14chats — Privacy Policy

How 14chats handles personal data across its website and platform

Last updated: [date].

1. Who we are and scope

This Privacy Policy explains how [14chats legal entity / sole trader name] ("14chats", "we", "us") handles personal data. It covers our marketing website (14chats.com) and our platform (app.14chats.com) (together, the "Services"). This policy applies to paid use of the platform; where a pilot is in place, the separate pilot notice and pilot agreement also apply.

1.2. For questions or data requests, contact [legal@14chats.com]. If we have appointed a representative or data protection contact in the UK or EU, their details are set out at the end of this policy.

2. Our role: controller and processor

2.1. Where we are a controller. We act as a data controller for personal data we decide the purposes and means of processing — for example, data of website visitors, people who submit pilot or contact requests, and account administrators, as well as billing information handled through our reseller (see section 5).

2.2. Where we are a processor. When an agency uses the platform, it enters operational data about its models and clients (for example, roster, availability, options, bookings, fees, messages and notes). For that data, the agency is the controller and we act as its processor, processing the data on the agency's documented instructions. Our obligations as processor are set out in a Data Processing Agreement ("DPA") that forms part of the agency's subscription.

3. Categories of data and data subjects

3.1. Depending on how the Services are used, we may handle personal data relating to: website visitors and enquirers; account users such as agency staff and bookers; models whose profiles and calendars are managed on the platform; and an agency's clients recorded in the platform.

3.2. Categories of data may include identity and contact details, account and login data, professional and scheduling information (availability, options, bookings), fee-related information, messages, technical and usage data, and billing information processed by our reseller.

4. Purposes and legal bases (UK GDPR)

4.1. Where we act as controller, we rely on the following legal bases:

• (a) performance of a contract — to provide, support and administer the Services and accounts;
• (b) legitimate interests — to secure, operate and improve the Services, prevent misuse, and communicate with agencies, balanced against individuals' rights;
• (c) consent — where required, for example certain marketing communications and non-essential cookies (which you may withdraw at any time);
• (d) legal obligation — to comply with law, including tax and accounting requirements.

4.2. Where we act as processor, we process personal data only on the relevant agency's instructions and for the purposes it determines, as set out in the DPA.

5. Payments and Merchant of Record

5.1. Payments for paid subscriptions are handled by Paddle (Paddle.com Market Limited and its affiliates), which acts as Merchant of Record (reseller) for those purchases. Paddle collects and processes payment and card data and is responsible for payment-related processing under its own privacy policy. We do not receive or store full payment card details.

6. Service providers and sub-processors

6.1. We use service providers that help us host, secure and operate the Services, including cloud hosting, our payments reseller (Paddle), and communication and support tools. They may process personal data only as needed to provide those services and under appropriate contractual terms.

6.2. Where we act as processor for an agency, the list of sub-processors and the process for changes are set out in the DPA.

7. International transfers

7.1. Some of our providers may process data outside the United Kingdom or the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards, such as adequacy decisions or standard contractual clauses / the UK International Data Transfer Agreement, as applicable.

8. Retention

8.1. We keep personal data only for as long as needed for the relevant purpose — providing the Services, support, security, or meeting legal obligations — and then delete or anonymise it where appropriate. Where we act as processor, retention and deletion follow the agency's instructions and the DPA.

9. Security and separation between agencies

9.1. We apply reasonable technical and organisational measures to protect personal data. Agency workspaces are separated: an agency's client records, rates, fees and internal data are private to its workspace and are not made available to other agencies. Models access their own calendar and requests through private access.

10. Your rights

10.1. Subject to applicable law, you may request access to, correction, deletion or restriction of your personal data, object to certain processing, request portability, and withdraw any consent you have given. You may also withdraw a pilot request at any time.

10.2. Where we hold data as a processor on an agency's behalf (for example, data about a model or a client), please direct your request to the relevant agency as controller; we will assist that agency in responding.

10.3. To exercise your rights, contact [legal@14chats.com]. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ICO).

11. Cookies

11.1. We use necessary cookies to operate the website and, where applicable, other cookies subject to your choices. Details are provided in our cookie notice or a cookie banner where required.

12. Data relating to minors

12.1. The platform is intended for professional agency use by adult authorised users. Where an agency's operational data includes personal data of individuals under 18 (for example, a model who is a minor), the agency acts as controller and is responsible for ensuring a valid legal basis and any required consent from a parent or guardian. We process such data as processor on the agency's behalf under the DPA.

13. Changes to this policy

13.1. We may update this policy from time to time. Where a change is material, we will take reasonable steps to inform you. The "last updated" date above shows when the policy was last revised.

14. Contact

14.1. Controller: [14chats legal entity / sole trader name], [address]. Contact for privacy questions and data requests: [legal@14chats.com]. [UK/EU representative, if appointed: name and contact.]