Privacy Policy

KFDB Connect ("Platform", "we", "us") is a professional networking app for the Indian film industry. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have — in plain language.

This policy is written under the Digital Personal Data Protection Act 2023 (DPDP Act) and the Information Technology Act 2000.

When you create and use your account, we collect:

• Name, profile photo, city, date of birth, gender
• Email address and phone number
• Professional roles, skills, filmography, education, certifications, awards
• Portfolio links and social media handles you add
• Profile gallery photos you upload
• Job listings you post, applications you submit, and answers to any screening questions asked by job posters
• Portfolio URLs you provide when applying for a job
• Crew lists and project memberships
• Direct messages you send to other members — the message text, any profile cards or web links you share, emoji reactions, and read receipts (see Section 8 — Direct Messaging).
• If you create a Casting Profile: a stage name and casting bio, the on-screen age range and height you list, appearance attributes, representation contact details, availability and travel preferences, showreel and social links, acting experience, credits, languages, and any casting headshots you upload (see Section 9 — Casting Profiles & Casting Access). Appearance attributes are sensitive data you provide voluntarily for casting purposes.
• If you create a Studio Page: studio name, type, city, founder name, services, logo, contact name, contact phone, contact email, and portfolio links for the studio. This data is attached to your individual account and subject to the same deletion rules.
• If you register an Organisation Account: organisation name, type(s), city, founded year, bio, services, notable clients, project history, contact person name, contact phone numbers, contact email addresses, social media links, and any custom links you add. Organisation Account data is independent of any individual profile and is deleted when the Organisation Account is deleted.

We also collect data about how you use the app (see Section 5 — Analytics).

We do not collect payment information. We do not collect ID documents. Date of birth is used only to verify you are 18+ and is never shown on your public profile.

Your profile is visible to other logged-in KFDB Connect users once it reaches 50% completeness and Ghost Mode is turned off. What logged-in users can see includes: your name, photo, city, roles, skills, filmography, education, certifications, and awards.

A limited public preview of your profile (name, photo, city, and primary roles) is also accessible via your shareable profile link (kfdbconnect.com/u/yourhandle) to anyone — including unauthenticated visitors — unless Ghost Mode is turned on. Contact info, full credits, and messaging are not shown in the public preview. If you enable Ghost Mode, the public preview shows "This profile is private."

Your phone number and email address are hidden by default. There are two ways they can become visible to others:

• Contact request (default): another logged-in user requests your contact details, you receive a notification, and you choose to approve or decline. Only users you approve can see your details.
• Make public (optional): you can choose to make your phone number and/or email visible to all logged-in users at any time from Settings › Privacy Controls. If you do this, your contact details appear directly on your profile without requiring a request. You can reverse this at any time from the same screen.

Your date of birth, gender (if you choose to keep it private), login history, and consent records are never shown to other users.

Casting profiles. Once you publish a casting profile, your basic casting information — stage name, bio, actor types, showreel links, opportunity status, city, on-screen age range, height, and years of experience — is visible to logged-in members. Your sensitive casting details — appearance attributes, representation contact, availability, and any gallery images you mark as casting-only — are not shown to ordinary members; they are visible only to members granted Casting Access (see Section 9). While your casting profile is a draft, only you can see it.

When someone requests your contact details, you receive a notification. You decide whether to approve or decline. If you approve, they can see only the details you have chosen to share (phone and/or email, based on your settings). You can revoke access at any time from Settings › Privacy Controls › Contact Requests. All contact access events are logged for security audit purposes.

Contact sharing when applying for a job: When you apply for a job on KFDB Connect, you may optionally consent to share your phone number and/or email address directly with the job poster. This is a separate, per-application choice and is not linked to your platform-level contact request settings. Your contact details are shared with the specific poster only if you explicitly opt in at the time of applying. You can see which applications you shared contact details for in your application history. This consent record is deleted when you delete your account.

We use your data to:

• Create and display your professional profile
• Help other film professionals find and connect with you
• Showcase selected profiles on the Explore page (KFDB Spotlight) to promote visibility within the industry — only profiles that meet a minimum completeness threshold are eligible
• Process job applications and crew list invitations
• Enable direct messaging between members
• Help casting professionals discover performers and, where the performer has approved Casting Access, view their casting details
• Send you notifications about relevant activity on your account
• Send occasional emails about completing your profile or new features (only if you have given consent and not opted out)
• Respond to support requests
• Monitor for abuse and keep the platform safe, including reviewing reported messages and casting content
• Show relevant safety guidance based on your profile settings — for example, a contact privacy warning if you choose to make your phone number or email publicly visible

We do not sell your data. We do not use your data for advertising on other platforms.

We use the following tools to understand how the app is used and to fix errors:

PostHog (product analytics)
PostHog records which features you use, which tabs you visit, and actions like job posts or profile follows. This helps us understand what is working and what to improve. PostHog operates from the United States. We do not send your name, phone number, or email to PostHog. Your account is linked by an anonymous ID so we can see behaviour across sessions. Session recording is disabled.

