Privacy Policy
1. What we collect
Account data. Your name, email address, account role (client or talent), and — if you sign up with a password — a salted PBKDF2 hash of that password. We never store or see your plain-text password. If you sign in with Google, we also store your Google account ID and the name and email Google confirms for you.
Applications and briefs. What you send us: for talent, your name, email, a link to your work, an optional note, and your payout bank details (bank name, account name, account number) so paid work can reach you; for clients, your name, email, company and the details of the work you need.
Security records. Hashed sign-in tokens and one-time codes (stored as SHA-256 hashes, never in readable form) and the version of the Terms you accepted, with its timestamp.
2. What we use it for
Only to run the network: creating and securing your account, matching talent to briefs, replying to applications and briefs, and sending the transactional emails those flows require (verification, password reset, sign-in codes, and receipts). We do not run advertising on this site and we do not profile you for ads.
3. Where it lives, and who processes it
Account data is stored in a Cloudflare D1 database on Cloudflare's infrastructure. Transactional email is delivered through Resend. If you use Google sign-in, Google handles that step under Google's own privacy policy; we receive your name, email address and Google account ID from it. Applications and briefs are also delivered to the studio's inbox so a human can read them.
4. What we never do
We never sell personal data. We never share it with third parties for their marketing. The only sharing that happens is the sharing you asked for: relevant parts of an application shown to a client whose brief it matches, and relevant parts of a brief shown to developers being considered for it.
Payout details get stricter handling still: they are never sent by email, never shown to clients, and never displayed anywhere in full — your own dashboard shows only the bank name and the last four digits of the account number.
5. Cookies
One session cookie (vl_session) keeps you signed in; during a Google sign-up, one short-lived helper cookie (ten minutes) carries your verified Google identity to the role-choice step. That is the whole list — no analytics cookies, no advertising cookies.
6. Retention and your rights
We keep account data while your account is open. You may ask us at any time — by email, no forms, no fee — to see the personal data we hold about you, to correct it, or to delete your account and its data. Deletion removes your account, applications and briefs, except where a record must be kept for an active engagement's paperwork. We answer within 30 days at the latest, and usually far sooner.
7. Security
Passwords are hashed with PBKDF2 (100,000 rounds, per-user salt). Sessions are opaque random tokens stored hashed, rotated at every sign-in, and revoked when a password is reset. Sign-in codes are single-use, expire in ten minutes, and lock after five attempts. The site is served over HTTPS only.
8. Changes and contact
If this policy changes materially, the new version will be published here with a new version date. Questions, access or deletion requests: hello@victorantai.com.