent, and ask to see, correct or delete the child’s data, by sending GRIEVANCE in the same WhatsApp chat (it goes to our Grievance Officer), or by writing to them at grievance@takeonehq.com. When consent is withdrawn we stop processing the child’s data and delete it within 30 days, except what the law requires us to keep.

If a child tells us their age on WhatsApp and no parent or guardian gives the declaration, we send them no casting calls and keep only what we need to keep it that way (their age and the chat). A parent or guardian can ask us to delete it at any time. If you believe a child is using TakeOne without a parent or guardian, or has a web account, tell us at support@takeonehq.com.

We use industry-standard encryption in transit (TLS) and at rest, and enforce row-level security on our database. No system is perfectly secure; if you suspect your account has been compromised, change your password and email support@takeonehq.com.

Some of our service providers store and process data outside India. Where required, we rely on appropriate safeguards (such as standard contractual clauses and processor data-processing agreements) for these transfers, and limit each provider’s access to the minimum data needed for the named purpose.

The processors named in "Who we share with" are based in the following primary regions:

• Supabase, Vercel, Resend, Sentry, PostHog, Anthropic, Modal, Replicate, FAL, Higgsfield, TMDb - United States.
• Apify - Czech Republic / European Union.
• Cloudflare, Upstash - Global edge / multiple regions.
• Cashfree Payments India Private Limited - India.
• Meta (WhatsApp) - United States and other regions where Meta operates.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice at least 7 days before they take effect.

For complaints regarding the processing of your personal data, raise a grievance with our Grievance Officer on WhatsApp (start your message with "Grievance:"), or write to them at grievance@takeonehq.com. Acknowledgement within 24 hours; resolution within 15 days as required by IT Rules 2021 Rule 3(2). Full procedure, escalation path, and contact details are on the dedicated Grievance Officer page.