Sentry (error monitoring)
Sentry captures technical errors (crashes, failed loads) so we can fix them. It receives information about what went wrong — error messages, the page you were on, your device OS and app version. It does not receive your name, email, phone, or profile content. All visible text on screen is masked in error captures.

Vercel Analytics and Speed Insights
These tools measure page load performance and aggregate visitor counts. They do not link to your account.

We never send the content of your direct messages, or your casting profile's appearance, contact, or availability details, to PostHog, Sentry, or any analytics tool.

You can opt out of analytics in Settings › Privacy Controls › Usage Analytics (coming soon — see Section 19).

We send two types of emails:

Transactional emails
Login OTPs, password resets, and contact request notifications. These are required for the service to work and cannot be turned off while your account is active.

Engagement emails
Occasional reminders to complete your profile, and a one-time nudge if your profile score is below 50. These are sent only if you have given consent during onboarding and have not opted out. You can unsubscribe using the link in any engagement email, or by going to Settings and turning off "Engagement emails" (coming soon — see Section 19).

Emails are delivered through ZeptoMail (Zoho India). Your email address is shared with ZeptoMail solely for delivery.

Messages you send through the KFDB Connect support chat (Settings › Support & Legal › Contact Us) are stored in our database and are readable by KFDB Connect staff for the purpose of responding to your query. Do not send sensitive personal information (ID numbers, financial details) through the support chat.

KFDB Connect lets you send direct messages to other members. Here's how that data is handled:

• What we store: the content of your messages (text), any profile cards or web links you share, emoji reactions, read receipts, and a record of which members are in a conversation. When you share a web link, we fetch a preview (title and image) from that page; the linked website receives a request but no information about you.
• Who can see your messages: only you and the member you are messaging. Other members cannot see your conversations.
• Not end-to-end encrypted: your messages are stored in our database in readable form. This means KFDB Connect staff and our infrastructure provider can technically access message content, which is protected by access controls rather than end-to-end encryption. We do not read your private messages as a routine matter.
• Reviewed if reported: if you or another member reports a conversation, a snapshot of the recent messages in that conversation is saved with the report so our team can review and act on it. We keep this snapshot for as long as necessary to handle the report and to record any safety action taken.
• Blocking: you can block another member at any time, which archives the conversation and stops them from messaging you.
• Analytics: we never send the content of your messages, or who you message, to our analytics or error-monitoring tools.

If you are a performer, you can create a Casting Profile to be discovered for acting work. Because this profile includes appearance and other sensitive details, access to it is tiered.

• What we collect: a stage name and casting bio; the on-screen age range and height you list; your city; acting experience, credits, and languages; the showreel and social links you add; your availability and travel preferences; representation details (agency name, manager name, and manager/agent phone number) if you provide them; appearance attributes you choose to enter — such as body type, skin tone, hair and eye colour, hair length and texture, facial hair, tattoos, and piercings; and any casting headshots you upload. You provide all of this voluntarily, for casting purposes.
• Sensitive data: appearance attributes (including skin tone) are treated as sensitive personal data. We collect them only because you choose to add them for casting, and we restrict who can see them.
• What members see by default: once you publish, your basic casting information — stage name, bio, actor types, showreel links, opportunity status, city, on-screen age range, height, and years of experience — is visible to logged-in members.
• Restricted details and Casting Access: your appearance attributes, representation contact details, availability, and any gallery images you mark as casting-only are not shown to ordinary members. They are visible only to members granted Casting Access. A member requests Casting Access with a short message explaining why; a KFDB Connect administrator reviews the request and approves or declines it.
• Administrators: KFDB Connect administrators can access casting data to review access requests and to handle reports or safety issues.
• Not end-to-end encrypted: casting data is stored in readable form and protected by access controls; it is accessible to KFDB Connect staff and our infrastructure provider.
• 18+ only: casting profiles, like all profiles, are restricted to adults aged 18 and over.
• Deletion: you can unpublish your casting profile at any time to hide it from other members. Your casting profile and all its details are deleted when you delete your account.

We use the following third-party services to operate KFDB Connect. Each processor handles your data only as instructed by us, for the purpose described:

• Supabase — Database, authentication, and file storage. Hosts all your profile data and uploaded photos. (United States / EU)
• Vercel — Hosts and delivers the KFDB Connect web app and API. Processes every request you make to the app. (United States (CDN globally distributed))
• PostHog — Product analytics — usage events and feature engagement. (United States)
• Sentry — Error and crash monitoring. (United States)
• ZeptoMail (Zoho India) — Transactional and engagement email delivery. (India)
• TMDb (The Movie Database) — Film metadata (titles, posters) for the Films tab. We send film title searches; no personal data is sent. (United States)

We retain your data for as long as your account is active. Here is what happens to specific data over time:

