Privacy Policy

1. Scope and controller

CastLyra (castlyra.com) is operated by Oryvelon LLC ("Oryvelon", "we"), Delaware, United States. Oryvelon LLC is the controller of the personal data described in this policy.

This policy applies to everyone who visits castlyra.com, applies as talent or sends an enquiry on behalf of a brand or business. For people in Türkiye, the KVKK Information Notice forms part of this policy.

For anything about your personal data, contact us at info@castlyra.com.

2. Data we collect

• Talent: e-mail address, full name, display name, date of birth (only to confirm you are 18+), optional phone number, city and country, categories, experience, bio, languages, skills, optional measurements and model-card details (height, sizes, shoe size, bust/waist/hips, hair and eye colour), photos, social and portfolio links, availability and work preferences, consent records.
• Brand and business representatives: name, company name, work e-mail, optional phone and website, country, company type, enquiry details, consent records.
• Everyone: a one-way hashed value derived from your IP address for security and abuse prevention, browser information and event logs; essential cookies and, only with your consent, analytics cookies.

We do not ask for special-category data such as racial or ethnic origin, religion, health, sex life or biometric data — please do not include it in your application. We never use your photos for facial recognition or biometric analysis.

3. How we collect data

We collect data directly from you through the application wizard, the sign-in form and the business enquiry form. Some technical data (cookies and security logs) is created automatically when you use the site.

4. Purposes and legal bases

• Creating your account, receiving and reviewing your application and contacting you: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Publishing your approved profile and showing it to brands: performance of the contract and your consent, which you can withdraw at any time (GDPR Art. 6(1)(a)).
• Age checks, recording moderation decisions, preventing fraud and abuse and keeping systems secure: legal obligations and legitimate interests (GDPR Art. 6(1)(c) and (f)).
• Replying to brand enquiries: steps taken at your request before entering a contract, and legitimate interests.
• Establishing, exercising or defending legal claims: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(e)).
• Newsletters, announcements and analytics: only with your consent.

5. What becomes public

Only after your application is approved and your profile is published: your display name, city and country, approved categories, bio, skills, languages, approved links and approved photos. Measurements and model-card details appear only if you separately allow it.

Your e-mail address, phone number, full name, date of birth, our internal notes and unapproved photos are never published. Published photos are re-encoded and hidden data such as location (EXIF/GPS) is removed.

6. Who we share data with

We do not sell your personal data or share it with third parties for advertising. We share it only as follows, and only for the stated purpose:

• Service providers (processors): database and file storage (Supabase, EU – Frankfurt), e-mail delivery (Resend, EU – Ireland), web hosting (Hostinger), bot protection (Cloudflare Turnstile, when enabled), error monitoring (Sentry, when enabled) and, only with your consent, Google Analytics / Google Tag Manager.
• Brands and businesses: your published profile is public. We share your contact details with a brand only with your permission.
• Authorities: where the law requires it or to protect our rights.
• Corporate transactions: in a merger, acquisition or asset sale, subject to the protections in this policy.

7. International transfers

Our database and files are stored in the European Union. Because Oryvelon LLC is a US company and some providers are located in other countries, your data may be transferred to or accessed from outside the EU, UK or Türkiye.

For such transfers we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, standard contracts notified to the Turkish Personal Data Protection Board under KVKK Art. 9, and adequacy decisions where available.

8. Retention

• Account and application data: while your account is open and up to 12 months after it is closed.
• Photos of rejected applications: deleted within 90 days of the rejection.
• Unfinished uploads: deleted within 1 day.
• Public profile copies: deleted when the profile is unpublished.
• Business enquiries: up to 24 months after the last contact.
• Security rate-limit records: 1 day.
• Consent and audit records: as long as needed to demonstrate compliance with our legal obligations.

When a period ends, data is deleted, destroyed or anonymised.

9. Security

We use technical and organisational measures including encrypted connections (HTTPS), row-level access control, password-less (e-mail link) sign-in, private storage, least-privilege access, audit logging and rate limiting against abuse. No system is risk-free; if a personal data breach occurs we will notify the competent authority and you within the legally required time.

10. Your rights

Depending on where you live (KVKK Art. 11, GDPR, UK GDPR or US state privacy laws) you have the right to access, correct, delete, restrict, object to processing of and port your data, and to withdraw consent at any time. Withdrawing consent does not affect processing carried out before the withdrawal.

Send your request to info@castlyra.com; see the Data Request Guide for details. We respond free of charge within 30 days.

We do not sell or "share" personal data as those terms are defined in US state laws, and we honour the Global Privacy Control (GPC) signal. You can complain to the Turkish Personal Data Protection Board, your EU data protection authority or, in the UK, the ICO.

11. Age limit

CastLyra is only for people aged 18 or over. We do not accept applications from minors and delete such data if we become aware of it.

12. Representatives

Our EU and UK representatives under Article 27 GDPR / UK GDPR and our Türkiye representative under KVKK will be listed here once appointed. Until then, please contact us directly at info@castlyra.com.

13. Changes

We may update this policy from time to time. We will announce significant changes on the site and, where appropriate, by e-mail. The effective date of the current version is shown at the top of this page.