Legal
Privacy Policy
Effective date: 2026-09-30
Who we are
CastLyra (castlyra.com) is operated by Oryvelon LLC, a limited liability company organised in the State of Delaware, United States ("Oryvelon", "we"). Oryvelon LLC is the data controller for the personal data described here. Contact for all privacy matters: info@oryvelon.com.
What we collect
Talent: e-mail, legal name, display name, date of birth (to confirm you are 18+), optional phone, location, categories, bio, languages, skills, optional measurements, photos, links, availability and your consent choices. Business contacts: company, work e-mail, location, company type, brief details and consent choices. Visitors: essential cookies for sign-in; analytics cookies only if you accept them.
What is public
Only after our team approves your application: display name, city/country, approved categories, bio, skills, languages, approved links and approved photos — and measurements only if you explicitly allow it. Your e-mail, phone, legal name, exact date of birth, internal notes and unapproved photos are never published.
Why we use it (legal bases)
To create and review your application and run your account (contract / steps before a contract); to publish your approved profile (your consent, which you can withdraw); to confirm you are 18+ and keep the platform safe, including an audit trail of moderation decisions (legitimate interests and legal obligations); to answer business briefs (legitimate interests); optional marketing and analytics only with your consent.
Where data is stored and international transfers
Our database and file storage are hosted in the European Union (Frankfurt, Germany); transactional e-mail is sent from the EU (Ireland). Because Oryvelon LLC is a US company, data may be accessed from the United States. Where required we rely on appropriate safeguards such as the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum and, for Türkiye, the standard contracts under KVKK Article 9.
How long we keep it
Account and application data: while your account is active and up to 12 months after closure. Rejected application photos: deleted after 90 days. Business briefs: up to 24 months. Consent and audit records: as long as needed to prove compliance. You can ask us to delete your data earlier.
Your rights
Depending on where you live (for example under KVKK, GDPR, UK GDPR or US state privacy laws) you can request access, correction, deletion or a copy of your data, object to or restrict processing, and withdraw consent at any time. Write to info@oryvelon.com; we answer within 30 days. We do not sell personal data or use it for cross-context behavioural advertising, and we honour the Global Privacy Control signal. You may also complain to your local authority, e.g. the KVKK Authority (Türkiye), your EU data protection authority or the ICO (UK).
Representatives
An EU and UK representative under Article 27 GDPR / UK GDPR has not yet been appointed; until then please contact us directly at info@oryvelon.com and we will update this notice when they are appointed.