• Profile and all related data: deleted immediately when you delete your account.
• Uploaded photos (avatar and gallery): deleted from storage immediately when you delete your account.
• Studio Page: deactivated (hidden) when you deactivate it; deleted when you delete your account. Studio logo is deleted from storage on account deletion.
• Support chat messages: retained until you delete your account.
• Direct messages: retained until you or the other participant deletes the conversation, or until either account is deleted. Deleting your account removes your conversations and messages.
• Reported-message snapshots: kept for as long as necessary to review and act on the report and to record any safety action taken.
• Casting profile and all casting details (appearance, representation contact, availability, credits): deleted when you delete your account.
• Casting Access requests: retained while relevant to managing access and as a record of access decisions; removed when you delete your account.
• Job applications, screening question answers, and job application contact consent records: deleted immediately when you delete your account.
• Security and access audit logs: retained for up to 2 years for safety and compliance purposes, then removed.
• Contact visibility consent records: if you chose to make your phone number or email publicly visible, a record of that consent (your name, email address, which field, and when) is retained for up to 2 years as a safety audit log, even after account deletion. Your account ID is removed from the record on deletion.
• Deletion audit record (hashed email, account type, deletion date, and deletion reason): retained for 12 months after account deletion for churn analysis and platform security, then automatically removed. No name, email address, or other personally identifiable information is stored.
• Email suppression list (your email address if you unsubscribed): retained indefinitely to prevent re-sending unwanted email.
• Engagement email tracking: records of which emails were sent to your account are deleted when you delete your account.

You can permanently delete your account from Settings › Account Centre › Delete Account. When you confirm deletion:

• Your profile, photos, job listings, crew lists, applications, and all related data are deleted immediately from our database.
• Your uploaded photos (avatar and gallery) are deleted from cloud storage.
• Your support chat history is deleted.
• Your direct message conversations and messages are deleted from our database.
• Your casting profile and all its details (appearance, representation contact, availability, credits, and casting headshots) are deleted.
• Any approved contact access others had to your details is revoked.

Your email address may remain on our suppression list to prevent future emails. Security audit logs and any contact visibility consent records referencing your account may be retained for up to 2 years; your account ID is removed from these records on deletion, but your name and email address within them are kept for legal compliance purposes. Deletion is permanent and cannot be undone.

When you delete your account, KFDB will remove or anonymize your personal profile information. For security, legal compliance, fraud prevention, service integrity, and platform improvement purposes, KFDB may retain limited non-identifying audit information, including a hashed version of your email address, account metadata, deletion date, and deletion feedback. Such information is retained only for a limited period (12 months) and is automatically deleted according to our data retention policy.

KFDB Connect is strictly for adults aged 18 and above. We do not knowingly collect data from anyone under 18. This includes casting profiles — we do not permit casting profiles for anyone under 18. If we become aware that a user is under 18, we will immediately delete their account and data. If you believe a user is under 18, please report it to support@kfdbconnect.com.

Under the Digital Personal Data Protection Act 2023, you have the following rights:

• Right to access: request a summary of the personal data we hold about you.
• Right to correction: update inaccurate data through your profile settings, or by contacting us.
• Right to erasure: delete your account and all associated data at any time.
• Right to withdraw consent: you can withdraw consent for engagement emails at any time using the unsubscribe link or through Settings (opt-out for analytics coming soon).
• Right to nominate: you can nominate another person to exercise your data rights on your behalf by contacting us at support@kfdbconnect.com.
• Right to grievance redressal: you can raise any privacy concern with our Grievance Officer (see below).

To exercise any of these rights, contact us at support@kfdbconnect.com.

Our infrastructure providers (Supabase, Vercel, PostHog, Sentry) are based in or operate through the United States. By using KFDB Connect, your data may be processed outside India. We have data processing agreements in place with these providers. As DPDP Act cross-border transfer rules are finalised by the Government of India, we will update our practices accordingly.

We use the following technical measures to protect your data: Row-Level Security on all database tables (each user can only access their own data), encrypted connections (HTTPS/TLS) for all data in transit, access controls limiting which team members can access production data, and secure storage for secrets and API keys. Direct messages and casting data are protected by these same access controls; note that direct messages are not end-to-end encrypted (see Section 8), and access to sensitive casting details is limited to members an administrator has approved (see Section 9). No security system is perfect. If you discover a vulnerability, please report it to support@kfdbconnect.com.

We may update this Privacy Policy as the Platform evolves. If we make significant changes to how we use your data, we will notify you through the app and by email before the changes take effect. Continued use of the Platform after notification constitutes acceptance of the updated policy.

For any privacy questions, data requests, or concerns, contact us at support@kfdbconnect.com.

The following controls are described in this policy but are not yet available in the app. We are building them and will update this section when they launch:

• In-app analytics consent toggle (Settings › Privacy Controls › Usage Analytics)
• In-app engagement email opt-out toggle (Settings › Notifications)
• Data export / download my data (Settings › Account Centre)
• Right to nominate — UI for saving a nominee's details in your account settings
• Photo attachments in direct messages (will include content moderation before launch)
• Self-service deletion of a casting profile (currently, casting data is removed when you delete your account, and you can unpublish your casting profile to hide it)