Privacy Policy
Last updated: 2026-06-13 · Effective: 2026-06-13
This Privacy Policy describes how Mr. Green's Agency List ("Company", "we", "us", "our") collects, uses, shares, and protects personal information when you access or use the websites, applications, and services we operate under the Mr. Green's Agency List name (collectively, the "Service"). The Service is currently offered as a free founding beta. Capitalized terms not defined here have the meanings in our Terms of Service.
1. Information we collect
We collect the following categories of personal information (mapped to CCPA categories where applicable):
- Identifiers and account info — email address, password (stored only as a hash), display name, username, role (talent, agency, brand, production), date of birth, country, city, primary language, timezone, phone number (optional).
- Profile and professional information — photo gallery, résumé / work history, education, skills, badges, market and travel radius, social links, agency affiliations, and other content you choose to publish.
- Platform activity — jobs posted, applications, endorsements, reviews, messages, roster memberships, saved talent lists, agency claims, moderation reports, and associated timestamps.
- Commercial information — if paid features launch in the future, transaction records and subscription status (payment card numbers would be processed and stored by Stripe; we do not store full card data).
- Technical and device information — IP address (server-side, for rate limiting and abuse prevention), browser user agent, device type, referring URL, and authentication session tokens.
- Inferences — limited inferences drawn from the above, such as activity-based abuse signals.
We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.
Sensitive personal information. Date of birth (which can imply age) is the only category that could be considered "sensitive personal information" under California law. We collect it only to confirm eligibility (18+) and to support age-appropriate features. We do not use sensitive personal information to infer characteristics about you.
2. How we use information
- To operate the Service: directory, profiles, messaging, job board, applications, reviews, endorsements, rosters.
- To authenticate you, keep you signed in, and secure your account.
- To send transactional emails (new applicant, new message, review posted, account alerts). You can manage most of these in Settings → Notifications.
- To enforce anti-abuse rules (rate limits, CAPTCHA, report queue, moderation, fraud detection).
- To analyze usage and improve the Service, primarily through aggregated or de-identified data.
- To communicate with you about the Service, including changes to these terms.
- To comply with legal obligations and respond to lawful requests from authorities.
- To establish, exercise, or defend legal claims.
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).
3. Who can see what
- Public profile (name, username, headshot, bio, role, market, skills, public photos) — visible to anyone browsing the Service, including guests.
- Email address — visible only to agencies you have explicitly contacted and to companies on whose roster you sit.
- Reviews and endorsements — public, attributed to the author, and visible to the reviewed person/agency, other users, and our moderators.
- Messages — visible to the participants of the conversation and, when reviewing reports of abuse, to our moderators.
- Reports of abuse — visible to our moderation team, including your identity as reporter.
- Internal logs (IP address, user agent, security signals) — visible only to authorized engineers and not to other users.
4. How we share information
We share personal information only with:
| Recipient | Purpose |
|---|---|
| Supabase | Authentication, database, file storage (hosting infrastructure). |
| Cloudflare | Site hosting (Pages, Workers), DNS, CDN, CAPTCHA (Turnstile). |
| Resend | Transactional email delivery. |
| Stripe | Payment processing for paid features if paid features launch. |
| Other users | As described in Section 3 (Who can see what). |
| Legal and law enforcement | When required by law, court order, or to protect rights, safety, or property. |
| Business transfers | In connection with a merger, acquisition, financing, reorganization, or sale of assets (subject to this Policy). |
Each service provider is contractually limited to using personal information only to provide services to us, with appropriate confidentiality and security obligations. We do not sell or share personal information for advertising purposes.
5. Cookies, local storage, and tracking technologies
We use cookies and browser local storage to keep you signed in, remember your preferences, and prevent abuse (e.g., CAPTCHA tokens). We do not use third-party advertising cookies, cross-site advertising pixels, or behavioral retargeting. We do not knowingly allow third parties to track users across other sites for advertising.
Do Not Track. Some browsers send a "Do Not Track" or Global Privacy Control (GPC) signal. Because we do not sell or share personal information for cross-context behavioral advertising, these signals do not change how we collect or process data. We treat any GPC signal as a valid opt-out request for the categories of processing it covers.
6. Your choices
- Edit, hide, or remove profile fields — from the profile edit screen.
- Manage email notifications — from the Notifications section in Settings.
- Delete your account — from the Danger Zone in Settings. Deletion is permanent and removes your profile, media, messages, and associated platform data. Some data may persist in backups, security logs, or anonymized form, as described in Section 8.
- Export your data — contact us at support@mrgreenagencylist.com.
- Update or correct information — most fields are editable from your profile or Settings; for anything you can't change yourself, contact us.
7. Data security
We use industry-standard authentication, encryption in transit (HTTPS), and row-level access policies at the database layer. Passwords are stored only as one-way hashes. Sensitive operations are protected by rate limits and CAPTCHA. We restrict internal access on a need-to-know basis. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute protection. If we become aware of a security incident affecting your personal information, we will notify you and applicable authorities as required by law.
8. Data retention
We keep personal information for as long as your account is active and for the period reasonably necessary to operate the Service, comply with legal obligations, resolve disputes, prevent fraud or abuse, and enforce our agreements. When you delete your account, we remove your profile, uploaded media, applications, messages, and associated platform data. Some records may persist:
- in encrypted backups for up to 90 days before being overwritten;
- in security and abuse-prevention logs for up to 12 months;
- in aggregated or de-identified form indefinitely;
- where retention is required by law (e.g., tax records associated with paid transactions).
9. Children
The Service is not directed to children and is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
10. Your California privacy rights
If you are a California resident, you have the following rights under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), as amended by the California Privacy Rights Act ("CCPA/CPRA"):
- Right to know — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties to whom we disclosed it.
- Right to delete — request that we delete personal information we collected from you, subject to legal exceptions.
- Right to correct — request that we correct inaccurate personal information.
- Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of, but you may submit a request and we will confirm.
- Right to limit use of sensitive personal information — we do not use sensitive personal information to infer characteristics about you, so this right is effectively already honored.
- Right to non-discrimination — we will not deny you the Service, charge you a different price, or provide a different level of quality because you exercised your privacy rights.
How to make a request. Submit a request through Support or by email to support@mrgreenagencylist.com. We will verify your identity using information already associated with your account before responding. We will respond within 45 days, with a possible 45-day extension if reasonably necessary. You may use an authorized agent to make a request on your behalf — the agent must provide written permission and we may require you to verify your identity directly.
Notice of financial incentives. We do not offer financial incentives in exchange for personal information.
11. California "Shine the Light" disclosure
California Civil Code § 1798.83 permits California residents to request information regarding our disclosure of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. Requests for this disclosure may be sent to support@mrgreenagencylist.com.
12. Canadian privacy (PIPEDA)
If you are a resident of Canada, you have rights under the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial laws to access, correct, and request the deletion of personal information we hold about you, and to withdraw consent for certain uses. Submit requests through Support or at support@mrgreenagencylist.com.
13. International users
The Service is offered to residents of the United States and Canada. Personal information is processed and stored in the United States. If you access the Service from another jurisdiction, you do so at your own initiative, and you consent to the transfer and processing of your personal information in the United States, which may have different data-protection rules than your jurisdiction.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date. If we make material changes, we will provide additional notice (by email or in-product). Your continued use of the Service after the effective date constitutes your acceptance of the updated Policy.
15. Contact us
Privacy questions, requests, or complaints: support@mrgreenagencylist.com or through Support. We do not publish a personal mailing address during the free founding beta; if a legally required mailing address is needed, contact us by email first.