Privacy Policy

This Privacy Policy describes how TakeOne ("TakeOne", "we", "us") collects, uses, stores and shares information when you use the TakeOne platform at takeonehq.com (the "Service"). It applies to actors, casting directors, production houses, and any visitor to the Service.

We collect information in three buckets:

1. Information you give us

• Account details: name, email, phone number, date of birth.
• Portfolio content: profile photos, showreels, gallery images, filmography credits, skills, languages, physical stats, work preferences, social links.
• Identity verification documents (when you opt into KYC) - these are stored encrypted and never shown publicly.
• Payment details - processed by our payment provider; we do not store card numbers.

2. Information collected automatically

• Device, browser, IP address, and approximate location.
• Pages visited, time on page, and interactions (collected via PostHog and Sentry).
• Cookies and similar technologies - see our cookies section below.

3. Information from third parties

• If you sign in via Google, we receive your name, email, and profile photo from Google.
• For filmography credits, we may pull poster art and metadata from TMDb (themoviedb.org).

• To create and operate your account.
• To make your profile discoverable by casting directors and houses (only data you mark public).
• To process payments and credits.
• To send transactional emails (signup confirmation, OTPs, casting alerts).
• To prevent fraud, abuse, and impersonation.
• To improve the Service through aggregate analytics.
• To comply with legal obligations.

Two features on TakeOne process your data with AI in ways that warrant separate disclosure under DPDP § 5(1):

Face embeddings (face similarity search)

When you upload a profile photo, we generate a numerical representation of your face (a face embedding vector) and store it in our database. Casting directors can upload a reference photo and find actors whose embeddings are mathematically close. We use a hosted face model (on Modal, with Replicate as a fallback) to compute the embedding. We do not retain the original uploaded reference photo from directors after the search runs. Your embedding is deleted with your account.

AI image generation (TakeOne Studio)

When you opt into Studio, your headshot is sent to our image- generation provider (currently Higgsfield) to produce stylized portraits. Inputs and generated outputs are tied to your account; outputs you choose to publish appear on your gallery like any other photo. We never use your photos to train any public AI model.

Casting brief auto-fill (Sonnet 4.6 vision)

When you paste a webpage, video, image, or Instagram post URL into the casting form, we send the content to Anthropic’s Claude model to extract role details (title, audition date, contact). Anthropic does not use API content to train its public models. The extracted text is stored on your draft casting; the source file itself is not retained beyond the request.

You can withdraw consent for any of these AI features at any time by deleting the relevant data (gallery image, casting draft) or your account from Settings.

When you leave a review on another user’s profile, we store the review together with your identity as its author - always, and even when you choose to display the review anonymously. Displaying a review anonymously only hides your name, username, and photo from the people who read it; it does not make you anonymous to TakeOne.

We retain the reviewer’s identity so we can investigate complaints, meet our grievance-redressal duties, and comply with legal obligations - including notice-and-takedown under the Information Technology Act, 2000 and the IT Rules 2021. We may disclose who wrote a review to our Grievance Officer and moderators, to the person reviewed where that is needed to resolve a grievance, and to legal authorities where required by law. We do not otherwise reveal the author of an anonymously-displayed review.

We do not sell your personal information. We share data only with:

• Other users - when you make your profile public, casting directors and houses can see it.
• Service providers - Supabase (database & auth), Vercel (hosting), Resend (email), Dodo (payments), Cloudflare (CDN), PostHog (analytics), Sentry (error monitoring), Upstash (rate limiting), Modal & Replicate (face embedding), FAL (AI image generation), Higgsfield (AI image / video generation), Apify (Instagram post extraction when you paste a URL into the casting form), TMDb (filmography data), Anthropic (AI features).
• Legal authorities - if required to comply with applicable law or a valid legal process.

We use cookies for authentication, fraud prevention, and analytics. Essential cookies (e.g., your login session) are required to use TakeOne. Non-essential cookies (analytics) are loaded only after you accept them, never before.

How we ask depends on your device. On desktop we show a cookie banner. On phones, where a banner covers much of the screen, we instead offer the same choice as an optional checkbox while you create your account. It is unticked by default, and leaving it unticked is a valid answer that we record so you are not asked again. Either way you can change your mind any time through Cookie preferences, in the footer and in your dashboard settings.

We keep your account data while your account is active. If you delete your account, we remove personal data within 30 days, except where we are legally required to retain it (e.g., financial records for taxation purposes).

Under India’s Digital Personal Data Protection Act 2023 and similar laws elsewhere, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (subject to legal retention).
• Withdraw consent for non-essential processing.
• File a grievance with our Grievance Officer (below).

To exercise any of these rights, email grievance@takeonehq.com.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (DPDP § 6(5)).

TakeOne is for users 18 and older. We enforce this at the date-of-birth entry point in account settings; date-of-birth values recording an age under 18 are rejected.

Under DPDP § 9(3), data of users aged 14 to 17 may only be processed with verifiable parental consent. We do not currently operate a verifiable-parental-consent flow, so accounts in this age range are not supported. If we learn we have collected data from a user under 18 without verifiable parental consent we will delete it promptly. If you believe a minor has created an account, report it to safety@takeonehq.com.

We use industry-standard encryption in transit (TLS) and at rest, and enforce row-level security on our database. No system is perfectly secure; if you suspect your account has been compromised, change your password and email security@takeonehq.com.

Some of our service providers store and process data outside India. Where required, we rely on appropriate safeguards (such as standard contractual clauses and processor data-processing agreements) for these transfers, and limit each provider’s access to the minimum data needed for the named purpose.

The processors named in "Who we share with" are based in the following primary regions:

• Supabase, Vercel, Resend, Sentry, PostHog, Anthropic, Modal, Replicate, FAL, Higgsfield, TMDb - United States.
• Apify - Czech Republic / European Union.
• Cloudflare, Upstash - Global edge / multiple regions.
• Dodo Payments - United States and India.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice at least 7 days before they take effect.

For complaints regarding the processing of your personal data, write to our Grievance Officer at grievance@takeonehq.com. Acknowledgement within 24 hours; resolution within 15 days as required by IT Rules 2021 Rule 3(2). Full procedure, escalation path, and the contact form are on the dedicated Grievance Officer page.