Privacy Policy

Who we are

This website is operated by Umbra Models, based in Ohio, United States (“Umbra”, “we”, “us”). We are the controller of the personal information described in this policy. We are an OnlyFans management agency. Our public site does one thing: it lets a creator apply, book a call, or subscribe to our newsletter.

For anything in this policy, write to team@umbramodels.com.

What we collect

There is no shop, no payment page, and no public sign-up on this site. We only hold what you type into one of three forms, plus a small amount of technical data that every web server sees.

When you apply

Your name, email address, Instagram handle if you give one, a rough figure for your current monthly earnings if you give one, the message you write, and an optional photo you choose to upload. Photos are stored with our upload provider and are visible only to our team.

When you book a call

Your name, email address, and the date, time, and time zone you select.

When you subscribe to the newsletter

Your email address and which page you subscribed from.

Alongside any of those

Your IP address, your browser’s user agent string, the time of submission, and whether our notification email to ourselves was delivered. We keep these to answer you, to stop automated abuse of the forms, and to prove what happened if a submission is disputed.

When you simply read the site

We run our own first-party page counter. It records the page path, the referring page, a country code supplied by our host, whether the request looked like a bot, and a visitor identifier that is a salted hash of your IP address and user agent. The salt rotates every day, so the identifier cannot be tied back to you and cannot be linked across days. We never store your raw IP address in the analytics table, and there is no third-party analytics or advertising tag anywhere on this site. See our cookie notice.

Security records

We log rate-limit counters and security events such as blocked or repeated form submissions. These may contain an IP address and the route that was hit.

If you are a signed client using the portal

Our training portal at /portal is invite only and closed to the public. For the people we invite, we hold an account record (email address, name, and role) and progress against the training courses. Access requires a session cookie, which is described in the cookie notice.

Why we use it, and our lawful bases

Under the UK and EU General Data Protection Regulation we must have a lawful basis for every use. Ours are:

Steps taken at your request before a contract (Article 6(1)(b)). Reviewing your application, replying to you, and holding the call you booked.
Performance of a contract (Article 6(1)(b)). Running the client portal and delivering the services for talent we have signed.
Consent (Article 6(1)(a)). Sending you the newsletter. You can withdraw consent at any time and the withdrawal is effective immediately going forward.
Legitimate interests (Article 6(1)(f)). Keeping the site up and free of abuse, measuring in aggregate how many people read what, and keeping records of enquiries. We have weighed these against your interests and use the least identifying method we can, which is why analytics is hashed and salted rather than cookie based.
Legal obligation (Article 6(1)(c)). Retaining records where the law requires it, and responding to lawful requests.

We do not collect special category data through this site, and we ask you not to send it. Do not include health, sexual orientation, or biometric details in a form message. If you send them anyway, we will delete them.

Who else sees it

A small set of service providers process data on our instructions and are contractually bound to protect it. They are:

Supabase, our database and authentication provider, which stores the records described above.
Resend, which delivers our notification and newsletter email and manages the unsubscribe list.
UploadThing, which stores an application photo if you upload one.
Netlify, which hosts and serves the site.

Beyond those providers, we disclose personal information only when we are legally compelled, when we need to establish or defend a legal claim, or in connection with a merger or sale of the business, in which case you will be told. We do not sell your personal information and we do not share it for cross-context behavioural advertising.

How long we keep it

Security event logs: 90 days. Deleted automatically after that.
Page view records: 13 months. Deleted automatically after that. These contain no raw IP address and no name.
Rate limiting counters: 1 day.
Applications and call bookings: 24 months after our last contact with you, unless you ask us to delete them sooner or we sign you and the record becomes part of your client file.
Newsletter subscriptions: until you unsubscribe, after which we keep a suppression record of your email address so that we do not mail you again by accident.
Client portal accounts: for the duration of the engagement and 12 months afterwards, or longer where tax or contractual record keeping requires it.

Your rights

If you are in the UK, the European Economic Area, or Switzerland, you have all of the following rights. We honour them for everyone who asks, wherever they live.

Access. Get a copy of the personal information we hold about you, and an explanation of how we use it.
Rectification. Have inaccurate information corrected and incomplete information completed.
Erasure. Have your information deleted where we no longer need it, where you withdraw the consent it relied on, or where you successfully object to our use of it.
Restriction. Have us pause our use of your information while a dispute about its accuracy or our lawful basis is resolved.
Portability. Receive the information you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where that is technically feasible.
Objection. Object to processing we base on legitimate interests. If you object to direct marketing, we will stop with no questions asked.
Withdraw consent. Withdraw any consent you have given, at any time, without affecting the lawfulness of what we did before you withdrew it.
Complain. Lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner’s Office. In the EEA it is the authority for your country of residence. We would rather you came to us first so we can fix it.

How to exercise your rights

Email team@umbramodels.com from the address you used with us, and tell us which right you are exercising. If you write from a different address we will ask you a question only the account holder could answer, because handing your data to an impostor would be worse than a slow reply.

We respond within 30 days. If a request is unusually complex we may extend that by up to two further months and will tell you why inside the first month. Exercising a right is free. We charge nothing, and we will never treat you differently for asking.

One limit worth stating plainly: our page-view records are keyed to a daily-rotating salted hash, so we genuinely cannot locate your rows in that table. There is nothing there to return or erase, which is the point of collecting it that way.

International transfers

We operate from the United States and our service providers are based principally in the United States. If you are in the UK or the EEA, your information will be transferred outside your country. Where that happens, the transfer is covered by the UK International Data Transfer Addendum or the European Commission’s Standard Contractual Clauses in our contracts with those providers, together with the technical measures described in this policy. You can ask us for a copy of the relevant safeguard by emailing team@umbramodels.com.

Automated decision making

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you for that purpose. Every application is read and decided by a person. See where we use AI for the detail.

California privacy rights

This section is for California residents and uses the terms of the California Consumer Privacy Act as amended by the CPRA.

Categories we collect

Identifiers. Name, email address, Instagram handle, IP address.
Commercial and professional information. The earnings range you choose to share, the content of your message, and your status as an applicant or client.
Internet or network activity. Page path, referring page, user agent, and the hashed visitor identifier.
Coarse geolocation. A country code only. We do not collect precise location.
Visual information. A photo, only if you upload one with your application.

We collect these directly from you, or from your device when you load a page. We use them for the business purposes described in this policy. We keep them for the periods listed above.

Categories we disclosed in the last 12 months

Identifiers, commercial information, internet activity, coarse geolocation, and visual information were disclosed for a business purpose to the service providers named above, who may use them only to perform services for us.

Sale and sharing

We have not sold personal information and we have not shared it for cross-context behavioural advertising in the last 12 months, and we do not do so today. This site carries no advertising pixels, no ad-network tags, and no third-party trackers. Because there is nothing to opt out of, we do not display a “Do Not Sell or Share My Personal Information” link. If that ever changes we will add one before it does, not after. We do not knowingly sell or share the personal information of anyone under 16.

Your California rights

Know. Request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the parties we disclosed it to.
Delete. Request deletion, subject to the exceptions the statute allows.
Correct. Request correction of inaccurate personal information.
Opt out of sale or sharing. Available on request, although as stated we do neither.
Limit use of sensitive personal information. We do not collect sensitive personal information through this site, so there is nothing to limit.
Non-discrimination. We will not deny you service, charge you a different price, or give you a lesser standard of service because you exercised a privacy right.

Submit any of these to team@umbramodels.com. We verify your identity by matching the request to the email address on the record. An authorised agent may act for you with written permission that we can verify with you directly.

Marketing email

Every marketing email we send carries a working unsubscribe link and our physical postal address, as the CAN-SPAM Act requires. Unsubscribing takes one click, we honour it within 10 business days at the outside and usually within minutes, and we never charge or require you to log in or give a reason. You can also unsubscribe by emailing team@umbramodels.com with “unsubscribe” in the subject line.

Unsubscribing from marketing does not stop transactional email, for example a reply to your application or a confirmation of a call you booked. If you need a postal address for a formal notice, email us and we will provide one.

Where we use AI

We use AI tools in two places, and we would rather tell you than have you guess.

Drafting marketing and editorial copy. Some of the writing on this site, including articles in Insights, starts as an AI-assisted draft. A member of our team edits, fact checks, and approves everything before it is published. The claims, figures, and opinions are ours.
Internal tooling. We use AI assistants for ordinary internal work such as summarising notes, drafting internal documents, and building our own software.

Just as importantly, here is what AI does not do. It does not decide whether we accept your application. It does not score, rank, or filter applicants. It does not send you an automated reply pretending to be a person. If we ever publish an image or video generated by AI, we will label it as such.

Security

Form submissions are validated and rate limited. Lead records, security logs, and analytics tables are locked to server-side access only and are not reachable from a browser. Portal data is protected by database-enforced row level security, so one account cannot read another’s. No system is perfect, and we do not claim ours is. If you believe you have found a vulnerability, email team@umbramodels.com and we will work with you in good faith.

Age requirement

This site and our services are for adults. You must be at least 18 to apply, to book a call, or to subscribe. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information to us, email team@umbramodels.com and we will delete it.

Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects how we use information you have already given us, we will tell you by email before it takes effect.

Contact us

Privacy questions and rights requests: team@umbramodels.com.
Everything else legal: team@umbramodels.com.